นโยบายความเป็นส่วนตัว
Effective date: 25 September 2026
This Privacy Policy explains what personal data PlayU collects when you use the Services, why, who receives it, how long we keep it, and the rights you have. Terms that are capitalised but not defined here have the meaning given in the Terms of Service.
1. Who we are
1.1 The controller of your personal data is PlayU d.o.o., a limited liability company registered in the Republic of Serbia ("PlayU", "we", "us"). We decide why and how your personal data is processed.
1.2 For any question about this Policy or your personal data, or to exercise your rights, write to [email protected] with the subject line "Privacy".
2. Scope and the laws that apply
2.1 This Policy applies to the website at playu.ai, our applications, and every other part of the Services that links to it. It does not apply to third-party websites or services, including those of advertisers, sign-in providers and payment providers.
2.2 We process personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of the RS, No. 87/2018) (the "Serbian Data Protection Law"). Where the GDPR, the UK GDPR or another data protection law applies to our processing of your data, we also comply with that law, and you have the rights that it gives you.
2.3 The Services are for adults only. We do not knowingly collect personal data from anyone under 18 (see Section 14).
3. The personal data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Account data | Email address, username, nickname, avatar, language, country, and a password if you choose to set one (we store it only as a one-way hash) |
| Data from sign-in providers | When you sign in with Google, Telegram or another provider: your identifier at that provider, name, email address, profile picture and, for Telegram, the phone number if the provider shares it |
| Age and content settings | Your confirmation that you are 18 or older, whether you have chosen to see adult content, and the result of any age verification |
| Your Content | Prompts, photos and videos you upload (which may show your face or the face of another person), the images and videos generated for you, titles, descriptions, comments, likes, saves and follows |
| Purchase data | Items bought, prices, currency, payment method type, order and transaction references, the country of your payment instrument, and your phone number or bank code where a payment method requires it. We do not receive your full card number. For crypto-asset payments: the network, the asset, the sending wallet address and the transaction hash, which are public on the blockchain |
| Programme data | Your referral code, who invited you and whom you invited, rewards, and for affiliates, the payout details you provide |
| Communications | Messages you send to support, reports, appeals and complaints |
3.2 Data we collect automatically
| Category | Examples |
|---|---|
| Device and connection data | IP address, browser and operating system, user agent, language and time zone settings, screen and hardware characteristics, and network information |
| Device identifier | An identifier that we derive from the characteristics of your browser and device, and a key that we store on your device, used to recognise the device for security and fraud prevention (see Section 12) |
| Browser integrity signals | Results of checks that detect automation, tampering and emulated browsers |
| Location | Your approximate location (country or region), which we infer from your IP address and other technical signals. We do not collect precise GPS location |
| Usage data | Pages and items viewed, how long you watch a video and whether you skip it, searches, likes, the steps you take in the creation Studio, the plans and checkout pages you view, advertisements you see and click, the link or referral through which you arrived, and session identifiers |
| Session data | The devices signed in to your account, when each session started, and the IP address it started from |
3.3 Data we infer
- your content preferences, which we use to rank Explore and Feed for you (see Section 5);
- a fraud-risk assessment, for example whether several accounts share one device or network;
- your likely home country, and whether you appear to use a VPN, proxy or other tool that hides your location, used to apply geographic restrictions and Terms Section 2.5, show local payment methods and prevent fraud; and
- descriptive labels and a mathematical representation of each image (an "image embedding"), which describe what the image shows, such as style or subject, so that we can categorise and recommend content.
3.4 Sensitive data. Your choice to view adult content, the content you create, and your viewing and liking activity may reveal information about your sex life or sexual orientation. Photos you upload may show faces. We process this data only to provide the Services you ask for, as described in Section 4. We do not use your photos to identify you or anyone else, and we do not create facial recognition templates. A face in a photo is located only while the generation that uses it runs.
