Introduction

KreatorsFactory (“we,” “us,” “our”) provides AI-powered face swap, talking avatar, and lip sync services through our website (kreatorsfactory.com), mobile apps (iOS and Android), and desktop apps (Windows and macOS).

This Privacy Policy applies to everyone who uses KreatorsFactory. It is written to comply with the Nigeria Data Protection Regulation (NDPR), the Nigeria Data Protection Act 2023 (NDPA), and — for users in the European Union, United Kingdom, and elsewhere — the General Data Protection Regulation (GDPR) and equivalent laws.

By using KreatorsFactory, you agree to the practices described here. If you do not agree, please do not use the service.

What we collect

Information you give us directly

• Account information: name, email address, password (stored as a one-way hash, never in plain text).
• Photos and videos you upload to face-swap, generate talking avatars from, or use for lip sync.
• Face library entries: photos you save to reuse across features, with the names you give them.
• Payment information: card details, mobile-money numbers, or crypto-wallet addresses when you subscribe or buy credits. Card numbers are processed directly by our payment partners (Paystack, Flutterwave, Korapay, Cryptomus, NOWPayments, Circle, Apple, Google) and never touch our servers.
• Support messages you send us by email or contact form.

Information we collect automatically

• Device and usage data: device type, operating system, app version, IP address, and how you interact with KreatorsFactory (e.g. which features you use, how long videos take to render).
• Cookies and similar technologies: see our Cookie Policy for the full list.

How we use it

We use your data only for these specific purposes:

• Provide the service: deliver the face swap, avatar, lip sync, and live face swap features you request.
• Process payments: charge for subscriptions and credit packs through our payment partners.
• Send transactional emails: account verification, password resets, payment receipts, and notifications when your video is ready.
• Improve the service: analyse usage patterns to find bugs, improve performance, and decide which features to build next. We never use your uploaded media for this — only aggregated metrics.
• Prevent abuse: detect and block fraud, illegal content, and behaviour that violates our Terms of Service.
• Comply with the law: respond to legal requests, tax obligations, and regulatory requirements.

AI processing & your face data

The photos and videos you upload — including any faces they contain — are used only to generate the result you request (Swap Studio, Avatar Studio, Lip Sync or Identity Swapper). We do not extract or store any biometric faceprint, face template, or face geometry, and we never use your media to identify you.To create the result, your media is processed by specialist AI providers acting solely as our processors under contract; they may not use it for any other purpose, and we name them individually on request (see section 5). Your media is encrypted in transit and at rest, is deleted from our servers once the render completes (failed-job media is purged after 30 days), and you can delete your account and all associated media at any time in Settings → Account → Delete account.

Face data is sensitive personal data, and we treat it that way. Here is exactly how it's handled in each KreatorsFactory feature:

Renders you start and come back to

Swap Studio, Avatar Studio, Lip Sync and Identity Swapper. These run on our hardware, not on your device.

• Your uploaded photos and videos are sent over an encrypted (HTTPS) connection to our encrypted media storage.
• They are passed to the AI provider that performs that particular job,only for the duration of processing it. Our providers are contractually barred from retaining your media once the job completes, or from using it for any purpose of their own.
• The output video is saved to your account so you can download or share it.
• You can delete any uploaded media or generated video from your account at any time. Deleted files are permanently removed from our storage within 30 days.

Live Swap and Voice Swap, during a call

Where this is processed depends on which one you are using, and the difference is significant enough that we set it out in full rather than summarise it.

• Live Swap in the desktop app runs on your own computer. The model is downloaded once, the first time you open the app, and every calculation happens locally from then on. Your camera feed is not transmitted to us. The app contacts us only to confirm your allowance and to report the number of minutes you have used, so that the allowance can be enforced.
• Live Swap in the browser extension is processed on our servers. A browser extension cannot download and run a model of this kind, so your camera video is sent to us over an encrypted connection, transformed, and returned to the call as it happens.
• Live Body Swap is processed on our servers on every platform, including inside the desktop app. It is heavier than a personal computer can carry while a call is in progress.
• Voice Swap is processed on our servers. Your microphone audio is sent, converted, and returned to the call in the same way.

Where processing happens on our servers, your video and audio are handled in transit only. The call is not recorded and no copy is kept.What we retain is the session record itself — when it started, when it ended, how long it ran and which engine served it — because that is what your allowance is measured and billed against.

What we never do

• We never use your media to train AI models. Period.
• We never sell your data to third parties for marketing or advertising.
• We never share your photos or videos with anyone except the processors described above, and only for the time needed to carry out the request you made.

Who we share with

We share data only with the partners we need to operate the service:

• AI processing providers — only the specific media needed for the job you asked for, and only while it is being carried out.
• Cloud storage providers — your uploaded and generated media, encrypted in transit and at rest.
• Payment processors: Paystack, Flutterwave, Korapay, Cryptomus, NOWPayments, Circle, Apple App Store, Google Play Store — only the data needed to process your payment.
• Transactional email providers — your name and email address, so we can send the emails the service has to send you.
• Authentication: Google (for “Sign in with Google”) — only the basic profile fields you authorise.
• Hosting and infrastructure providers — our application servers are located in Europe.

Each of these is engaged as our processor under a written agreement that limits them to acting on our instructions. We do not publish the list of individual companies, but we are not withholding it from you: we will name our current processors to any user, customer or regulator who asks — email privacy@kreatorsfactory.com and we will send the current list.

We may also disclose data when legally required (court orders, subpoenas, regulator requests) or to protect KreatorsFactory and our users from fraud, abuse, or harm.

How long we keep it

• Account data: as long as your account is active. If you delete your account, we erase it within 30 days, except where law requires us to keep records longer (e.g. tax invoices for 7 years).
• Uploaded media and generated videos: until you delete them, or 12 months after your last login if you stop using the service.
• Live face swap usage logs: kept for 90 days for quota enforcement and abuse prevention, then aggregated into anonymous totals.
• Payment records: 7 years (Nigerian tax law).

Your rights (NDPR + GDPR)

You have the right to:

• Access a copy of the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Delete your account and associated data.
• Restrict certain types of processing.
• Export your data in a machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, where consent is the legal basis for processing.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

To exercise any of these rights, email privacy@kreatorsfactory.com. We respond within 30 days.

How we protect your data

• All connections to KreatorsFactory use TLS 1.3 (HTTPS).
• Passwords are stored as a salted, deliberately slow one-way hash — we cannot reverse them, even if our database were compromised.
• Sign-in uses short-lived access tokens with rotating refresh tokens, so a token that leaks stops working quickly.
• Payment data never touches our servers — it goes directly from your device to the payment provider.
• We follow OWASP Top 10 best practices, run automated security scanning on every deploy, and patch dependencies promptly.

No security system is perfect. If you believe your account has been compromised, email security@kreatorsfactory.com immediately.

Children

KreatorsFactory is not intended for users under 13 (under 16 in some jurisdictions). We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact privacy@kreatorsfactory.com and we will delete it.

International transfers

KreatorsFactory is built and supported from Nigeria. Some of our processors operate from the United States and Europe. When data is transferred outside Nigeria or the EU, we rely on Standard Contractual Clauses (SCCs) and the provider's own NDPR / GDPR compliance.

Changes to this policy

When we make material changes, we will email registered users and post a notice on this page at least 14 days before the change takes effect. Continued use of KreatorsFactory after that date means you accept the updated policy.

Contact us

Questions, complaints, or rights requests: privacy@kreatorsfactory.com.

Postal address:
KreatorsFactory
Lagos, Nigeria