UPDATED 29 OCTOBER 2026
Your data in UFIYO
This notice describes the current text and audio pilot. No paid plan is active. Contact the operator if you want access to, correction of or erasure of your data.
1. Controller and contact
Daniel Gresl, Czech business ID (IČO) 04906870, Korunní 2569/108, Vinohrady, 101 00 Praha 10, Czech Republic, is the controller for UFIYO’s use of personal data. Contact: support@ufiyo.com.
2. What is processed and why
Google/Firebase supplies a stable account identifier, verified email and profile name for Google sign-in. The UFIYO server verifies this identity to protect the account and assign credits. It stores account preferences, optional brand context, saved projects, generation history, outputs and credit/job records. It receives briefs and any conversation context needed for a creation. Technical service providers also process connection and security information needed to deliver and protect the service.
Providing the account, creation and storage functions is necessary to perform the service requested by the user. Security, preventing abuse and enforcing credit limits rely on the operator’s legitimate interests. Any legal record-keeping obligation applies separately. The current pilot has no newsletter signup, advertising profile or automated decision about a person’s eligibility for employment, credit or a comparable significant outcome.
3. Providers and transfers
Google/Firebase handles Google sign-in. UFIYO does not receive your Google password and does not request access to Gmail messages or Drive files. OpenAI receives the brief, selected task settings and any optional brand/conversation context needed to generate the result. For text creation, the Responses API call requests that the response not be stored through the Responses storage feature; this does not mean every provider security log is immediately erased.
Sites and its Cloudflare infrastructure host the application and account records. The private preview can additionally require the owner’s Sites/ChatGPT sign-in. Stripe processes clearly labelled sandbox checkout tests; real customer payments are not enabled in this pilot. Providers can process information outside the European Economic Area. Their applicable contracts and transfer safeguards must be considered when operating the service internationally.
Audio tools
For text to voice, the entered script and selected voice are sent to OpenAI. Generated audio is stored privately with your account on Sites / Cloudflare R2 and is accessible only after account verification. For transcription, a selected recording stays on your device until you start; the browser converts up to 60 seconds to audio before sending it to OpenAI through UFIYO. The original recording is not persisted in UFIYO storage. The resulting transcript and credit/job record remain with your account. We also record the terms version, time of acceptance and adulthood confirmation without requesting your birth date. Only upload recordings you are entitled to process.
ElevenLabs voice and Google music/video are being prepared and are not currently enabled for customer generation. Before enabling another provider we will update this notice to describe the data it receives. UFIYO is an application using external AI services; it does not claim to have trained the underlying models.
4. Retention and deletion
Saved projects, history and account settings remain with the account so work can be resumed. Archiving hides a project from the active list and can be reversed; it does not erase it. You can request closure and erasure by email. The operator verifies the request and retains only information still needed for an applicable legal obligation or a justified claim. Provider security logs and backups follow the respective provider’s retention rules.
5. Cookies and device storage
The service uses necessary login/session technology and local storage for choices such as language, favourites and reduced motion. Firebase manages its sign-in session. The service worker stores a generic offline page and app icons, not private API responses. This pilot does not include an advertising or audience-analytics tracker.
6. Your rights
Depending on the applicable law, you can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it. Requests can be sent to the contact above. You can complain to the Czech Office for Personal Data Protection or your competent supervisory authority. More information is available from the European Commission.