3.5 If you do not give us the data marked as required when you sign up or pay, we cannot provide the related feature.
4. Why we use your data, and our legal bases
We process personal data only when we have a legal basis under the Serbian Data Protection Law and, where it applies, Article 6 of the GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in, keep your sessions | Account, sign-in provider, session, device data | Performance of the contract with you |
| Generate, store and show Your Content, and publish what you choose to publish | Your Content, account data | Performance of the contract |
| Show adult content and personalise it | Age and content settings, usage data, inferred preferences | Your explicit consent, which you give when you choose to see adult content. You can withdraw it at any time |
| Sell Coin and plans, process payments, prevent payment fraud, handle refunds and chargebacks | Purchase, device, location data | Performance of the contract; our legitimate interest in preventing fraud |
| Keep accounting and tax records | Purchase data | Legal obligation |
| Protect the Services, detect bots, abuse, multiple accounts and fraud, and enforce the Terms | Device identifier, integrity signals, device and connection data, usage data, risk assessments | Our legitimate interest in keeping the Services and our users safe |
| Apply age and geographic restrictions required by law | Age settings, location | Legal obligation; our legitimate interest in complying with the laws of the countries where the Services are available |
| Rank and recommend content in Explore and Feed | Usage data, inferred preferences, image embeddings | Performance of the contract (a personalised feed is part of the Services); for adult content, your explicit consent |
| Measure and improve the Services, fix errors, and develop new features | Usage data, device data, Your Content in aggregate | Our legitimate interest in improving the Services |
| Show advertising and measure it | Usage data, approximate location | Our legitimate interest in funding the Services through advertising |
| Run rewards, referral and affiliate programmes | Programme data, usage data | Performance of the contract |
| Send service messages (sign-in codes, receipts, security and policy notices) | Email address, push subscription | Performance of the contract; legal obligation |
| Send marketing messages | Email address, push subscription | Your consent, or where the law allows, our legitimate interest in promoting similar services to existing customers. You can opt out at any time |
| Handle reports, appeals and legal requests, and establish or defend legal claims | Any relevant data | Legal obligation; our legitimate interest in protecting our rights and those of others |
Where we rely on legitimate interests, we have weighed them against your rights. You can object to this processing (see Section 10).
5. Personalisation and automated decisions
5.1 We use automated systems, including a statistical model trained on how users interact with content, to decide which content to show you and in what order. This is profiling. It does not produce legal effects for you or affect you in a similarly significant way. You can object to it by writing to us, and we will then show you content that is not personalised.
5.2 Automated systems also flag accounts that may be involved in fraud or abuse. A flag alone does not lead to a ban. A person reviews the evidence before we terminate an account for fraud or abuse.
6. AI providers and your content
6.1 To generate Output, we send your prompt and any photos or videos you use as a reference to AI model providers that process them on our behalf. We may also use an AI language model to improve your prompt and to check where faces are in a reference photo.
6.2 These providers may process your data only to perform the generation for us. The generated file is copied to our own storage, and we require providers to delete the data within a short period after the generation ends.
6.3 We do not use your prompts, uploads or Output to train generative AI models, and we do not allow our AI providers to do so. We use usage data to train our own content ranking model (Section 5), and we compute image embeddings to categorise and recommend content (Section 3.3).
7. Who receives your data
7.1 We do not sell your personal data, and we do not share it with third parties for their own advertising.
7.2 Service providers (processors). These providers process personal data on our behalf, under our instructions and under a written data processing agreement:
| Category of provider | Service | Data |
|---|---|---|
| Cloud infrastructure providers | Hosting, content delivery, file storage, media conversion, network security | All data that passes through or is stored in the Services |
| AI model providers | Image and video generation, face and head replacement, prompt improvement, face location | Prompts, reference images and videos, Output |
| Email delivery provider | Sending email | Email address, email content |
| Payment service providers | Payment processing | Purchase data, the contact details that a payment method requires |
You can ask us for the names of the providers in a category by writing to [email protected].
7.3 Independent controllers. These parties decide for themselves how they use the data they receive, under their own privacy policies:
- Sign-in providers (Google, Telegram and others you choose), which receive the fact that you sign in to PlayU.
- Google reCAPTCHA, which we use to tell people from bots when you sign in and on other protected pages. Google receives your IP address and information about your browser and interaction. Google's Privacy Policy and Terms of Service apply.
- Browser push services (for example Google, Mozilla or Apple), which deliver push notifications if you turn them on.
- Payment providers and banks in their own right, where the law requires them to process data, for example for anti-money-laundering checks.
- Public blockchains, where crypto-asset transactions are permanently public.
- Network test servers. To determine network conditions and your approximate location for fraud prevention and geographic restrictions, your browser may contact third-party servers, including Cloudflare's and public connectivity and STUN servers. These servers receive your IP address.
