Privacy policy

Repic is an AI brand studio: you describe your brand once, and Repic turns that profile into your identity, your content, and AI "Twins" that can speak in your voice and appear as your likeness. This privacy policy explains how we handle personal data across the Repic public website, the free tools, and Repic Studio at app.repic.site (together, the "Service").

The data controller responsible for your personal data is [Repic Legal Entity Name] ("Repic", "we", "us", "our"), at [Registered Business Address, Pakistan]. For any privacy question or to exercise your rights, contact us at privacy@repic.site. We may set up further dedicated aliases over time; privacy@repic.site is the address to use for anything in this policy.

This policy does not cover services we link to but do not run - when you follow a link off Repic, the other service's own policy applies on its surface.

We collect the data you give us to run the Studio, the data the product generates for you, and a limited set of signals about how the Service is used.

• Account and identity: your username, a hashed password (never the password itself), an optional email address, your first and last name, display name, and profile photo. If you use Google Sign-In, we receive the Google account email and name associated with that sign-in.
• Brand and persona data: your Brand Persona fields and onboarding answers - the deep qualitative profile that is the single source of truth for your brand - together with your Brand Kit and saved generation history.
• Uploaded documents: files you upload to build your brand (for example PDF, DOC, DOCX, TXT, or MD). We parse these (including OCR) and analyse them with Google Gemini to fill your Persona and onboarding fields. These files can contain arbitrary personal data - for example a CV or resume - so upload only what you have the right to share.
• Your own social links: the social-profile URLs you add to your profile (for example Instagram, LinkedIn, TikTok, X, or YouTube).
• Biometric data (voice and face): if you build a voice or visual Twin, we process biometric data derived from your recordings and photos. Because this is sensitive, it has its own section below and its own biometric policy.
• Usage and telemetry: page views, feature use, and actions (recorded automatically for authenticated activity and through explicit product events), your interactions with the Repic Assistant and the actions you allow or disallow, notifications, and technical data such as your IP address and user-agent.
• Support, waitlist, and contact messages: what you send us through contact forms, support, or the waitlist (which can include your email, name, role, goal, company, phone, and the IP address and user-agent captured with the submission), plus your email preferences.
• Cookies and similar technologies: covered in our cookie policy and summarised below.

Some Repic Twins rely on biometric data, which is a special category of personal data. Your explicit consent is the only basis on which we process it, and we use it only to build and run the Twin you asked for. The in-product consent step is live for voice twins today and is still being rolled out for visual twins; our biometric and likeness policy says plainly where that stands, how deletion is carried out today, and the retention schedule we hold ourselves to.

• Voiceprints: when you clone your voice, we process the voice sample you record or upload and the derived custom-voice model (the cloning key) used to speak as your Twin.
• Faceprints: when you build a visual Twin, our face pipeline computes biometric data from your reference photos - including face embeddings (ArcFace), facial landmarks, head-pose, and face-parsing region maps - to keep generated images on-model, along with a written description of the person's appearance.
• Likeness assets: the images and video generated of your face and body in new poses, expressions, outfits, and scenes, and any virtual try-on composites.

Some Repic features can involve the personal data of people who are not Repic users and who have not agreed to anything with us. We want to be honest about this.

• Public third-party content: features that read public content from other platforms - web and social scraping (for example Reddit, Quora, or YouTube) and Instagram insights for a handle you enter - can collect author handles, post text, and profile or audience metrics, including for accounts you do not own.
• Uploaded or linked media: transcription of files or links can capture the voices of third parties in the recording; virtual try-on and visual reference photos can depict other people.

If you upload, link, or request processing of content that includes another person, you must have the rights and permissions to do so, and you are responsible for that content under our terms and acceptable use policy. We are working to curtail and gate the highest-risk of these features.

We use your data to run the Studio, keep it reliable, and communicate with you. Where the GDPR or UK GDPR applies, we rely on the following lawful bases.

• To provide the Service (performance of a contract): creating and managing your account, generating your on-brand output, saving your history, running the assistant, and delivering the features you use.
• Consent: processing your biometric data (voice and face), sending you marketing emails, and setting non-essential cookies. You can withdraw consent at any time, which does not affect processing already carried out.
• Legitimate interests (balanced against your rights): product analytics and improvement, security, fraud and abuse prevention, keeping the Service reliable, and defending our legal rights. We weigh these interests against your interests and freedoms.
• Legal obligation: responding to lawful requests and keeping records where the law requires it.

Repic's generation runs on AI model providers under contract with us. The main providers are Google Cloud / Vertex AI (Gemini for text, vision, image, document analysis, and translation; Veo for video; Imagen for upscale and virtual try-on), Google Cloud Text-to-Speech (Chirp 3) for voice cloning and synthesis, and Canva when you choose to open an asset there.

When you run an engine, we send the provider only what that generation needs - the relevant persona fields, your prompt, and any input the feature requires (which can include your reference photos, voice sample, or transcript text) - and receive your output back.

