1. Who we are and what this covers
SunnyClips ("SunnyClips", "we", "us") is operated by Youkla. This Privacy Policy explains what personal data we collect when you use sunnyclips.com and the SunnyClips apps and services (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the rights you have over it.
SunnyClips makes short animated stories in which your child is the hero. You upload a photo, pick a moment and a look, and we generate the story as a video and a printable book.
We are the data controller for the personal data described here. If you have any question about this policy, write to [email protected].
2. The data we collect
We collect only what the Service needs to work. Here is the full list.
| Category | What it includes | Why we need it |
|---|---|---|
| Account | Name, email address, profile picture from your sign-in provider, sign-in method | To create and secure your account and to email you when a story is ready |
| Characters | One photo per character, the name you give them, their role (child, parent, sibling, pet), age range and gender | To draw that character consistently in every scene |
| Places | A photo of a room, if you choose to use your own, and the name you give it | To draw your scenes in that room |
| Moments | The moment you pick, or the words you write to describe your own | To write the story |
| Stories we make | Generated images, videos, narration audio, and story books | To show them in My stories, let you download or print them, and continue a series |
| Billing | Plan, stories left, payment status, invoices, Stripe customer id | To bill you and to answer billing questions. Card numbers go to Stripe, never to us |
| Usage and device | Pages visited, actions taken, browser type, approximate location from IP address, error reports | To keep the app working, find bugs, and prevent abuse |
| Messages | Anything you write to support, including screenshots you attach | To answer you |
We do not collect government identifiers, precise location, biometric templates, or health data, and we do not build profiles of you from third-party sources.
3. Photos and other files you upload
When you upload a photo we resize it to about 1,000 pixels and keep that one small JPEG. It is stored in a folder tied to your account under a random 21-character file name, encrypted at rest, and only ever sent over HTTPS.
A character photo is used for one thing: drawing that character. It is shown to the image model once per look to produce a reference sheet, and every scene is drawn from that sheet. A room photo is used the same way to draw your scenes. Photos are never shown in anyone else's story, never posted publicly, and never used in marketing.
Our AI providers process photos and story text under paid business terms that forbid them from using your content to train their models. We do not train models on your content either. Nobody at SunnyClips opens your photos unless you ask us to look at a specific problem.
Delete a character or a place and its photo and the reference drawings made from it are removed from our storage right away. Delete a story and it disappears from your library. Ask us to close your account and every photo, story, and record tied to it is deleted, apart from invoices we must keep for tax law.
4. Children
SunnyClips is for parents. We do not knowingly collect information directly from anyone under 18. Photos of children are uploaded by you, the adult account holder. By uploading a photo of a child you confirm that you are their parent or legal guardian, or that you have that person's permission, and you consent to our processing of the photo as described here. This is our legal basis for handling a child's image, and it is the only reason we handle one.
Anyone under 18 may not create an account. If you believe a child has given us personal data directly, or that a photo of a child was uploaded without a parent's or guardian's permission, write to [email protected] and we will delete it.
5. Why we process your data, and the legal basis
Where the GDPR, UK GDPR, or a similar law applies, we rely on the following legal bases:
- Performing our contract with you. Creating your account, generating what you asked for, storing it in your library, billing you, and answering your support requests.
- Consent. Handling photos of other people, including your children, which you confirm you have permission to upload. Marketing emails, where you opted in. Analytics and advertising cookies on marketing pages, where the law requires consent. You can withdraw consent at any time; withdrawing it does not affect processing that already happened.
- Legitimate interests. Keeping the Service secure, preventing abuse and fraud, measuring which features fail, and improving the Service. We balance these interests against your rights and do not rely on them for anything you would not reasonably expect.
- Legal obligations. Keeping billing records for tax and accounting law, and answering lawful requests from authorities.
We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
6. Who we share data with
We never sell personal data. We never share it with data brokers or advertisers for their own use. We share it only with the service providers below, who process it on our instructions, under contracts that limit what they may do with it.
