Privacy Policy

Account: the email address you sign in with (used for passwordless magic-link authentication).

Usage: your generation history and credit-ledger entries (what you generated, when, the tier and cost) so we can show your balance and history and operate the credit system.

Payment metadata: when you buy credits, our payment provider processes the transaction and we receive metadata such as the pack purchased and a payment identifier. We do not see or store your full card details.

The briefs, prompts, uploaded images and brand details you submit are processed to generate your creative, as described below.

Face and character photos: if you upload a photo of yourself or another person to cast in your ad, that image is sent to our AI image provider solely to generate the output you requested. We do not store uploaded face or character photos in our own systems, and we do not use them to train any AI model. Each provider's own handling of the image is governed by its own privacy policy (see Sub-processors below).

Reference thumbnails: for each image you generate we keep one small thumbnail of the result (256 pixels on the long edge) alongside that generation's history row, so our support team can see what a generation produced when you report a problem with it. Thumbnails are visible only to the operator, are never published or shared, are not used to train any AI model, and are automatically deleted after 90 days. The full-resolution image is never stored on our systems — it is delivered to your browser and is yours to download. Email support@shakl.me if you want a thumbnail deleted sooner.

We rely on the following third parties to run the Service, and share only what each needs:

OpenAI, our primary image provider; receives your prompts and any uploaded reference, product or character images to generate scenes. OpenAI may retain these API inputs and outputs for up to 30 days to monitor for abuse and then deletes them, and does not train its models on them by default. See OpenAI's privacy policy.

fal.ai, which generates your videos from the images and text you provide, and also serves as a fallback image provider when our primary provider is unavailable or declines a prompt; it receives the same prompts and any uploaded reference, product or character images to generate scenes. fal.ai does not use this content to train its models. See fal.ai's privacy policy.

Supabase, provides authentication and the database (your email, credit ledger and generation history).

Dodo Payments, processes payments as our Merchant of Record (handles the transaction and billing).

Vercel, hosts and serves the application.

Resend, sends our emails, such as sign-in links and account notices; it receives your email address and the message.

Sentry, receives error reports from our servers (the error, the page or request it came from, and an internal account ID, never your email) so we can find and fix problems.

Cloudflare Turnstile, checks on the sign-in screen that a person, not a bot, is signing up; Cloudflare receives technical data from your browser for that check.

Upstash, stores short-lived request counters, keyed to your account ID, that limit how fast requests can be made.

Brand-kit lookups, when you use the optional brand-logo or brand-website feature, the Service fetches your brand's public website and public logo/favicon sources (including Clearbit and Google's favicon service) to pull a logo and colors. This happens only when you provide a brand name or URL.

We keep what we store on your device to what the service needs.

Sign-in. A Supabase authentication cookie keeps you signed in.

Preferences and app state. Small cookies and your browser's local storage remember your language, notices you have dismissed, whether you have seen the studio tour, a brief you started before signing in (kept up to 7 days), and a log of your recent generations, including your ad text (the latest 50). These stay in your browser until you clear its data, except the brief and your generation log, which are removed when you sign out.

Usage measurement. A random, anonymous ID in local storage lets us count how the app is used, in our own event log. We also use Vercel Web Analytics to count page visits; it sets no cookies and stores nothing on your device.

Sign-in protection. The sign-in screen uses Cloudflare Turnstile to stop automated sign-ups, and a device marker in your browser stops repeat free-trial claims.

Payments. Checkout runs on our payment processor's page (Dodo Payments). The processor and its providers set their own cookies and tools there, under their own privacy policies.

We do not use advertising trackers.

You can request deletion of your data by emailing support@shakl.me. Account deletion is currently a manual operator action. We will remove your account and associated records on request, within 30 days; copies in our database backups expire within 8 days after that.

When you delete your account, we keep a record of past credit transactions for our accounts, with your email and the link to your account removed. To prevent repeat free-trial claims, we keep a device marker for 90 days, not linked to your account.

Operator: Shakl (formerly Tarweej) is operated by an independent operator based in Dubai, United Arab Emirates (not a registered company). Full operator details are on file with our payment processor, Dodo Payments. Contact: support@shakl.me.