Privacy Policy

Part A — The essentials

HDY REAL ESTATE, LLC operates Fleyo: AI Video Generator and the website at https://www.fleyo.org. Our address is 4533 Summerwood Dr, Bountiful, 84010-5892, United States, and our developer display name is HDY Realty. In this policy, “we,” “our” and “us” mean that company. You can reach the people responsible for privacy enquiries at support@fleyo.org.

This policy explains information handling for the website, the Android app, its creative tools, purchases and communications with our team. Fleyo offers image-to-video, text-to-video, video templates and AI image generation. It is being developed for Google Play and does not yet have a public store download. The descriptions of app processing apply when you use the relevant app features.

Personal information includes information that identifies you directly and information that can reasonably be linked to you or your device. A device reference, a support conversation or a photograph may therefore be personal information even when it does not include your name. We determine the purposes and handling described here and act as the controller where that role applies under data protection law.

The website provides product information and these policies. It does not run a generation service or accept payment. Reading a policy is not consent to optional tracking or a new use of your information. When a separate explanation, permission or consent is required, we provide it for the relevant activity.

The date shown on this page identifies the policy version. We may update the text to reflect changes in Fleyo, the information it handles, operational arrangements or applicable requirements. We keep the notice aligned with the service rather than using an old description for a materially different practice.

A material change receives any additional notice required by law. If a proposed activity requires new consent or another legal step, publishing revised wording does not replace that step. A policy update is not permission to use information already collected for an incompatible purpose or to disregard an existing retention commitment.

Your privacy choices and applicable rights remain relevant when the policy changes. Keep a copy of a notice or correspondence you need for your records, and contact us if you want to understand which version or handling applies to a particular issue. A change to this page does not by itself change the independent notices of Google Play, Adjust or another provider.

For photo input, you choose images through Android's system Photo Picker. We access the selected images for the request you make; choosing a photo does not provide access to the entire photo library. The selected input is uploaded to our generation systems. Describing our infrastructure as self-hosted means that we operate the generation servers and models, not that generation takes place entirely on your phone.

We use self-hosted generation infrastructure and do not pass your creative inputs or outputs to an outside AI generation provider. Written instructions, selected material and settings are processed to produce the requested image or video and make the result available. Operational services such as website hosting or installation attribution are explained separately; their involvement is not third-party AI generation.

Fleyo does not use faces to identify people, perform facial recognition, extract facial geometry for identification or build biometric identifiers. An image can still reveal someone's identity or other personal information. Those details remain protected information even though the generation process does not perform biometric identification.

We do not use any user data to train AI models. This includes creation data, app and service identifiers, diagnostic information, purchases, attribution information, support messages and reports. Handling a task, resolving a failure or considering a content complaint does not create permission to turn that information into a training collection.

All creation data is removed within 36 hours from the start of input upload, or from prompt submission when no upload is involved. The complete scope and shared deadline are explained below. Download a result you wish to keep while it is available. Only submit material you have permission to use, and avoid including unnecessary confidential or sensitive information.

Each creation has a maximum 36-hour lifetime, beginning when its input upload starts. If there is no upload, the clock begins when the prompt is submitted. Inputs, outputs and all other information associated with the same request share that deadline. Completing a result, generating a thumbnail or making a copy never starts a new period.

The deadline applies to all creation data as defined above: media, prompts, settings, task records, metadata, relationships to other records and copies. It covers every system we control and every processor handling the data on our behalf, including databases, storage, logs, support or report attachments, previews, caches and backups. Moving information to another system, opening a complaint or keeping a security record does not extend its lifetime.

Certain independent records may remain for a necessary purpose after all creation content and creation-linked information have been removed. Deleting a creative task does not automatically erase an unrelated transaction or the independent record of a purchased benefit. The following criteria concern those separate records only.

• App-user and preference records remain as needed to operate and administer your use, until a valid deletion request or the end of that need. Task references and other links to a creation are removed by the creation's deadline, even if an independent app-user record remains.
• Purchase and financial records remain for verification, delivery of entitlements, refunds, disputes and applicable accounting or tax requirements. Their purpose and legal obligations determine the period. They cannot keep creation content, metadata or links after the creation deadline.
• Support and report records remain as necessary to handle the matter, document a response or address a related dispute. Any creation content, related attachments, task identifiers or other creation information is removed by the original deadline; an open support conversation is not an exception.
• Technical and security records remain for necessary diagnosis, service protection, fraud prevention or an associated investigation. Retention depends on the issue and whether the record is still needed. Creation details embedded in those records are deleted on the creation's schedule.
• Installation-attribution records follow the necessary attribution purpose, applicable Adjust arrangements, valid privacy requests and legal requirements. They do not contain creation data and have a separate retention period determined by those criteria.