7.4 Other users and the public. Your username, nickname, avatar, public profile, the content you publish, your comments and likes on public content, and the number of your followers are visible to other users and may be visible to anyone on the internet, including search engines. Private content is visible only to you.
7.5 Advertisers receive only aggregated reports, such as the number of times an advertisement was shown or clicked. They do not receive your identity.
7.6 Authorities and legal claims. We disclose data to courts, the police, regulators and other public authorities when the law requires it, when it is necessary to report or prevent a crime (in particular child sexual abuse material, see Terms Section 8.2), or to establish, exercise or defend legal claims.
7.7 Business transfers. If PlayU is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred to the other party under confidentiality obligations. We will tell you before your data becomes subject to a different privacy policy.
7.8 With your consent. We share data with other parties when you ask us to, for example when you share content to another platform.
8. International transfers
8.1 Where your data is stored.
- If you live outside the European Economic Area, your personal data is stored on our servers in Chicago, United States.
- If you live in the European Economic Area, your personal data is stored in the Netherlands, inside the European Union, and is protected by the GDPR.
Some of our service providers process data in other countries, as needed to provide their service to us.
8.2 When we transfer personal data from Serbia, or from the European Economic Area or the United Kingdom, to a country that is not recognised as providing an adequate level of data protection, we protect it with appropriate safeguards. These are the standard contractual clauses adopted by the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, the standard contractual clauses of the European Commission, or the UK International Data Transfer Addendum, as applicable, together with encryption and access controls.
8.3 You can ask for a copy of the safeguards by writing to [email protected].
9. How long we keep your data
We keep personal data only as long as we need it for the purposes in Section 4, and then delete or anonymise it.
| Data | How long we keep it |
|---|---|
| Account data and settings | While your account is open, then up to 30 days after it closes |
| Your Content (uploads, prompts, Output, comments) | Until you delete it or your account closes; then deleted from our storage within 30 days |
| Backups | Up to 30 days after the data is deleted from the live systems |
| Purchase and accounting records | For the period required by Serbian accounting and tax law, up to 10 years after the end of the year of the transaction |
| Affiliate commissions and payouts | For the duration of the programme, then as accounting records |
| Security, session, device and fraud data | Up to 2 years after your last activity. If we terminate an account for a serious breach, we keep the identifiers needed to prevent a new registration for up to 5 years |
| Usage data | Up to 24 months, then aggregated or anonymised |
| Support messages, reports, appeals and complaints | Up to 3 years after the matter is closed |
| Data needed for a legal claim, an investigation or a request from an authority | Until the matter is finally resolved, or as the law requires |
Content that you published and that other users shared, or that we already used in promotional materials, may remain in those places as described in Terms Section 5.4. Anonymised and aggregated data no longer identifies you and may be kept without limit.
10. Your rights
10.1 Under the Serbian Data Protection Law and, where it applies, the GDPR, you have the right to:
- access your personal data and receive a copy of it;
- rectify data that is inaccurate or incomplete;
- erase your data (the "right to be forgotten"), unless we must keep it, for example for accounting or to defend a legal claim;
- restrict our processing of your data in certain cases;
- data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller;
- object at any time to processing based on our legitimate interests, including profiling, and to direct marketing;
- withdraw your consent at any time, without affecting the processing done before the withdrawal; and
- not be subject to a decision based solely on automated processing that produces legal effects for you or affects you similarly significantly.
10.2 How to exercise your rights. You can delete your account yourself in your account settings. For any other request, write to [email protected] from the email address linked to your account, with the subject line "Privacy". You can also manage your profile and signed-in devices in your account settings. We may ask for information to confirm your identity. We answer within 30 days. For complex or numerous requests we may extend this period by up to 60 days, and we will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
10.3 Right to complain. You may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs), or with the data protection authority of the country where you live or work, or where the alleged infringement took place. We would appreciate the chance to resolve your concern first.
11. Regional information
11.1 European Economic Area and United Kingdom. You are protected by the GDPR or UK GDPR, and the rights in Section 10 apply to you in full. Your personal data is stored in the Netherlands (Section 8.1). You may complain to your local supervisory authority.
11.2 United States. Depending on the state where you live, you may have the right to know what personal data we collect, to access, correct and delete it, to obtain a copy, and to opt out of the sale of personal data, targeted advertising and certain profiling. We do not sell personal data and do not share it for cross-context behavioural advertising. We treat data that reveals your sex life or sexual orientation as sensitive and use it only to provide the Services you request. To exercise a right, or to appeal our decision on a request, follow Section 10.2. You may use an authorised agent, and we will not discriminate against you for exercising your rights. We do not respond to browser "Do Not Track" signals, but we honour Global Privacy Control signals where the law requires.