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare R2 | Encrypted storage and delivery of the files you upload and the files we make for you | Global edge network |
| Stripe | Payments and subscription billing. Card numbers go to Stripe, never to our servers | United States / EU |
| Mailgun | Transactional email: sign-in codes, receipts, ready notifications | United States / EU |
| Google (Gemini API) | AI text and image generation under paid API terms that exclude training on your data | United States |
| ElevenLabs | Voice narration generation | United States |
| PostHog | Product analytics so we can see which screens fail or confuse | United States / EU |
| Google Analytics, Meta Pixel, TikTok Pixel | Aggregate traffic and ad measurement on marketing pages | United States |
We may also disclose data if the law requires it, to protect the rights and safety of you, us, or others, or as part of a merger or sale of Youkla, in which case this policy continues to apply to your data.
7. Cookies, analytics and advertising
The Service uses a small number of cookies and similar technologies:
- Strictly necessary. Signing you in, remembering your session and your preferences. These cannot be switched off without breaking the Service.
- Analytics. PostHog and Google Analytics tell us which screens are used, which fail, and where people get stuck. Data is aggregated; we do not use it to identify you.
- Advertising measurement. On marketing pages only, Meta Pixel and TikTok Pixel let us see whether an ad led to a sign-up. They do not run inside the app after you sign in.
You can block cookies in your browser settings, opt out of ad measurement through Meta and TikTok's own ad settings, and use browser extensions that block trackers. Blocking necessary cookies will prevent sign-in.
8. International transfers
Our providers operate in the United States and the European Union. When personal data leaves the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework, and we take additional measures where a transfer risk assessment calls for them.
9. How long we keep data
- Account data stays for as long as your account exists.
- Uploaded files and generated content stay until you delete them, or until we delete your account at your request.
- Billing records are kept for as long as tax and accounting law requires, typically seven years.
- Server logs and analytics events are kept for up to 12 months.
- Support conversations are kept for up to 24 months so we can follow up on earlier issues.
When data is no longer needed we delete it or anonymise it so it can no longer be linked to you.
10. How we protect data
- Every connection to the Service is encrypted with TLS.
- Files are stored encrypted at rest, in per-account folders, under random file names that cannot be guessed or enumerated.
- Our database is encrypted in transit and access to it is limited to the systems that need it.
- Payment card details are entered directly into Stripe and never pass through our servers.
- Access to production systems is restricted to the people who operate the Service, protected by multi-factor authentication, and logged.
No system is perfectly secure. If we discover a breach that affects your personal data we will tell you and the relevant authority without undue delay, as the law requires.
11. Your rights
Depending on where you live you have some or all of the following rights, and we honour them for everyone, wherever you are:
- Access. Ask for a copy of the personal data we hold about you.
- Correction. Ask us to fix data that is wrong.
- Deletion. Ask us to delete your data. Most content you can delete yourself inside the Service; for the whole account, write to us.
- Portability. Receive the data you gave us in a machine-readable format.
- Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause it while we check a request.
- Withdraw consent. For anything we do on the basis of consent.
- Complain. Lodge a complaint with your data protection authority. In the EU that is the authority of the country where you live; in the UK it is the Information Commissioner's Office.
California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. We have not sold personal information in the preceding 12 months.
Other US states. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising and profiling. We do not engage in profiling that produces legal or similarly significant effects.
To exercise any right, write to [email protected] from the email address on your account, or use the contact page. We verify requests by confirming control of that email. We answer within 30 days, or within the shorter period your local law requires, and we never charge for a request unless it is clearly unfounded or repetitive. You may authorise someone else to make a request on your behalf; we will ask for proof of that authorisation.
12. Marketing emails
We send transactional emails you cannot opt out of while you have an account: sign-in codes, receipts, and notices that something you made is ready. We send marketing emails only if you asked for them, and every one has an unsubscribe link.
13. Links to other sites
The Service may link to sites we do not control, such as Stripe's checkout or a payment receipt. Their privacy policies apply there, not this one.
14. Changes to this policy
When we change this policy we update the date at the top. If a change reduces your rights or changes how we use existing data in a way you would not expect, we email account holders before it takes effect.
15. Contact
- Youkla, operator of SunnyClips
- Privacy requests: [email protected]
- Everything else: [email protected]
These Terms and any dispute arising from the Service are governed by the laws of the country in which Youkla is established, without regard to conflict-of-law rules, and subject to the mandatory consumer protection rules of the country where you live.
Questions about this page?
Write to [email protected] and a person will answer.