Privacy Policy

1. Identity and Contact Details

The data controller for onira.studio (“Onira,” “we,” “us”) is Pyxel Bytes, the trading name of Biel Carpi, a sole trader registered under Andorran law.

• Trading name: Pyxel Bytes
• Operator: Biel Carpi
• Tax identifier (NRT): F-421466-S
• Address: Avinguda de les Nacions Unides 40, Escaldes-Engordany, Andorra
• Email: hello@onira.studio
• Website: onira.studio

For any privacy-related questions or requests, please contact us at the email address above.

As required by GDPR Article 27, we intend to designate an EU Representative as the Service scales. As a sole-trader microenterprise in the early stage, we are evaluating cost-proportionate representation options. In the meantime, EU residents may exercise their data protection rights by contacting us directly at the email above.

2. Scope and Applicability

This Privacy Policy applies to the website at onira.studio, the Onira web application, and all related services (collectively, the “Service”). It does not apply to third-party websites or services linked from Onira.

3. Data We Collect

3.1 Data You Provide

• Account information — name, email address, and password when you create an account.
• Prompts and creative instructions — the text prompts, scripts, mood selections, and other inputs you submit to generate videos.
• Payment information — billing details processed through Paddle.com, our Merchant of Record. We do not store your full credit card number.
• Support communications — messages and feedback you send us.

3.2 Data Collected Automatically

• Device and browser data — IP address, browser type, operating system, screen resolution, and device identifiers.
• Usage data— pages visited, features used, session duration, clicks, and interaction patterns.
• Cookies and similar technologies — see Section 12 and our Cookie Policy.
• Analytics data— collected via Google Analytics (GA4) to understand how the Service is used.

3.3 Data from Third Parties

If you sign in using a third-party provider (e.g., Google), we receive basic profile information (name, email, profile picture) as authorised by you. We may also receive payment confirmation data from Paddle.

4. How We Use Your Data

• Service delivery— to process your prompts through our AI pipeline and deliver generated videos.
• Account management — to create and maintain your account, manage subscriptions, and process payments.
• Communication— to send you launch updates, product announcements, and service notifications. You can opt out of marketing emails at any time.
• Analytics and improvement — to understand usage patterns, diagnose technical issues, and improve the Service.
• Security and fraud prevention — to protect against abuse, spam, and unauthorized access, including via rate limiting and access controls.
• Legal compliance— to comply with applicable laws, regulations, and legal processes.

5. Legal Bases for Processing

We are based in Andorra and comply with the Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (the Andorran data protection law, “LQPD”), which mirrors the GDPR in structure and rights. Because we serve users in the EU, the GDPR (Regulation 2016/679) also applies to our processing of EU residents' data. Under both frameworks, we rely on the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing your prompts to deliver the video generation service, managing your account, and processing payments.
• Consent (Art. 6(1)(a)) — sending marketing emails and placing non-essential cookies.
• Legitimate interest (Art. 6(1)(f)) — analytics to improve the Service, fraud prevention, and securing our infrastructure.
• Legal obligation (Art. 6(1)(c)) — retaining billing records as required by applicable tax law.

6. AI Processing and Third-Party AI Models

Onira is an AI video production platform. When you submit a prompt, your text instructions are sent to third-party AI models to generate scripts, narration, images, music, and video. The following providers may process your data:

Your prompts are sent to these providers on a pass-through basis solely to generate the requested content. We do not control how these providers process data beyond our contractual agreements with them. We encourage you to review their privacy policies.

7. No AI Model Training on Your Data

We do not use your prompts, scripts, or generated videos to train AI models. Onira uses third-party AI models and does not develop or train its own foundation models. Your creative inputs are used solely to deliver the service you requested. Note that third-party AI providers may have their own data usage policies — please refer to their privacy policies linked in Section 6.

8. Data Sharing and Recipients

We do not sell your personal data. We may share data with the following categories of recipients:

• AI model providers — as described in Section 6, to generate content.
• Payment processor — Paddle.com, our Merchant of Record, to process subscriptions and payments. Paddle handles payment processing, global tax compliance, and billing on our behalf. We do not store or process your payment card details; these are handled directly and securely by Paddle. By purchasing a Subscription, you also agree to Paddle's Buyer Terms and Privacy Policy.
• Analytics services — Google Analytics (GA4), to understand usage patterns.
• Hosting and infrastructure — Vercel and cloud providers that host the Service.
• Legal and regulatory — when required by law, court order, or to protect our rights.

9. International Data Transfers

Onira is based in the Principality of Andorra. Some of our service providers, including AI model providers, are based in the United States and other countries outside Andorra and the European Economic Area (EEA).

