Privacy Policy

Aurray Studio ("we", "us") is a UK service that makes videos and pictures with AI and runs social media for small businesses. It is run by AURRAY STUDIO LTD, a company registered in England and Wales (company number 17524739), registered office Flat 20 Florence Mansions, Vivian Avenue, London, NW4 3UY, which is the controller of your personal data. This page explains what personal data we collect, why we need it and what control you have. We follow UK GDPR wherever you use Aurray from.

• Your account: your name and email address. If you use a password, we store only a scrambled (hashed) version, never the password itself. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your business: your website address, details you tell us (such as what you sell and where you are), and what we read from your public website: text, product names, prices and photos.
• What you make and upload: your projects, scripts, prompts, photos, audio and video, and the posts and videos we make for you.
• Connected social accounts: when you connect Instagram, Facebook, YouTube, TikTok or X, we keep the access key (token) that lets us post for you, plus the account's name, handle and picture. If you turn on "Use photos from my Instagram and Facebook posts", we also copy photos from your own posts so we can use them in new posts. That setting is off by default.
• Payments: handled by Stripe. We receive your plan and payment status, never your full card number.
• How you use Aurray: pages visited, buttons used, browser, device and IP address, mainly to keep things secure and working.

• To run Aurray: make your videos, pictures and posts, save your work, and take payments.
• To post to your social accounts the posts you have approved, at the times you chose.
• To contact you about your account, billing, security and support. We send marketing emails only if you said yes, and every one has an unsubscribe link.
• To keep Aurray safe: preventing abuse, fraud and misuse of credits.
• To fix problems and improve Aurray.

We don't sell your data. We don't use your content or business information to train AI models.

This section explains exactly what we do with data from Google.

Sign in with Google. We receive your name, email address and profile picture. We use them only to create your account and sign you in.

Connecting YouTube. When you connect a YouTube channel, Google asks you to allow two things:

• Upload videos (youtube.upload): to upload the videos you approve to your channel, at the time you scheduled.
• See your channel (youtube.readonly): to read your channel's name and ID, so you can see which channel is connected and which business it posts for.

We don't read your other videos, comments, subscribers or watch history. We never upload anything you haven't approved. We don't use Google data for advertising, we don't sell it, we don't use it to train AI models, and our staff don't look at it unless you ask us to help, it's needed for security, or the law requires it.

Aurray Studio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Aurray Studio uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy.

Turning it off. Disconnect YouTube in Aurray (My Business → Accounts) at any time. We then cancel our access with Google and delete the access key and channel details we stored. You can also remove Aurray's access from your Google account at myaccount.google.com/permissions. Videos already posted stay on your channel until you delete them on YouTube.

When you connect a Facebook Page or an Instagram professional account, Facebook asks you to allow these. Here is what each one is for:

• See your Pages (pages_show_list): to list the Pages you manage, so you can pick the one Aurray posts to, and to find the Instagram account linked to it.
• Read your Page (pages_read_engagement): to read the Page's name and picture, check that a post went out and get its link, and - only if you turn on "Use photos from my Instagram and Facebook posts" - read the photos your Page has posted.
• Post to your Page (pages_manage_posts, publish_video): to publish the posts and videos you approve, at the times you chose.
• Your Instagram account (instagram_basic, instagram_content_publish): to read the account's username and picture, publish the posts and reels you approve, and - only with that photo setting on - read the photos you have posted.
• Business accounts (business_management): many Pages and Instagram accounts belong to a Meta business portfolio. This lets Aurray find those, so you can connect them.

We don't read your messages, comments, followers, friends or ads, and we never post anything you haven't approved. We don't sell this data, use it for advertising, or use it to train AI models.

To make your content, we send your prompts, scripts, business details and photos to AI providers we have contracts with. They use the data only to produce your result, not to train their models.

Only companies that help us run Aurray, and only what they need:

• Stripe, for payments;
• our cloud hosting and storage providers;
• the AI providers described above;
• our email provider, to send account and (if you agreed) marketing emails;
• the social platforms you connect, when we post what you approved.

We may also share data if the law requires it, or to protect people or Aurray from harm or fraud.

We use only the cookies and browser storage needed to keep you signed in and remember simple choices. We don't use advertising or cross-site tracking cookies.

• Your account and projects: while your account is open.
• Connected account keys: until you disconnect the account or delete your Aurray account.
• When you delete something, we remove it from our live systems. We keep only what the law requires, such as billing records for tax.

Some of our providers, including some AI providers, work outside the UK (for example in the United States). When they do, we use approved legal safeguards such as Standard Contractual Clauses to protect your data.

• A connected account (Facebook, Instagram, YouTube, TikTok or X): disconnect it in Aurray under My Business → Accounts. We cancel our access with the platform where it allows that, and delete the access key and account details we stored, straight away.
• Facebook and Instagram: you can also remove Aurray in Facebook under Settings → Apps and websites. That cancels our access; email us if you also want everything we hold about that account deleted.
• Photos from your posts: turning off "Use photos from my Instagram and Facebook posts" stops us using them. To have the copies deleted too, email us.
• Everything: email support@aurray.co.uk from your account's email address and ask us to delete your account. We delete your account, projects, businesses, photos and connected accounts within 30 days, and confirm by email. We keep only what the law requires, such as billing records for tax.

You can ask us for a copy of your data, or ask us to correct it, delete it, limit how we use it, or send it to another service. You can also object to how we use it. Email support@aurray.co.uk and we'll reply within one month. If you're unhappy with how we handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Aurray isn't for children under 16, and we don't knowingly collect their data.

We encrypt data in transit, hash passwords, encrypt stored access keys, and limit who can access what. No system is perfect. If a breach puts your data at real risk, we'll tell you.

If we make a big change, we'll tell you by email or in the app before it takes effect.

Email support@aurray.co.uk, call +44 7881 153992, or write to us at Hendon, London NW4 3UY, United Kingdom. See also our Contact page and Terms of Service.