We do not sell your personal data. We share it only in these limited ways:

• With processors: the service providers that make Repic work (hosting and compute, model providers, storage, sign-in, and email delivery), each bound by contract to process your data only for us and only on our instructions. See our sub-processors page.
• For legal and safety reasons: with authorities or other parties when the law genuinely requires it, or where necessary to protect the rights, property, or safety of Repic, our users, or the public.
• In a business transfer: if Repic is involved in a merger, acquisition, financing, or sale of assets, your data may transfer as part of that transaction. We will require the recipient to honour this policy and will notify you of any change of control that affects your data.

The processors we rely on are listed, with their purpose and location, on our sub-processors page, which we keep current and give notice of changes to.

Because our providers - principally Google - operate in the United States and other regions, running the Service involves transferring your personal data outside Pakistan and outside the EEA and UK. Where we make such transfers, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK addendum) together with our providers' data protection terms.

We use strictly necessary cookies to keep you signed in and secure, and - with your consent - functional and analytics cookies to understand how the site and Studio are used. You can decline the non-essential kind and the product still works. The details, categories, and your choices are in our cookie policy.

We keep your data for as long as we need it for the purpose it was collected, then delete it or (where the purpose allows) keep it in a limited form. In practice:

• Account and profile data is kept while your account is open.
• Brand, persona, onboarding, and uploaded documents are kept while your account is active so the Studio can remember your brand; the raw uploaded document is intended to be removed after it has been parsed.
• Media in cloud storage - voice samples, reference photos, generated likeness images and video, try-on composites, and transcribed or downloaded media - is held while your account and the related Twins are active.
• Biometric data is governed by the retention and destruction schedule in our biometric policy.
• Usage, telemetry, support, and waitlist records are kept for a limited period to run, secure, and support the Service and for our records.

We are committed to deleting your data when you close your account or ask us to delete specific items, including the media held in cloud storage. Today, deletion and export are handled on request while we build self-serve controls; you exercise these rights by emailing privacy@repic.site and we action them. Residual copies may persist in encrypted backups for a limited period of up to [X] before those cycle out.

Depending on where you live, you have rights over your personal data. Repic honours the following for all users:

• Access - ask what we hold about you.
• Portability - get an export of your data in a usable format.
• Rectification - correct data that is wrong or incomplete.
• Erasure - ask us to delete your data.
• Restriction and objection - ask us to pause or stop certain processing.
• Withdraw consent - for anything based on consent, including biometrics and marketing.

To exercise any of these, email privacy@repic.site. We will respond within [30] days (and will tell you if we need longer, where the law allows). We will be honest that some of these controls are handled by our team on request today, while we build self-serve tools in the product. If you are in a region with a data-protection authority, you also have the right to complain to it - though we would appreciate the chance to resolve your concern first.

We protect your data with encryption in transit, access controls, and least-privilege permissions so that people on our team see only what their role requires. The voice-cloning key is held server-side only and is never sent to your browser or to anyone else.

Authorised members of our team may access your content and account where necessary to provide support, investigate abuse, keep the Service safe, or comply with the law. We limit this access and are working to log it. If a breach ever affects your personal data, we will notify you and any relevant authority as required, promptly and plainly.

Repic is a professional tool, not a service for children. You must be at least [16] years old to use the Service, and we do not knowingly collect personal data from children. If we learn that an account belongs to someone under that age, we will close it and delete its data. Given that Repic involves voice and face biometrics, we do not permit biometric features to be used by minors.

The following notices add to this policy for people in certain regions. Where a regional notice conflicts with the rest of this policy, the regional notice controls for those users.

(a) EEA and United Kingdom (GDPR / UK GDPR). The controller is [Repic Legal Entity Name]. Our lawful bases are set out in section 5, and your rights of access, portability, rectification, erasure, restriction, objection, and consent-withdrawal are in section 11. We process voiceprints and faceprints as special-category data on the basis of your explicit consent (Article 9). International transfers are covered in section 8 and rely on Standard Contractual Clauses or other appropriate safeguards. You may lodge a complaint with your local supervisory authority. Where we are required to appoint an EEA or UK representative or a Data Protection Officer, their details will appear here: [EEA/UK Representative], [Data Protection Officer]; in the meantime, reach our data-protection contact at privacy@repic.site.

(b) California (CCPA / CPRA). In the last 12 months we may have collected these categories of personal information: identifiers (such as name, username, email, IP address); internet and device activity (usage and telemetry); audio and visual information (voice samples, photos, and generated likeness); commercial information (waitlist and account records); professional information you provide; and inferences drawn to build your brand profile. Our sensitive personal information includes your biometric data (voiceprints and faceprints). We do not sell and do not share (as CCPA/CPRA define "sell" and "share") your personal information. You have the right to know, delete, and correct your personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Exercise them at privacy@repic.site.

(c) Illinois and other US biometric laws. If you are in Illinois (BIPA), Texas (CUBI), Washington, or another state with a biometric-privacy law, note that we handle biometric identifiers and information (voiceprints and faceprints) only under your consent and under a published retention and destruction schedule, and we do not sell or profit from your biometric data. The full disclosures, consent, and schedule are in our biometric policy.

If we change this policy in a way that matters, we will tell you before it takes effect - by email or in the product. Questions about your data, or a request to exercise your rights, go to privacy@repic.site, where a person answers.