When a separate record is no longer needed, we delete it or make it genuinely anonymous. Any restricted backup preservation for an independent record must remain limited to its justified purpose and cannot preserve or restore deleted creation data. No purpose listed here allows us or our processors to retain creation information beyond its deadline.

A result saved to your own device or independently shared with another person or service is outside these systems. You control that separate copy. Routine removal does not delete your exported file, and the service is not a permanent archive from which an erased creation can later be recovered.

Part B — Information and its uses

Information reaches us through material you submit, your device's requests to our systems, purchases processed by Google Play and messages or reports you send. The Adjust integration also handles the limited installation-attribution information explained in its own section. These sources have different purposes; a purchase record is not the same thing as a record of a creation.

• Creation data means all information belonging to a creation. It includes, without limitation, the prompt; input images or videos where supplied; output images or videos; generation settings and parameters; template selections; task identifiers, status and timestamps; associated metadata; and information linking a creation to other records. Copies, previews, thumbnails, caches and backups of that information are also creation data. The deletion deadline described above covers this entire set, rather than only the finished media.
• App-user and installation records include identifiers associated with your use of the app, preferences and the access or entitlements available to you. These help the service recognize the relevant app record without a registered login. A task reference or other information tying such a record to a particular creation falls within creation data, even when stored alongside an otherwise independent user record.
• Purchase information includes order references, the product purchased, transaction dates, purchase or refund status, receipt or verification information and the benefit associated with the transaction. Google Play supplies information needed to validate and administer its purchases. Google processes the payment; we do not ask you to send full payment-card details or give us access to your Google account.
• Support and reporting information includes your message, the issue you describe, relevant app, creation or order references, and screenshots or attachments you choose to supply. Email contact also gives us your email address. An in-app content report contains the information needed to identify and explain the concern. Creation content and links inside correspondence or attachments remain subject to the creation-data deadline.
• Technical records include IP addresses, device or browser characteristics, app and operating-system versions, request times, page or feature interactions, errors, diagnostics and records used to operate and protect the service. Information associated with an individual creative task remains creation data regardless of whether it appears in a database, diagnostic record or security log.
• Installation-attribution information can include permitted device or advertising identifiers, referral or channel information, IP address, version details and installation, first-open or session signals. Adjust uses these to establish the source of an installation. Availability and privacy choices affect which signals can be used; attribution does not mean that no device data is collected.

You do not need to register a Fleyo login, create a password or sign in through a social network. We do not obtain a social-login profile as part of using Fleyo. The app can nevertheless maintain a user or installation reference and service records needed to provide a feature, recognize an entitlement or respond to a request.

An account-deletion label in Personal Settings refers to removal of these app-user records and their associated information. It does not mean that you have a separate username-and-password account. The absence of registration does not make requests, devices, purchases or correspondence anonymous, and this policy applies to personal information in those records.

Google maintains the Google account used for Google Play. Buying a Fleyo feature through the store does not create a Fleyo login. Our data-deletion process cannot close your Google account, cancel its unrelated services or remove information Google must retain under its own obligations. Store payment and subscription settings remain separate from Fleyo's user-data controls.

When asking for help, provide an available app or purchase reference so we can find the appropriate records. If you do not have a reference, explain the situation and we will identify what limited information is needed. There is no Fleyo password to send, and you should never send your Google password, authentication codes or recovery credentials.

We connect each use of information to a service or operational purpose. Providing a creative tool requires processing its inputs, but it does not give us unrestricted permission to reuse them. The limits on training and retention apply across the purposes listed here.

