Privacy Policy
Last updated: 13 July 2026
KEYOSTUDIO LTD (“KEYO”, “we”, “us”, or “our”) operates keyo.studio (the “Service”), an AI-powered platform that lets you generate images, video, audio, and other creative content. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it. KEYOSTUDIO LTD is a company registered in England and Wales (company number 17283516) and is the data controller of your personal data under the UK GDPR and EU GDPR. If you have any questions about this policy or your data, contact us at hello@keyo.studio.
1. Who this policy applies to
This policy applies to everyone who uses the Service, wherever you are located. Additional rights apply if you are in the United Kingdom or the European Economic Area — see Section 9 (“Your rights”). The Service is intended only for people aged 18 or over; we do not knowingly collect data from anyone under 18 (see Section 11, “Children”).
2. What personal data we collect
We collect data you give us directly — account data such as your name, email, and login credentials managed through Clerk (including basic profile information if you sign in with Google or Microsoft); payment data processed by Stripe (we never see or store your full card number); the content, prompts, and instructions you upload or enter to generate content; the content the Service creates for you; and the content of messages you send us, such as support requests. We also collect data automatically, including usage data, device and technical data such as your IP address and browser type, and cookies and similar technologies — see our separate Cookie Notice for details. We do not perform facial recognition or create biometric templates from your uploads, and we do not use your content or prompts to train our own AI models — the Service works by sending your content to third-party AI providers who perform the generation.
3. How we use your personal data
We use your personal data to provide the Service — creating and managing your account, processing your uploads and prompts, generating content, and delivering results; to process payments, manage subscriptions, credits, invoices, and refunds through Stripe; to support you and respond to your requests; to keep the Service secure by detecting and preventing fraud and abuse; to improve the Service, relying on analytics cookies only with your consent; to communicate service-related messages, sending marketing emails only where permitted; and to comply with our legal, accounting, and regulatory obligations.
4. Our legal bases for processing (UK/EEA)
Under the UK GDPR and EU GDPR, we rely on the following legal bases: performance of a contract, to provide the Service you signed up for; legitimate interests, to keep the Service secure, prevent abuse, and run and improve our business; consent, for analytics and any marketing cookies and for optional marketing communications, which you can withdraw at any time; and legal obligation, where we must process data to comply with the law.
5. Third-party AI providers and other processors
To deliver the Service, we share your data with carefully selected processors, sharing only what each service needs to function. When you generate content, your uploads and prompts are sent to the third-party AI provider needed to produce your output, which may include Google, Kling AI, Topaz Labs, ElevenLabs, and BytePlus depending on the feature you use. We also work with Clerk for authentication, Supabase for database and storage hosting, Stripe for payment processing, Vercel for application hosting, and Google Analytics for usage analytics (only if you accept analytics cookies). We may also share data with professional advisers and authorities where required by law, or as part of a business transfer such as a merger or acquisition. We do not sell your personal data.
6. International data transfers
KEYO is based in the UK. Some of our providers are located outside the UK and EEA, including in the United States and China, which means your personal data may be transferred to and processed in these countries. Where this happens, we use safeguards such as transfers to countries recognised as providing an adequate level of protection, or standard contractual clauses (UK IDTA / EU SCCs) approved by the relevant authorities. Contact us at hello@keyo.studio for more information about a specific transfer.
7. How long we keep your data
We keep your personal data only for as long as necessary. Account data is kept for as long as your account is active; uploaded and generated content remains available while your account is active and you can delete it at any time; after deletion or account closure, content is removed from our active systems and backups within a reasonable period, typically up to 90 days; and payment and legal records are kept for as long as required by tax, accounting, and other legal obligations. Some data may be kept longer where required for legal reasons, such as resolving disputes or law enforcement requests.
8. Security
We use technical and organisational measures designed to protect your personal data, including encryption in transit, access controls, and trusted infrastructure providers. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.
9. Your rights
If you are in the UK or EEA, you have the right to access a copy of the personal data we hold about you, request correction of inaccurate data, request erasure where there is no good reason for us to keep it, restrict how we use your data, receive your data in a portable format, object to processing based on our legitimate interests or to direct marketing, and withdraw consent at any time where we rely on it. To exercise any of these rights, contact us at hello@keyo.studio — we may need to verify your identity and will respond within the timeframes required by law, normally within one month. If you are not satisfied with our response, you can complain to the Information Commissioner’s Office in the UK or your local data protection authority in the EEA.
10. Other websites
The Service may link to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read the privacy policy of any third-party site you visit.
11. Children
The Service is not intended for anyone under 18. If you believe we have collected data from someone under 18, contact us at hello@keyo.studio and we will delete it as required by law.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the date at the top and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated policy.
13. Contact us
KEYOSTUDIO LTD is registered in England and Wales, company number 17283516. You can reach us at hello@keyo.studio.