Effective date: 19 August 2026 Version: 1.0 Applies to: the Yap iOS application ("Yap: AI UGC Video") and the Yap service
Yap turns a product photo or a short product description into a vertical product video. You sign in with Apple, describe your product (or upload a photo of it), review an AI-assisted script, and Yap generates a 9:16 video with an AI presenter, narration and captions.
To do that, we process three kinds of information:
We do not sell personal data. We do not show advertising. We do not track you across other companies' apps or websites — Yap contains no advertising identifier, no analytics SDK and no tracking of any kind. All AI presenters in Yap are fictional, computer-generated people; Yap does not clone voices and does not put your face, or anyone else's, into videos.
Yap is provided by Studio Next Limited, a company registered in England and Wales under company number 12945543, with its registered office at 85 Great Portland Street, First Floor, London, England, W1W 7LT. Our VAT registration number is GB424859177.
In this policy, "we", "us" and "our" mean Studio Next Limited. "Yap" means the Yap iOS app and the generation service behind it. We are the data controller for the personal data described in this policy.
| What you need | Where to go |
|---|---|
| Privacy questions, access requests, erasure requests | mert@studionext.co.uk |
| General support, billing, faults | mert@studionext.co.uk |
| Post | Studio Next Limited, 85 Great Portland Street, First Floor, London, England, W1W 7LT |
| Our website | https://studionext.co.uk |
| Data | Where it comes from | Why we have it | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Email address and name | Apple, when you use Sign in with Apple (you can hide your real email — Apple's private relay works with Yap) | To create and secure your account | Contract — Art. 6(1)(b) |
| Account identifier (a random UUID) | Created at sign-up | To attach your projects, content and credits to your account | Contract — Art. 6(1)(b) |
| Product descriptions, scripts and edits you type | You, in the app | To generate and store your video scripts and scenes | Contract — Art. 6(1)(b) |
| Product photos you upload | You, via Apple's photo picker — Yap can only see the specific images you pick, never your photo library | To feature your product in the script and video | Contract — Art. 6(1)(b) |
| Generated audio, video and caption files | Created by the service for you | They are your output; the app downloads them for editing and export | Contract — Art. 6(1)(b) |
| Purchase history for credit packs (product, transaction ID, time, quantity) | Apple and RevenueCat | To add the credits you bought to your account, exactly once | Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c) for tax and accounting records |
| Credit balance and a ledger of credit holds, spends and refunds | Created by the service | Video generation costs credits; the ledger is how your balance stays correct and disputes get resolved | Contract — Art. 6(1)(b) |
We do not collect location data, contacts, health data, your photo library (only the photos you pick), your microphone input, or your face. Yap requests no camera and no microphone permission.
We do not use analytics or crash-reporting SDKs, we do not use the advertising identifier, and we do not use the App Tracking Transparency framework because there is nothing to ask permission for — Yap does not track you.
Notifications about generation progress are created locally on your device. Yap does not send push notifications and holds no push token for you.
Yap is an AI product, and we would rather over-explain this than tuck it away.
What the AI providers receive: the text of your description or script, and — only when you attached one — temporary, expiring links to your product photo and to generated audio (these links expire within one to three minutes). Your name, email address and account identity are not sent to AI providers as part of generation requests.
What we do not do: we do not use your content to train AI models, and we do not permit our providers to use it for training under the terms we contract on. Yap has no voice cloning and no user-face avatars; every presenter is a fictional, AI-generated person.
AI output can be wrong. Scripts and videos are machine-generated; review them before you publish them anywhere. Free-tier exports carry a visible "Yap • AI generated" watermark.
We use a small number of suppliers to run Yap. Each receives only what it needs, under contracts that restrict what it may do with the data.