• Fulfil a creation request: receive the material and settings you choose, apply a template where requested, manage the task, return its status and deliver the generated result.
• Keep the app usable: maintain relevant preferences, associate requests with the correct app-user record, administer access and explain whether a requested feature is available.
• Deliver paid benefits: verify store transactions, establish purchase entitlements, reconcile cancellations, refunds or reversals, and investigate a missing benefit or disputed charge.
• Respond to you: answer support questions, investigate a reported problem, process privacy and deletion requests, review content concerns and provide necessary administrative communications.
• Identify acquisition sources: use Adjust to determine the referral, campaign or channel associated with an installation. Adjust is not used to analyze creative content, feature use or purchase events.
• Maintain reliability and safety: diagnose errors, address misuse, fraud and security incidents, investigate reports and take appropriate steps to enforce our terms or protect people and their rights.
• Meet legal and business responsibilities: maintain necessary independent transaction and accounting records, obtain professional advice, respond to valid legal requests and establish or defend legal claims.

We may use aggregate or genuinely de-identified statistics to understand service performance. Replacing a name or hashing an identifier does not necessarily make information anonymous; records that remain linkable to a person are still personal information. Statistical, diagnostic or safety work cannot preserve a creation's content, metadata or links after its deletion deadline.

Where applicable data protection law requires a legal basis, including the laws of another country that protect your information, we use the basis relevant to the particular processing. Our United States address does not remove protections that apply to your information. A single basis does not automatically cover every use of the same record.

• Providing a requested service or taking steps you ask for before an agreement: processing a creative task, supplying purchased access and providing support necessary to fulfil the service you request.
• Legitimate interests, where permitted and balanced against your rights: keeping the app reliable, diagnosing faults, protecting people and systems, preventing fraud and conducting necessary business administration. These interests do not override a legal requirement to obtain consent.
• Legal obligations: handling information necessary for applicable accounting, tax, consumer protection and other duties, or responding to a binding requirement. Independent records retained for these purposes must not preserve creation information beyond its separate deadline.
• Consent: optional tracking, device access, communications or another activity for which applicable law requires your agreement. We seek the relevant consent rather than treating a visit to this page or silence as permission.

You can withdraw consent using the relevant available control or by contacting us. Withdrawal applies to subsequent processing and does not make earlier lawful handling unlawful. If particular information is necessary to complete a generation or purchase request, withholding it may mean that we cannot provide that requested feature. Optional attachments or unrelated personal details are not required just to ask a question.

If we propose a materially different use requiring another legal basis or a new consent, changing the text on this page is not enough. We take the required steps before carrying out that use. You can ask which basis applies to a particular record or purpose.

Fleyo includes Adjust for source attribution: understanding which referral, campaign or channel led to an installation. Attribution uses technical signals to connect an installation with its source. It is separate from the systems that process your images, prompts and videos, and Adjust does not generate content for Fleyo.

Subject to availability, applicable permission and privacy choices, those signals can include device or advertising identifiers, referrer and channel information, an IP address, operating-system, app or SDK versions, and installation, first-open or session information needed for attribution. Technical identifiers may relate to a device even without a named login, so they are covered by this policy.

We do not send Adjust creation data, including inputs, outputs, prompts, task information or associated metadata. We also do not send support communications or content reports, use it to examine your creations, or send purchase events for tracking. Necessary attribution information or results may be exchanged with connected acquisition channels through enabled integrations, subject to applicable consent and privacy choices.

You can use the relevant privacy controls on your device and contact us about access, deletion, an objection or an applicable advertising opt-out. Limiting an advertising identifier does not itself erase information already received. We handle requests about attribution performed for Fleyo with the relevant provider. Independent attribution records have their own retention criteria and do not inherit the creation-data deadline or contain your creative material.

Loading this website sends the requests needed to deliver its pages, fonts and images. A browser may keep cached copies to display them efficiently. Our website does not use analytics or advertising cookies. Product illustrations describe creative possibilities; viewing them is not an upload of your own media or a submission to an AI generation service.

The installed app uses local and service records for its functions and the Adjust SDK for installation-source attribution. These technologies are separate from browser cookies. Clearing your browser history or blocking a website cookie does not automatically change an SDK's operation in the app or erase records already received by our systems or a provider.

Android's system Photo Picker lets you choose the photos used for a creative request. If another app function requires a device permission, we request the permission when needed. You can decline or change a permission using the controls Android provides; a feature depending on that access may then be unavailable. Removing permission does not itself recall material already uploaded or replace a request to delete server information.

