Privacy Policy

1. Identity and Contact Details

The data controller for onira.studio (“Onira,” “we,” “us”) is Hyperion Apps LLC, a Wyoming Limited Liability Company operating under the Hyperion Lab brand.

• Legal company: Hyperion Apps LLC
• Brand: Hyperion Lab
• Mailing address: 1309 Coffeen Avenue STE 19519, Sheridan, Wyoming 82801, United States
• Email: hello@onira.studio
• Website: onira.studio

For any privacy-related questions or requests, please contact us at the email address above.

As required by GDPR Article 27, we intend to designate an EU Representative as the Service scales and where that requirement applies. In the meantime, EU residents may exercise their data protection rights by contacting us directly at the email above.

2. Scope and Applicability

This Privacy Policy applies to the website at onira.studio, the Onira web application, and all related services (collectively, the “Service”). It does not apply to third-party websites or services linked from Onira.

3. Data We Collect

3.1 Data You Provide

• Account information — name, email address, and password when you create an account.
• Prompts and creative instructions — the text prompts, scripts, mood selections, and other inputs you submit to generate videos.
• Payment information — billing details processed by Stripe on behalf of Hyperion Apps LLC. We do not store your full credit card number.
• Support communications — messages and feedback you send us.

3.2 Data Collected Automatically

• Device and browser data — IP address, browser type, operating system, screen resolution, and device identifiers.
• Usage data— pages visited, features used, session duration, clicks, and interaction patterns.
• Cookies and similar technologies — see Section 12 and our Cookie Policy.
• Analytics data— collected via Google Analytics (GA4) to understand how the Service is used.

3.3 Data from Third Parties

If you sign in using a third-party provider (e.g., Google), we receive basic profile information (name, email, profile picture) as authorised by you. We may also receive payment confirmation data from Stripe.

4. How We Use Your Data

• Service delivery— to process your prompts through our AI pipeline and deliver generated videos.
• Account management — to create and maintain your account, manage subscriptions, and process payments.
• Communication— to send you launch updates, product announcements, and service notifications. You can opt out of marketing emails at any time.
• Analytics and improvement — to understand usage patterns, diagnose technical issues, and improve the Service.
• Security and fraud prevention — to protect against abuse, spam, and unauthorized access, including via rate limiting and access controls.
• Legal compliance— to comply with applicable laws, regulations, and legal processes.

5. Legal Bases for Processing

Hyperion Apps LLC is established in the United States. Because we serve users in the European Union and European Economic Area, the GDPR (Regulation 2016/679) may apply to our processing of those users' personal data. Where GDPR applies, we rely on the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing your prompts to deliver the video generation service, managing your account, and processing payments.
• Consent (Art. 6(1)(a)) — sending marketing emails and placing non-essential cookies.
• Legitimate interest (Art. 6(1)(f)) — analytics to improve the Service, fraud prevention, and securing our infrastructure.
• Legal obligation (Art. 6(1)(c)) — retaining billing records as required by applicable tax law.

6. AI Processing and Third-Party AI Models

Onira is an AI video production platform. When you submit a prompt, your text instructions are sent to third-party AI models to generate scripts, narration, images, music, and video. The following providers may process your data:

Your prompts and the production inputs required for the selected workflow, which may include user-supplied image references, are sent to the applicable providers on a pass-through basis solely to generate the requested content. Do not upload material unless you have the required rights and consents. We do not control how these providers process data beyond our contractual agreements with them. We encourage you to review their privacy policies.

7. No AI Model Training on Your Data

We do not use your prompts, scripts, or generated videos to train AI models. Onira uses third-party AI models and does not develop or train its own foundation models. Your creative inputs are used solely to deliver the service you requested. Note that third-party AI providers may have their own data usage policies — please refer to their privacy policies linked in Section 6.

8. Data Sharing and Recipients

We do not sell your personal data. We may share data with the following categories of recipients:

• AI model providers — as described in Section 6, to generate content.
• Payment processor — Stripe, to process subscriptions, one-time credit purchases, refunds, invoices, and fraud-prevention signals. Hyperion Apps LLC is the seller of the Service unless checkout states otherwise. We do not store or process full payment-card details; Stripe handles them under its Privacy Policy.
• Analytics services — Google Analytics (GA4), to understand usage patterns.
• Hosting and infrastructure — Vercel and cloud providers that host the Service.
• Legal and regulatory — when required by law, court order, or to protect our rights.

9. International Data Transfers

Hyperion Apps LLC is based in the United States. Some of our service providers, including AI model providers, are based in the United States and other countries outside the European Economic Area (EEA).

