Privacy Policy

Privacy Policy

Last updated: July 9, 2026


1. Who We Are

Loupa AI ("Loupa AI", "we", "us") is operated by:

Wertunity E-Commerce FZCO
Dubai Silicon Oasis, DDP, Building A1
Dubai, United Arab Emirates

Contact: hey@loupa.ai

Wertunity E-Commerce FZCO is the data controller responsible for the personal data described in this policy.


2. What Loupa AI Does

Loupa AI is an AI-powered content creation platform that helps you generate images and videos, including AI-generated characters, using your brand information and (optionally) reference images you upload. This policy explains what data we collect, why, who processes it, and what rights you have.


3. Information We Collect

What we do NOT collect

  • We do not use advertising pixels or cross-site trackers (no Meta Pixel, Google Ads tag, or TikTok Pixel).

  • We do not collect your precise location.

  • We do not access your contact lists or address book.

  • We do not store your full payment card details — payments are handled by Whop and its payment partners.

  • We do not sell your personal information.


Account data

When you create an account we collect your email address and authentication credentials. Authentication and account data are managed through our backend provider, Supabase.

Content you submit

  • Image uploads, including reference images. If you upload a photo of a real person as a reference, see Section 5 — special rules apply.

  • Brand details ("Brand DNA") — information you save about your brand, products, tone, and audience so that generated content matches your brand.

  • Prompts and inputs you provide when using generation features.


Generated content

Images and videos generated for you are stored in your account so you can access, download, and reuse them.


Payment data

Payments are processed by Whop, which acts as merchant of record for transaction taxes and processes card payments via its financial partners (such as Stripe). We receive limited information from Whop (such as subscription status, plan, and transaction confirmations) but we never receive or store your full card number.


Technical and usage data

Like most online services, our infrastructure automatically records basic technical data such as IP address, browser type, device information, timestamps, and log data, used for security, debugging, and abuse prevention. We also track your credit usage to operate the credit system. We currently do not use third-party analytics tools.


4. How We Use Your Information

We use your data to:

  1. Provide the service — generate images and videos from your inputs, store your results, and apply your Brand DNA to outputs.

  2. Manage your account and billing — authentication, subscription management, credit accounting, and payment processing via Whop.

  3. Keep the service secure — fraud and abuse prevention, rate limiting, debugging, and enforcing our Terms of Service.

  4. Communicate with you — service emails (receipts, important account or legal notices). If we introduce marketing emails in the future, we will only send them with your consent where required by law, every marketing email will include an unsubscribe link, and opting out will never affect service-related emails.

  5. Content safety — we may use automated tools to screen uploads and generated content for material that violates our Terms of Service (such as child sexual abuse material), and we report illegal material to the relevant authorities where required by law.

  6. Comply with legal obligations.


AI model training

We do not use your uploads, prompts, Brand DNA, or generated content to train AI models. We access our AI providers through their business APIs (Anthropic, Google Gemini, Kling), which process your inputs in order to generate your outputs, in accordance with their respective API terms and privacy policies.


Legal bases (EEA/UK users)

Where GDPR or UK GDPR applies, we process your data on these bases: performance of a contract (providing the service you signed up for, billing), legitimate interests (security, abuse prevention, service improvement), consent (optional features such as future marketing emails, and the processing of reference images containing real people), and legal obligation (tax and accounting records).


5. Reference Images of Real People

Loupa AI lets you optionally upload a photo of a real person as a visual reference. When you do this:

  • The image is sent to Google Gemini, which generates a modified, AI-created character inspired by — but intentionally not identical to — the reference. The AI character may then be used in video generation via Kling.

  • You must only upload images of real people if you are that person or have their explicit permission to use their image this way. You may not upload images of minors as references.

  • We process reference images to fulfill your generation request. We do not use them to identify individuals, build facial-recognition databases, or create biometric templates for identification purposes.

  • Reference images are stored with your account content until you delete them or your account.


If you are in a jurisdiction with specific biometric-data laws (e.g., Illinois), by uploading a reference image you consent to the processing described above, and you confirm you have obtained any legally required consent from the person depicted.