Browser storage settings and device privacy controls provide choices for their respective environments. Where optional tracking needs consent, an app permission or acceptance of the Terms of Service does not substitute for that separate consent. Contact us if you need help understanding which control concerns the information involved.

Links to a store, Adjust or another external service lead to that provider's own information and privacy practices. This policy describes disclosures made by Fleyo. Information you give an independent provider directly is also governed by its notice, including its handling of an exported file or a store transaction.

We disclose information for the purposes described in this policy, limiting it to what the recipient needs for that purpose. We do not exchange personal information for money. Some regional laws define sale or advertising-related sharing more broadly; the regional rights sections explain the choices that may apply to those disclosures.

• Operational providers: hosting, storage, website delivery, communications, support and security providers can handle relevant information for their work. Adjust receives the attribution signals described above. Using these services does not mean that creative inputs or outputs are sent to an external AI generation provider.
• Purchase and marketplace services: we exchange relevant transaction, verification, entitlement, refund or dispute information with Google Play and services needed to administer the purchase. Google may separately handle information as the marketplace and payment provider under its own responsibilities.
• Professional advisers: lawyers, accountants, auditors, insurers and other advisers may receive information necessary for advice, compliance, a claim or business administration. Appropriate confidentiality and purpose restrictions apply to that access.
• Authorities and legal or safety recipients: we may disclose relevant records when a valid legal requirement applies, or when disclosure is permitted to protect people, investigate unlawful conduct or establish, exercise or defend rights. A general reference to legal purposes does not enlarge the creation-data retention limit.
• Business changes: information relevant to a proposed or completed financing, merger, acquisition, restructuring or asset transfer may be reviewed or transferred with appropriate safeguards. Confidentiality, required notices and applicable legal protections continue to matter. A successor is not given permission to disregard existing commitments through the transfer itself.
• A recipient you choose: we may provide information to a person acting with your authority, or handle an export or disclosure you request. If you independently share a result, the recipient's handling of that copy takes place outside our service and cannot be reversed by deleting our record.

For providers processing information on our behalf, we require handling limited to the authorized work and appropriate protection. Creation information held by such processors is subject to the same deletion deadline as our own copies. Independent information held by a marketplace under its own obligations is distinct from creation data processed for Fleyo.

We use technical, administrative and organizational safeguards appropriate to the information and the risks. Communications between the app or website and our servers are encrypted in transit using HTTPS with TLS. Access is limited to people and systems with a relevant operational need, with authorized handling restricted to the purposes described here.

Protecting information also involves reviewing operational providers, responding to reported incidents and investigating failures or suspicious activity. Such investigations remain subject to the rules for creation data and separate necessary records. Keeping information for security is not permission to retain every uploaded file or associated task indefinitely.

No online service can promise that a loss, unauthorized disclosure or other incident will never occur. If an incident affects personal information, we assess it and make notifications required by applicable law. This limitation does not reduce our responsibility to apply appropriate safeguards or address a problem.

Protect access to your device and store account. If you suspect a privacy or security issue involving Fleyo, contact support@fleyo.org with a brief description and an available app or transaction reference. Do not include passwords, authentication codes or full payment details. We will explain if further information is needed to investigate.

Fleyo's operator is based in the United States. Information may be handled there and in other countries where our infrastructure, Google Play, Adjust or operational providers process relevant records. The postal address identifies our company; it is not a promise that every record is stored at that address or only in one country.

Privacy protections and access rules can differ between countries. When a transfer is subject to data protection requirements, we apply the protections required for that transfer. Depending on the location and circumstances, these can include a recognized adequacy decision, approved contractual safeguards or another lawful mechanism. We do not treat ordinary use of Fleyo as blanket consent to any international disclosure.

Where the laws of your country protect your information, those rules continue to govern relevant transfers even though our operator is in the United States. Contact us to ask about the arrangements relevant to your information and how to obtain a copy or description of applicable safeguards, subject to protecting legitimate confidential information.

A processing location does not change the stated purpose or the creation-data deadline. A provider handling a copy for us remains subject to the same limits. Independently retained store or attribution information must be distinguished from creation data rather than using a transfer to extend creative-content storage.

Use of Fleyo is subject to the age and permission requirements that apply to the user and the app. Where applicable law permits use with a parent or guardian's agreement, that agreement is required first. A creative feature or an accessible website does not authorize a child to bypass an age restriction or substitute for legally required parental permission.