| Supplier | What it does for Yap | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions — where your account, projects, photos and generated media are stored | Account details, projects, scripts, uploaded photos, generated media, credit ledger | Data stored in the London (eu-west-2) region. Supabase is a US-headquartered company and its staff may access systems for support from outside the UK. |
| Kie.ai (AI platform routing to the models below) | Runs the AI models that write scripts, moderate content, speak narration and animate the presenter | Your product description or script text; expiring links to your product photo, the presenter image and generated audio | US-headquartered; processing may take place in the United States and other locations |
| — script & moderation model (GPT-5.2) | Writes and safety-checks scripts | Description text, product photo link, generated script | via Kie.ai |
| — speech model (Google Gemini TTS) | Turns script text into narration audio | Scene text and a voice name | via Kie.ai |
| — video model (Kling AI Avatar) | Animates the presenter to speak the narration | Presenter image link and narration audio link | via Kie.ai |
| Apple | Sign in with Apple and App Store purchases | Your Apple sign-in, purchase and subscription records | Apple operates globally; see Apple's own privacy policy |
| RevenueCat | Confirms credit-pack purchases and tells our server to grant credits | Your account UUID, purchase receipts and transaction identifiers | US-headquartered |
We may also disclose data to professional advisers where necessary, to a buyer or successor if the business is sold (this policy continues to apply until you are told otherwise), and where we are required to by law. We do not sell personal data to anyone, in any circumstances.
Some of your content is processed outside the United Kingdom — in particular, AI generation runs through a US-headquartered platform. Your account data and stored content live in London, but the text you submit for script generation, and expiring links to your product photo and generated audio, transit AI providers that may process them in the United States.
Where data leaves the UK, we rely on the transfer mechanisms permitted by UK GDPR — the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision (including the UK Extension to the EU–US Data Privacy Framework where the supplier is certified).
| What | Retention | Why |
|---|---|---|
| Uploaded product photos (server) | Pending uploads expire after 2 hours; usable photos expire and are cleaned up after 7 days. Deleting a photo in the app removes it ahead of that schedule | Photos are inputs to a generation, not a photo library |
| Product photo copies on your device | Auto-removed after 7 days | Kept briefly for editing and export |
| Projects, scripts and generated media | Kept while your account exists, so your projects stay available | They are your work product |
| Rejected script drafts (failed moderation) | Deleted within 24 hours | Never shown, never kept |
| Exported videos on your device | Only the 5 most recent exports are kept locally | Bounded local storage; share or save what you want to keep |
| Purchase and credit-ledger records | 6 years after the end of the relevant financial year | Required for UK tax and company record-keeping |
| Account details | For the life of the account | See erasure below |
Erasure requests. Email mert@studionext.co.uk from the account you want removed and we will delete your account, projects, photos and generated media, and anonymise anything we must retain (purchase records for tax) so it no longer identifies you. We respond within one month. An in-app account-deletion control is being added; until it ships, email is the route.
No system is perfectly secure, and we will not claim otherwise. If you think you have found a security problem in Yap, email mert@studionext.co.uk and we will take it seriously.
If there is a data breach likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware, as required by Art. 33 UK GDPR, and if it is likely to result in a high risk to you we will tell you directly and without undue delay.
Only upload product photos you have the right to use, and only publish generated videos in line with the platforms you post them to. Do not upload photos of identifiable people. Yap's moderation is automated and probabilistic — it is a safety net, not a substitute for your own judgement about your content.
Under UK GDPR you have the right of access, rectification, erasure, restriction, portability, and objection, and rights about automated decisions. Yap's only automated decision is content moderation of what you submit for generation; if your content is rejected and you believe that is wrong, email us and a human will look at it.
To exercise any right, email mert@studionext.co.uk. We respond within one month, extendable by up to two further months for complex requests (we will tell you if so). We will not charge you unless a request is manifestly unfounded or excessive. We may need to verify you control the account before acting.
Complaining to the regulator. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — helpline 0303 123 1113 — ico.org.uk/make-a-complaint. You do not have to come to us first, though we would like the chance to put it right.
Yap requires an Apple Account and is intended for people aged 13 or over. We do not knowingly collect data from children under 13. If we learn that an account belongs to a child under 13, we will close it and delete the data.
We may email you about your account, faults, and changes to the service or this policy — those are service messages. We will only send marketing email if you have opted in, and every marketing email will have a working unsubscribe link. Today, Yap sends no marketing email at all.
We will update this policy when the service changes. We update the effective date at the top for every change; for significant changes — a new category of data, a new purpose, or a new destination country — we will tell you by an in-app notice before the change takes effect. We keep previous versions and will provide one on request.
| Reason | Contact |
|---|---|
| Privacy, access, erasure, objections | mert@studionext.co.uk |
| Support, billing, faults, security reports | mert@studionext.co.uk |
| Post | Studio Next Limited, 85 Great Portland Street, First Floor, London, England, W1W 7LT |
| Regulator | Information Commissioner's Office — ico.org.uk/make-a-complaint — 0303 123 1113 |