Privacy Policy

SprayCan (“we”, “us”), a product of Kamase Labs Inc., is an AI video tool at spraycan.studio that generates videos recreating a public social-media video’s format with your persona swapped in. This policy explains what we collect, why, who processes it, and how to get it deleted. Questions or requests: griffin@hirebarry.com.

Account data. When you sign up with email and password or a magic link, our authentication provider (Supabase) processes your email address, credentials, and session information. We store your email address and an account identifier.

Persona photos. Photos you upload to create a persona, and persona images you generate with AI. These are stored in a private cloud-storage bucket and served only through short-lived signed URLs.

Source videos. When you paste a public Instagram Reel URL, we download that public video at your direction, extract frames from it, and keep the video and frames as part of your job.

Generated media. The swapped frames and rendered videos the pipeline produces for you, stored in the same private bucket and shown in your gallery.

Job and credit records. Each job’s status, events, prompts, and timestamps, plus a ledger of every credit grant, charge, and refund — kept to run the pipeline, show you progress in real time, and operate the credit system.

Technical data. Standard server logs (IP address, request metadata) for security and reliability, and session cookies to keep you signed in — no advertising or cross-site tracking cookies.

Persona photos contain faces, and SprayCan’s whole purpose is to place a persona’s likeness into new video. We want to be precise about what that does and doesn’t mean:

• Your photos and likeness are processed for exactly one purpose — generating the persona-swapped media you explicitly asked for — and only when you start a generation.
• We do not build or maintain a facial-recognition or biometric identification database, and we don’t use your photos to identify, verify, or profile anyone.
• We don’t use your photos, videos, or generated media to train our own models, and our AI providers process them solely to fulfill your generation request.
• Uploading a photo of someone else requires their permission — that obligation is yours and is spelled out in the Terms of Service. If a SprayCan video depicts you without your consent, email us and we’ll act on it promptly.

To provide the service: authenticate you, run the generation pipeline on the photos and links you submit, store and show you your personas and media, meter credits, stream job status to your browser, send essential service emails (confirmation and magic links), keep the service secure, enforce our terms, and comply with law. That’s the whole list.

We use a small set of infrastructure providers, each processing data only to run SprayCan:

• Supabase (US-East) — authentication, the Postgres database holding accounts, jobs, events, and the credit ledger, and realtime job-status updates.
• Google Cloud (US) — private cloud storage for photos, source videos, and generated media, and the Gemini API, which analyzes frames and refines persona prompts.
• OpenAI — image generation: creating AI persona images and swapping your persona into the selected video frame.
• Kie.ai — video rendering; it receives the source video and the swapped frame via time-limited signed URLs to produce the final video.
• Vercel — website hosting.

Source videos are fetched directly from the public Instagram URL you provide. We don’t ask for or receive your Instagram or TikTok credentials, and we can’t post or act on your behalf anywhere.

We don’t sell personal data, share it for cross-context behavioral advertising, use it for advertising of any kind, or use your content to train our own models. We don’t publish your personas or generated media anywhere — your gallery is yours.

We keep account data, personas, media, and job history while your account is active, so your gallery keeps working. To delete specific personas, videos, or your whole account, email griffin@hirebarry.com from your account address — we erase your profile, personas, uploaded photos, generated media, and job history, keeping only records we’re legally required to retain. Copies at our processors are deleted per their retention schedules; signed URLs expire on their own.

Kamase Labs is incorporated in British Columbia, Canada, and our primary privacy framework is the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA). Under PIPEDA and BC PIPA, you can ask us to access, correct, export, or delete your personal information, and to know how we’ve used or disclosed it, by emailing griffin@hirebarry.com from your account address; we respond within the timelines those laws require, or the timelines your local law requires if it also applies to you.

Our processors (listed above) run on U.S. infrastructure, so your personal information is processed and stored in the United States and may be accessible to U.S. authorities under U.S. law. By using SprayCan, you acknowledge and consent to this cross-border transfer of your personal information, as PIPEDA requires us to disclose.

If you’re in California, note that we don’t sell or share personal information as the CCPA defines those terms, and we don’t use sensitive personal information beyond providing the service you asked for. If you’re in the EEA or UK, our processing rests on the contract we have with you (running the service) and legitimate interests (security), and you may also lodge a complaint with your local supervisory authority.

All traffic is encrypted in transit (TLS). Media lives in a private bucket accessible only through short-lived signed URLs; the database enforces row-level security so accounts can only read their own rows; and credentials and API keys are stored in managed secret stores with least-privilege access.

SprayCan is not directed at children and requires users to be at least 18. Don’t upload photos of minors; we delete accounts and content that violate this.

If this policy changes materially, we’ll update this page and the date above, and notify active accounts by email for significant changes.

Privacy questions and requests: griffin@hirebarry.com.