We do not knowingly collect children's personal information in a way that contravenes applicable requirements. If we discover that information has been collected without a necessary permission or legal basis, we take steps to stop that processing and remove the information as required. A parent or guardian can contact us to explain a concern and request review or deletion without supplying unnecessary sensitive material.

The creative tools do not require unrelated health records, identity documents, private financial details or other sensitive information. Avoid putting such information into an image, video, prompt or support attachment. Consider other people whose details appear in material you submit and obtain the permissions needed to use it.

Faces and likenesses deserve the same care. Fleyo does not perform biometric identification, but a recognizable photograph can still reveal personal information. Our limits on access, purpose, training and retention apply to that content rather than treating the absence of facial recognition as an absence of privacy obligations.

Part C — Your controls

Fleyo provides two ways to request deletion of app-user data. Both apply even though there is no registration or login. A deletion request concerns the records associated with your use, rather than merely hiding an entry or removing an app icon from your device.

• In Fleyo, open Personal Settings and choose the deletion control. Read the confirmation and follow the steps shown. Save any available creations you want to keep before confirming, because erased information cannot be restored from the deleted record.
• Without the app, email support@fleyo.org and state that you want your Fleyo app-user data deleted. Include an app-user or creation reference if available, or a relevant purchase reference that can help locate the records. If you cannot open the app or no longer have a reference, explain that; you do not need to reinstall it just to start a request.
• We remove the relevant app-user record, non-essential preferences, associated personal information and all remaining creation data across our systems and processors acting for us. This includes content, inputs, outputs, settings, task records, metadata, links and copies, not only the finished picture or video.
• Limited independent purchase, tax, dispute, security, support or attribution records may remain for a justified purpose as explained in the retention section. They cannot retain creation information beyond its deadline or be used to continue ordinary use of a deleted app-user record. We explain relevant retention and send necessary deletion instructions to processors.

The routine 36-hour removal of all creation data happens without a separate request. Request verification does not reset that clock. Deletion cannot recall a copy you exported or independently shared, close your Google account, cancel a Google Play subscription or request a refund. Store renewal and purchase questions have their own routes and can be addressed alongside deletion.

Send privacy requests to support@fleyo.org. The rights available depend on the applicable law, the information and the basis for its use. You can make a request without registering for Fleyo. Where another country's data protection law applies to you, the following rights include the protections available under that law; the state sections below supplement them where applicable.

• Access and information: ask whether personal information about you is processed, obtain a copy where applicable and learn about its sources, purposes, recipients and retention.
• Correction: ask us to correct an inaccurate record or complete information that is incomplete for the purpose for which it is used.
• Deletion and restriction: request erasure or limits on processing, subject to applicable exceptions for independent necessary records. Such exceptions do not extend the routine deadline for creation data.
• Portability: obtain information you supplied in an appropriate usable format, or request its transmission to another provider where the right applies and this is technically feasible.
• Consent withdrawal: change a consent-based choice without invalidating processing that was lawful before withdrawal. Use the relevant available control or contact us for assistance.
• Advertising and profiling choices: exercise applicable rights concerning sale, advertising-related sharing, targeted advertising or profiling that produces legal or similarly significant effects. The regional sections explain additional routes.

Right to object: when processing relies on legitimate interests, you may object based on your particular situation. Where the objection concerns direct marketing, the applicable right does not require you to justify a personal reason. We assess and respond under the rules that govern the processing concerned.

We may ask for limited information to connect your request to an app-user, device, purchase or support record and protect someone else's data. We do not require creation of a new login. An authorized representative can make a request where permitted, with evidence of authority and any verification the law requires.

We respond within the applicable legal period. If an exception, extension or legally permitted charge applies, we explain it and the available next steps. We do not discriminate against you for exercising a protected right. A request does not require you to send a new copy of sensitive content merely to repeat what is already identifiable from a reference.

You may complain to the authority that handles privacy or consumer complaints where you live. In the United States this can include your state attorney general or the Federal Trade Commission; elsewhere, your national data protection or consumer authority. You do not have to finish an informal exchange with us before using an available complaint route.

California privacy protections apply according to their scope, thresholds and exceptions. When they cover our processing, this section supplements the information above rather than replacing it. The categories, sources, purposes, recipients and retention criteria in this policy describe how relevant personal information is handled.

