Privacy policy

1. Who operates Fablyn

Fablyn is operated by Yarra Systems Pty Ltd (ABN 20 698 366 531) in Victoria, Australia. Privacy questions and requests can be sent to support@fablyn.app.

2. Information we collect

We collect account and identity information such as your name and email address; workspace content such as brand settings, scripts, narration, generated audio and video, captions and transcripts; support communications; and technical, security and product-usage information. For paid accounts, we receive limited billing information from Stripe, such as customer and subscription identifiers, subscription status, invoices and entitlements. We do not receive or store your full payment-card number.

For shared video reviews, we collect the reviewer’s supplied name, verified email address, comments, approval or rejection decisions and their timestamps. The workspace owner can see the reviewer’s name and email. Other people with access to the same shared cut can see review comments and decisions with the reviewer’s name, but not their email address. Review links, sign-in challenges and sessions also produce access and abuse-prevention records.

Optional website measurement

Optional first-party measurement is off until you enable it from the website footer. It uses a random identifier for the current browser tab and coarse campaign categories to understand page visits, sample playback and signup. It does not send your scripts, email address or IP address in measurement events. Browser events are kept for up to 30 days; when you sign in with measurement enabled, attribution is linked to your workspace for up to 90 days to understand completed videos and paid use. You can disable measurement in the footer. This stops browser collection and requests deletion of measurement records associated with this tab’s identifier. If that request cannot complete, the tab keeps the identifier needed to retry. After processing withdrawal, we retain the random identifier alone for up to 90 days to prevent delayed requests from recreating those records; it is not used for measurement. We respect Do Not Track and Global Privacy Control signals. Security and essential service records are separate.

Separately, we count page views by day, page and the kind of site a visit came from (for example a search engine or a social network). These counts contain no identifier, cookie, IP address or browser details and are not personal information.

3. Why we use it and our legal bases

We use this information to authenticate users; operate and secure Fablyn; generate and deliver content; measure plan usage; administer subscriptions; provide support; prevent fraud and abuse; improve reliability; and comply with legal obligations. Where the EU/EEA GDPR applies, we rely on contract performance where processing is necessary for a contract with you; legitimate interests in administering business accounts and providing, supporting and securing the service where those interests are not overridden by your rights; consent for optional measurement; and legal obligation where applicable. Where your employer or client is our customer, account administration may rely on legitimate interests rather than a contract with you personally. You can withdraw measurement consent at any time. We do not sell personal information or use workspace content for advertising.

4. Roles and service providers

Yarra Systems is the controller of account, billing, support, security and website-measurement information it decides how to use. When your organisation puts scripts, audio, video, captions or transcripts into a workspace, it may be the controller and Yarra Systems generally acts as its processor or service provider, processing that content only to provide the service under the organisation’s instructions. Organisations remain responsible for their own notices, instructions and lawful basis. We use service providers including Cloudflare for hosting, storage, security, email and AI services; TypeSafe’s Jev model for assistant routing, Anthropic’s Claude Sonnet 5.5 model for assistant generation, and Google models for assistant generation and narration, accessed through Cloudflare but run by those companies, as described below; Google Workspace for support email and business records; and Stripe and Link for checkout, billing, tax, fraud, disputes and transaction support. Stripe and Link also process payment and transaction information for their own merchant-of-record responsibilities under their privacy notices. We use YarraDesk, operated by Yarra Systems on Cloudflare, to keep restricted support and privacy case records. It is our own support system, not a separate company receiving your data. Privacy requests about Fablyn can be sent to our support address.

5. International transfers

These providers may process information in Australia, the United States and other countries where they or their subprocessors operate. Contact our support address for information about the providers and destinations relevant to your use, and to request details or a copy of any applicable transfer safeguards. This notice does not itself establish a transfer mechanism or replace a data-processing agreement.

The Fablyn assistant and narration

When you use the Fablyn assistant, we store your requests and replies in your private Thread. We send the request and relevant Video and Thread context to TypeSafe’s Jev model to identify the task and its complexity, and to Anthropic’s Claude Sonnet 5.5 model or Google models to generate a reply or design, through Cloudflare AI services. New designs and larger changes use Claude Sonnet 5.5; small changes, ideas and help use a Google model. The assistant receives selected image ids and dimensions; it does not receive image contents for visual analysis. When you choose new narration, we send the spoken text to a Google narration model through Cloudflare. Fablyn disables request logging and caching at the AI Gateway for these calls; unchanged narration is cached privately in your workspace for reuse.

These AI models are third-party products. Cloudflare passes our requests to them, but Anthropic, Google and TypeSafe run the models, and they process what we send under their own terms, not under Cloudflare’s data processing agreement. Cloudflare describes the Google and TypeSafe models as zero data retention. It makes no such statement for Anthropic’s model, so how long Anthropic keeps what we send depends on its own terms. Because of this, do not put personal information about yourself or others in narration text or assistant requests, unless your organisation has decided it may be shared with these providers. Contact our support address for the current provider terms.

We keep credit quotes, spending preferences and financial usage receipts to enforce your spending choices and account for AI usage. Permanent account closure removes private Threads, narration quotes and spending preferences. Financial receipts may remain under our billing retention obligations. Connected agents are optional and operate under the access you grant them and their provider's policies.

The Showcase

If you submit a video to the Showcase, we keep the submission, the decision, and any credit name and link you give. If the video is approved, the video, its first still and its captions are published at fablyn.app/showcase with the credit, so anyone can see them. The credit name and link are personal information: we remove them when you ask and when the workspace closes. The video itself stays published without a credit under the licence you gave when you submitted it, unless Fablyn takes it down.

6. Security and retention

We use reasonable technical and organisational safeguards appropriate to the service. No internet service can guarantee absolute security. We retain information while an account is active and as reasonably needed to operate Fablyn, resolve disputes, enforce agreements and meet legal obligations, then delete or de-identify it where appropriate. Workspace content is retained under the account and service lifecycle; exact deletion timing depends on backups, abuse records and legal holds. Stripe retains payment information under its own policies. We do not promise an indefinite archive period.

7. Your rights and complaints

You may request access to, correction or deletion of eligible personal information, restriction or objection to certain processing, data portability where applicable, or withdrawal of consent, by emailing support@fablyn.app. You may also object to processing based on legitimate interests. Please describe the request and the account or shared review it concerns. Do not send passwords, sign-in codes, payment-card details or identity documents in your initial email. We may request proportionate information to verify your identity. Where we process workspace content on an organisation’s behalf, we will direct the request to that organisation and assist it as appropriate. Where GDPR applies, we respond without undue delay and within one month of receiving a request. If its complexity or number permits an extension, we will notify you within that first month, explain why, and may take up to two additional months. If we cannot fulfil a request, we will explain the reason and available complaint routes. Any continued retention must have an applicable lawful justification. You can complain to your local EU/EEA supervisory authority, the UK Information Commissioner’s Office where applicable, or the Office of the Australian Information Commissioner.

8. Scope and changes

Fablyn is available to users aged 13 or older, subject to any higher minimum age required in their country. Users under 18 need permission from a parent or legal guardian. Fablyn is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided personal information to Fablyn, contact us at support@fablyn.app so we can investigate and arrange its removal where appropriate. We may update this policy as the service or law changes. We will post the revised version here and update its effective date.