Publish Back to site

Privacy Policy

Effective July 1, 2025

This policy explains what personal information Publish Labs Ltd. (“we”) collects when you use Polish, why we collect it, how long we keep it, and what rights you have. If anything here is unclear, email us at privacy@genapps.online.

Short version. We collect only what we need to run the Service: account info, the content you submit for review, and standard operational logs. We never sell your data. We never train foundation models on your content.

1. Who is responsible for your data

The data controller for your personal information is:

Publish Labs Ltd.
123 Creator Street, London, EC1A 1BB, United Kingdom
Contact: privacy@genapps.online

2. What we collect

Account data

  • Email address (required)
  • Display name (optional)
  • Password hash (we never store plaintext passwords)
  • Workspace and team-membership metadata

Content you submit

  • Scripts, titles, descriptions, thumbnails, uploaded video files
  • Analysis results and reports generated by the Service

Billing data

Billing is handled by our Merchant of Record, Lemon Squeezy. We receive a subscription status, plan tier, and invoice history from Lemon Squeezy — we never see or store your full payment card number. Lemon Squeezy’s privacy notice is at lemonsqueezy.com/privacy.

Operational data

  • IP address (used for rate limiting and abuse prevention)
  • Browser and OS user-agent
  • Timestamps of requests
  • Aggregate feature-usage counts (which pages, how often)

What we do NOT collect

  • We do not collect biometric data.
  • We do not use third-party ad-tracking pixels.
  • We do not read your emails, DMs, or accounts on other platforms.
  • We do not sell personal information to anyone, ever.

3. Why we process your data (legal bases)

Under GDPR, we process personal data on these legal bases:

  • Contract — to provide the Service you signed up for.
  • Legitimate interest — to secure the Service, prevent abuse, and improve quality.
  • Legal obligation — to comply with tax, accounting, and law-enforcement requests.
  • Consent — where required (e.g. non-essential cookies, marketing emails).

4. AI processing of your content

To produce a review, we send your submitted content to NVIDIA NIM(our large-language and vision-model provider) over an encrypted connection. NVIDIA processes the content transiently to generate the review response and does not retain it for model training. See NVIDIA’s privacy policy.

We do not use your content to train our own models, or any third party’s models, without your explicit prior consent.

5. Sub-processors we use

We rely on these vendors to run the Service. Each is bound by data-processing agreements.

  • Lemon Squeezy — payments, tax, invoicing
  • NVIDIA (NIM API) — LLM and vision-model inference
  • Vercel / hosting provider — application hosting and edge CDN
  • Neon or Supabase — application database
  • UploadThing or Cloudflare R2 — file storage for uploaded video assets
  • Resend — transactional email delivery
  • PostHog — anonymized product analytics (opt-out available)
  • Sentry — error monitoring

A current list is maintained at /legal/subprocessors and will be updated whenever it changes.

6. How long we keep your data

  • Account and profile: while your account is active, plus 30 days after cancellation to allow re-activation.
  • Submitted content and reports: while your account is active. On deletion, purged within 30 days.
  • Invoices: retained for 7 years to satisfy tax and accounting law.
  • Support conversations: 24 months.
  • Server logs: 90 days.

7. Your rights

Regardless of where you live, you have the right to:

  • Access — request a copy of your personal data.
  • Correct — fix inaccurate or incomplete data.
  • Delete — have us erase your account and content (see below).
  • Export — receive your data in a portable format.
  • Object — opt out of processing that relies on legitimate interest.
  • Withdraw consent — where processing is based on consent.

Exercise any of these rights from Settings › Data, or by emailing privacy@genapps.online. We respond within 30 days.

8. California residents (CCPA/CPRA)

California residents have the additional rights to (a) know what personal information we collect and disclose about them, (b) delete that information, (c) correct inaccuracies, (d) opt out of “sale” or “sharing” of their personal information, and (e) not be discriminated against for exercising these rights. We do not sell personal information as defined by CCPA/CPRA.

9. International transfers

Your data may be processed in countries outside your own, including the United States. Where we transfer data out of the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses or an equivalent legal mechanism to protect your rights.

10. Security

We use TLS 1.2+ for all data in transit and encryption at rest for stored data. Passwords are hashed with a modern KDF. Access to production systems is limited and logged. Despite these measures, no system is 100% secure — if we discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

11. Cookies

See our separate Cookie Policy for what we use, why, and how to change your preferences.

12. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have, contact privacy@genapps.online and we will delete it.

13. Changes to this policy

We’ll notify you in-app and by email at least 14 days before any material change takes effect. Non-material changes take effect on publication.

14. Complaints

If you are in the EU/EEA/UK and believe we have not handled your data lawfully, you may lodge a complaint with your local data-protection authority. We’d appreciate the chance to address your concern first — reach us at privacy@genapps.online.