The European Commission has granted Andorra an adequacy decision (Commission Decision 2010/625/EU, confirmed adequate by the Commission's review report of 15 January 2024, COM(2024) 7 final). This means personal data transferred from the EU or EEA to Andorra does not require additional safeguards such as Standard Contractual Clauses.

For transfers from Andorra to countries without an adequacy decision, the position varies by provider:

• United States— Google (script, image, and video generation), ElevenLabs (narration, music, and sound), and our hosting provider Vercel are US-based. Each relies on Standard Contractual Clauses (EU Commission Decision 2021/914) as the transfer safeguard. Google and ElevenLabs publish Data Processing Addenda incorporating these clauses.
• China— the image-to-video model (Pixverse v6) is operated by a Chinese entity. No EU adequacy decision exists for China. We are in the process of obtaining Article 46 GDPR/LQPD transfer safeguards (Standard Contractual Clauses) from this provider. Until confirmed, transfers rely on the Article 49(1)(b) derogation: the transfer is necessary for the performance of the contract between you and Onira (generating the video you requested). You are notified of this limitation and the absence of an adequacy decision by this disclosure.

10. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data— retained for the duration of your account and for 30 days after account closure (to allow download of generated content), after which it is permanently deleted. If you exercise your right to erasure under GDPR/LQPD Article 17, we will delete your data within 30 days of your verified request.
• Prompts and creative inputs — retained for 90 days, then automatically deleted.
• Generated videos— available for download during your active subscription. Deleted 30 days after account closure.
• Payment and billing records — retained as required by applicable tax law (up to 5 years).
• Analytics data— retained for up to 26 months via Google Analytics.

11. Your Data Protection Rights

Under Andorran data protection law (Llei 29/2021) and, where applicable, the GDPR, all users have the following rights regarding their personal data:

• Right of access— obtain a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure— request deletion of your personal data (“right to be forgotten”).
• Right to restriction of processing — request that we limit how we process your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object— object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making — Onira does not make automated decisions with legal or similarly significant effects about you.

To exercise any of these rights, contact us at hello@onira.studio. We will respond within 30 days. For complex or numerous requests, we may extend this by a further two months and will notify you of the extension within the initial 30-day period, in accordance with GDPR Article 12(3).

You also have the right to lodge a complaint with the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades — APDA) at www.apda.ad, or with your local supervisory authority if you are located in the EU.

12. California Consumer Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know— request information about the categories and specific pieces of personal data we collect, use, and disclose.
• Right to delete— request deletion of your personal data.
• Right to correct— request correction of inaccurate personal data.
• Right to opt out of sale or sharing — we do not sell or share your personal data for cross-context behavioral advertising.
• Right to non-discrimination — we will not discriminate against you for exercising these rights.

To exercise your CCPA/CPRA rights, contact us at hello@onira.studio.

13. Children's Privacy

Onira is not directed at anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at hello@onira.studio and we will delete the data promptly.

14. Cookies and Tracking Technologies

We use cookies and similar technologies (including localStorage) to operate the Service, remember your preferences, and analyse usage. For a complete list of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

15. Data Security

We implement industry-standard security measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) for all data transmitted between your browser and our servers.
• Encrypted API connections to all third-party AI providers.
• Access controls limiting who can access personal data within our organisation.
• Regular security reviews of our infrastructure and code.

However, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach, we will notify the APDA within 72 hours as required by Andorran data protection law (Llei 29/2021) and, for breaches affecting EU residents' data, the relevant EU supervisory authority within 72 hours as required by GDPR Article 33. Affected individuals will be notified without undue delay where the breach poses a high risk to their rights.

16. EU AI Act Transparency Disclosure

Although Andorra is not an EU Member State, Onira places AI systems on the EU market as a third-country provider, bringing it within the scope of the EU Artificial Intelligence Act (Regulation 2024/1689) under its extraterritorial provisions (Article 2). In accordance with applicable AI transparency obligations, we disclose the following:

Onira classifies its AI video generation tool as a limited-risk AI system under the EU AI Act. It does not constitute a high-risk AI system as defined in Annex III of Regulation 2024/1689.

• Onira uses artificial intelligence systems to generate video content, including scripts, narration, images, music, and video footage.
• All content produced by Onira is AI-generated. Videos created through the Service are synthetic media.
• Users who publish AI-generated content may be required to label it as AI-generated under applicable laws and platform policies, including YouTube's AI disclosure requirements.

17. Third-Party Links

The Service may contain links to third-party websites and services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

18. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. The “Effective date” at the top of this page indicates when this version was last updated. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

19. Contact Us

If you have questions about this Privacy Policy, your personal data, or wish to exercise your rights, contact us at:

• Trading name: Pyxel Bytes
• Operator: Biel Carpi
• Tax identifier (NRT): F-421466-S
• Address: Avinguda de les Nacions Unides 40, Escaldes-Engordany, Andorra
• Email: hello@onira.studio