Relevant categories include identifiers such as app or device references and a support email address; commercial information about transactions and entitlements; internet or app activity and technical records; and images, videos, prompts and correspondence you provide. Content may reveal additional information depending on what you include. We receive these categories from you, your use and device, Google Play and the attribution sources described above.

• Where applicable, request knowledge of and access to personal information, including information about its collection, purposes and disclosures.
• Request correction of inaccuracies and deletion, subject to the law's applicable exceptions.
• Opt out of a qualifying sale or sharing for cross-context behavioral advertising, and request limits on qualifying uses or disclosures of sensitive personal information.
• Use an authorized agent with the required authorization and verification, and exercise protected rights without unlawful discrimination.

We do not exchange personal information for money. California definitions can also cover other exchanges or advertising-related disclosures. If attribution information exchanged with an enabled acquisition channel falls within those definitions, the applicable opt-out is available through our contact address or a legally recognized preference signal. Relevant choices apply to those channel integrations.

We verify requests where required using information proportionate to the request. If an exception prevents full completion, we explain the reason and available options. You do not need to create a Fleyo login to exercise a right, and requesting an applicable limit or opt-out does not require sending the sensitive material again when a reference will identify the issue.

The legacy Do-Not-Track preference offered by some browsers does not have a single uniform implementation across services. We do not interpret that setting as an instruction to erase all Fleyo records, disable every app SDK or withdraw every permission you have given in another environment.

Legally recognized opt-out preference signals are different. Where applicable law requires a valid signal, such as Global Privacy Control, to be honored for a particular sale or sharing activity, we honor that requirement for the relevant processing. A signal relates to the browser, device or context in which it is received; it does not necessarily identify a separate app installation or every record associated with a person.

You may also contact support@fleyo.org to exercise an applicable sale, sharing or targeted-advertising opt-out. Identify the service or device record concerned using an available reference, without sending confidential credentials. We will explain any limited information needed to apply the choice to the correct processing.

Device-level limits on advertising identifiers and a request to delete previously collected information are distinct choices. An opt-out can limit relevant future handling without itself deleting necessary purchase records. The rights and deletion sections explain how to ask for those other actions, and no Fleyo registration is required to make a request.

If the Virginia Consumer Data Protection Act applies to our processing, eligible residents can invoke the rights below within its scope and subject to its exceptions. The categories and activities described elsewhere in this policy identify the information and processing to which those rights relate.

• Confirm whether we process personal data about you and request access to it.
• Correct inaccuracies, request deletion and obtain a portable copy of data where the right applies.
• Opt out of processing for targeted advertising, sale of personal data or profiling used for decisions with legal or similarly significant effects where the relevant activity and right apply.
• Appeal a decision about a privacy request and exercise protected rights without unlawful discrimination.

Submit a request to support@fleyo.org. If you disagree with the response, reply to that conversation or send a message with “Privacy appeal” in the subject. Explain the decision you want reviewed and why, including the earlier reference where available. We review the appeal and respond within the applicable period with the outcome and reasons.

If an appeal is denied, we provide the available route to contact the Virginia Attorney General about a complaint. Any required verification is limited to establishing the requester's authority and locating the relevant data. You do not need a Fleyo login, and an appeal does not suspend the routine deadline for removing creation information.

For a privacy enquiry, access or deletion request, advertising objection, security concern or question about this policy, email support@fleyo.org. The operator is HDY REAL ESTATE, LLC, with the developer display name HDY Realty, at 4533 Summerwood Dr, Bountiful, 84010-5892, United States. Our official website is https://www.fleyo.org.

Describe what you want us to review and include an available app-user, creation, purchase or previous support reference. A reply address lets us respond; it is not evidence that you have registered a Fleyo login. Avoid sending passwords, authentication codes, full card numbers, unrelated identity documents or unnecessary copies of private material.

For a harmful or potentially infringing result, use the report option on its creation detail page. You can submit the concern inside Fleyo without leaving the app. Email remains available if you cannot use that route. Explain the issue and your connection to it without forwarding illegal content; we will ask for any further detail needed.

The support and deletion pages provide practical instructions. You may raise a purchase issue at the same time as a privacy request; an unresolved payment question is not a condition that must be settled before you can request deletion.