11.3 Other countries. If you live in a country with its own data protection law, such as India, Indonesia, Malaysia, Thailand or Viet Nam, you have the rights that the law gives you, which may include the right to nominate a person to exercise your rights. Write to [email protected], and we will handle your request under Section 10.2 and under the law that applies to you. Complaints and grievances go to the same address, with the subject line "Grievance".
12. Storage on your device and device recognition
12.1 PlayU does not set its own cookies. We store a small amount of information in your browser's local storage:
| Item | Purpose | Kind |
|---|---|---|
| Sign-in credentials and device key | Keep you signed in and sign requests from your device | Strictly necessary |
| Device identifier | Recognise your device for security and fraud prevention | Strictly necessary |
| Age confirmation | Remember that you confirmed you are 18 or older | Strictly necessary |
| Referral and entry codes | Credit the person or partner who referred you | Functional |
| Preferences | Remember Studio settings, recent searches and your place in the feed | Functional |
| Session identifier | Group your usage events into visits for analytics | Analytics |
12.2 Device recognition. To prevent fraud, bots and abuse of free Coin, rewards and referrals, we derive an identifier from the characteristics of your browser and device (such as its fonts, graphics capabilities and settings) and run checks that detect automated or tampered browsers. This identifier may recognise your device even after you clear your browser storage. We use it only for security, fraud prevention and enforcing the Terms, not for advertising.
12.3 Google reCAPTCHA sets its own cookies when it runs (see Section 7.3).
12.4 Your choices. You can clear local storage in your browser settings; you will then be signed out.
13. Emails and notifications
13.1 We send you service emails, such as sign-in codes, receipts, and security and policy notices. You cannot opt out of these while you have an account.
13.2 We send marketing emails and push notifications only as allowed under Section 4. Every marketing email contains an unsubscribe link. You can turn off push notifications in your browser or device settings at any time.
14. Children
The Services are for adults only. We do not knowingly collect personal data from anyone under 18. If we learn that a person under 18 has an account, we close it and delete the personal data, except for data we must keep to report abuse to the competent authorities or to comply with the law. If you believe that a minor is using the Services, write to [email protected].
15. Security
15.1 We protect personal data with technical and organisational measures, including encryption in transit (TLS), one-way hashing of passwords, signed and time-limited links to media files, signed requests from registered devices, access controls that limit staff access to what their role needs, and monitoring for abuse.
15.2 No system is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the Commissioner within 72 hours of becoming aware of it, and if the risk is high, we will also notify you without undue delay.
15.3 You help protect your account by keeping your email account and devices secure and by signing out sessions you do not recognise.
16. Changes to this Policy
We may update this Policy. We will publish the new version in the Services and update the effective date. If a change materially affects how we use your personal data, we will notify you in advance by email or in the Services, and where the law requires it, we will ask for your consent.
17. Google user data
This section describes how PlayU accesses, uses, stores, shares and deletes data it receives from Google.
17.1 What we access. When you choose "Sign in with Google", PlayU requests only the basic scopes openid, email and profile. We receive your Google account identifier, name, email address and profile picture. We do not access any other data in your Google account.
17.2 How we use it. We use Google user data only to create your PlayU account, sign you in, show your name and avatar in your profile, protect your account and the Services from fraud and abuse, and send you service messages about your account. We do not use Google user data for advertising of any kind. We do not sell it. We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
17.3 Who we share it with. We do not transfer or disclose Google user data to third parties, except to the service providers in Section 7.2 that process it on our behalf to host and run the Services, or where the law requires it (Section 7.6).
17.4 How we protect it. We store Google user data on our servers as described in Section 8, and protect it with the measures in Section 15, including encryption in transit and access controls.
17.5 Retention and deletion. We keep Google user data while your account is open, and delete it within 30 days after your account closes (Section 9). You can delete your account in your account settings, or ask us to delete your data by writing to us (Section 10.2). You can also revoke PlayU's access at any time at myaccount.google.com/permissions.
17.6 Limited Use. PlayU's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
18. Contact
PlayU d.o.o., Republic of Serbia
Email: [email protected] (subject line "Privacy")