For transfers of EEA personal data to countries without an adequacy decision, the position varies by provider:

• United States— Google (script, image, and video generation), ElevenLabs (narration, music, and sound), and our hosting provider Vercel are US-based. Each relies on Standard Contractual Clauses (EU Commission Decision 2021/914) or another valid transfer mechanism as the transfer safeguard. Google and ElevenLabs publish Data Processing Addenda incorporating these clauses.
• China— the image-to-video model (Pixverse v6) is operated by a Chinese entity. No EU adequacy decision exists for China. We are in the process of obtaining Article 46 GDPR transfer safeguards (Standard Contractual Clauses) from this provider. Until confirmed, transfers rely on the Article 49(1)(b) derogation: the transfer is necessary for the performance of the contract between you and Onira (generating the video you requested). You are notified of this limitation and the absence of an adequacy decision by this disclosure.

10. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data— retained for the duration of your account and for 30 days after account closure (to allow download of generated content), after which it is permanently deleted. If you exercise your right to erasure under GDPR Article 17, we will delete your data within 30 days of your verified request.
• Prompts and creative inputs — retained for 90 days, then automatically deleted.
• Generated videos— available for download during your active subscription. Deleted 30 days after account closure.
• Payment and billing records — retained as required by applicable tax law (up to 5 years).
• Analytics data— retained for up to 26 months via Google Analytics.

11. Your Data Protection Rights

Where applicable privacy laws such as GDPR or CCPA apply, you may have the following rights regarding your personal data:

• Right of access— obtain a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure— request deletion of your personal data (“right to be forgotten”).
• Right to restriction of processing — request that we limit how we process your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object— object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making — Onira does not make automated decisions with legal or similarly significant effects about you.

To exercise any of these rights, contact us at hello@onira.studio. We will respond within 30 days. For complex or numerous requests, we may extend this by a further two months and will notify you of the extension within the initial 30-day period, in accordance with GDPR Article 12(3).

You also have the right to lodge a complaint with your local data protection supervisory authority if you are located in the EU or EEA.

12. California Consumer Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know— request information about the categories and specific pieces of personal data we collect, use, and disclose.
• Right to delete— request deletion of your personal data.
• Right to correct— request correction of inaccurate personal data.
• Right to opt out of sale or sharing — we do not sell or share your personal data for cross-context behavioral advertising.
• Right to non-discrimination — we will not discriminate against you for exercising these rights.

To exercise your CCPA/CPRA rights, contact us at hello@onira.studio.

13. Children's Privacy

Onira is not directed at anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at hello@onira.studio and we will delete the data promptly.

14. Cookies and Tracking Technologies

We use cookies and similar technologies (including localStorage) to operate the Service, remember your preferences, and analyse usage. For a complete list of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

15. Data Security

We implement industry-standard security measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) for all data transmitted between your browser and our servers.
• Encrypted API connections to all third-party AI providers.
• Access controls limiting who can access personal data within our organisation.
• Regular security reviews of our infrastructure and code.

However, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach, we will notify the relevant regulators and affected individuals as required by applicable law. For breaches affecting EU residents' data, we will notify the relevant EU supervisory authority within 72 hours as required by GDPR Article 33, and affected individuals without undue delay where the breach poses a high risk to their rights.

16. EU AI Act Transparency Disclosure

Onira places AI systems on the EU market as a third-country provider, bringing it within the scope of the EU Artificial Intelligence Act (Regulation 2024/1689) under its extraterritorial provisions (Article 2). In accordance with applicable AI transparency obligations, we disclose the following:

Onira classifies its AI video generation tool as a limited-risk AI system under the EU AI Act. It does not constitute a high-risk AI system as defined in Annex III of Regulation 2024/1689.

• Onira uses artificial intelligence systems to generate video content, including scripts, narration, images, music, and video footage.
• All content produced by Onira is AI-generated. Videos created through the Service are synthetic media.
• Users who publish AI-generated content may be required to label it as AI-generated under applicable laws and platform policies, including YouTube's AI disclosure requirements.

17. Third-Party Links

The Service may contain links to third-party websites and services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

18. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. The “Effective date” at the top of this page indicates when this version was last updated. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

19. Contact Us

If you have questions about this Privacy Policy, your personal data, or wish to exercise your rights, contact us at:

• Legal company: Hyperion Apps LLC
• Brand: Hyperion Lab
• Mailing address: 1309 Coffeen Avenue STE 19519, Sheridan, Wyoming 82801, United States
• Email: hello@onira.studio