6. Cookies

We use only essential cookies:

Cookie Purpose Duration Authentication/session cookies
Supabase: Keep you logged in, secure your session Session / up to 30 days
Whop / payment-partner cookies (checkout): Payment processing and fraud prevention Per Whop's policy

We do not use advertising or cross-site tracking cookies. If we ever add analytics or marketing cookies, we will update this policy and, where required, ask for your consent first.


7. Third-Party Processors

We share data with the following providers only as needed to run Loupa AI:


Provider Purpose Location Privacy Policy

Supabase Hosting, database, authentication, file storage United States supabase.com/privacy

Whop (and its payment partners, e.g., Stripe) Payment processing, billing, transaction taxes United States (global) whop.com/privacy

Anthropic AI text/reasoning processing United States anthropic.com/privacy

Google (Gemini) AI image processing and generation United States (global) policies.google.com/privacy

Kuaishou (Kling AI) AI video generation China / Singapore klingai.com privacy policy


We do not sell or rent your personal information to anyone.

Other limited disclosures. We may also disclose personal data where required to comply with law, valid legal process, or enforceable requests from public authorities, or to establish or defend legal claims and enforce our Terms of Service. If Wertunity E-Commerce FZCO is involved in a merger, acquisition, restructuring, or sale of assets, your data may be transferred as part of that transaction — we will notify you before your data becomes subject to a different privacy policy. We may also use and share anonymized, aggregated statistics (such as overall usage figures) that cannot identify you.


8. International Data Transfers

Loupa AI is operated from the United Arab Emirates and hosted on servers in the United States (Supabase). Depending on the features you use, your data is also processed by the providers listed above, which may include processing in China for video generation via Kling.

If you are in the EEA, UK, or Switzerland, transfers of your personal data outside those regions are protected by appropriate safeguards, such as the EU Standard Contractual Clauses (and the UK Addendum/IDTA), the EU–US Data Privacy Framework where a provider is certified, and equivalent mechanisms. You can contact us for more information about the safeguards applied to a specific transfer.


Note on video generation: if you use video features, the inputs required for generation (such as the AI character image and your prompt) are transmitted to Kling for processing. If you prefer that your data not be processed by Kling, do not use video generation features.


9. Data Retention

  • Account data, uploads, Brand DNA, and generated content: kept while your account is active. When you delete your account, all of this data is deleted permanently and cannot be restored — including for new accounts created with the same email. Residual copies may persist in encrypted infrastructure backups for up to 30 days before being purged.

  • Payment records: retained as required by tax and accounting law (typically 5+ years), held by Whop and in our billing records.

  • Server and security logs: retained for 30 days.

  • AI provider retention: our providers may retain API inputs briefly for abuse monitoring under their own policies (e.g., limited-day retention windows) before deletion.


10. Your Rights

Depending on where you live, you have some or all of the following rights: to access the personal data we hold about you, to correct it, to delete it, to receive a copy of your data in a portable format (currently handled manually — email us and we will provide an export), to object to or restrict certain processing, and to withdraw consent at any time where processing is based on consent.


  • EEA/UK: you have the rights above under GDPR/UK GDPR and may lodge a complaint with your local supervisory authority (or the ICO in the UK).

  • California and other US states: you have the rights to know, delete, and correct, and to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as defined by the CCPA/CPRA. We do not discriminate against you for exercising your rights.

  • Canada: you have rights of access and correction under PIPEDA, and may contact the Office of the Privacy Commissioner of Canada.

  • UAE: you have rights of access, correction, and deletion under the UAE Personal Data Protection Law.


To exercise any right, email hey@loupa.ai from the email address linked to your account (we may ask you to verify your identity). We respond within 30 days. You can also delete your content and account directly in your account settings.


11. Children

Loupa AI is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account or submitted data, contact us at hey@loupa.ai and we will delete it.


12. Security

We protect your data with TLS/HTTPS encryption in transit, encryption at rest on our hosting infrastructure, access controls, and payment handling exclusively through Whop and its PCI-DSS compliant payment partners. No online service can guarantee absolute security, but if a breach affects your personal data, we will notify you and the relevant authorities as required by applicable law.


13. Changes to This Policy

We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date, and for significant changes we will notify you by email or an in-app notice. Please review this page periodically.


14. Contact

Wertunity E-Commerce FZCO
Dubai Silicon Oasis, DDP, Building A1, Dubai, United Arab Emirates
Email: hey@loupa.ai