Last updated: 19 September 2026
Effective date: 19 September 2026
1. Who we are and how to contact us
Wrap! is operated by One Octet FZCO, registration number DMCC197454, based in Dubai, United Arab Emirates. Our registered address is Unit No: BA979, DMCC Business Centre, Level No 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates. One Octet FZCO is not VAT registered.
We are responsible for the personal data used to operate Wrap, including accounts, security and customer support. This policy covers www.wrap-video.ai, app.wrap-video.ai and the related service.
For privacy requests, contact contact@wrap-video.ai.
2. What we collect
- Account information: email address, password hash, account and profile settings, account status and session identifiers.
- Content and generation data: prompts, uploaded reference images, generation settings, generated videos and audio, job status and credit usage.
- Billing information: Paddle customer, subscription and transaction identifiers, amounts, payment status and limited payment-method information supplied for fraud prevention. Paddle collects full payment details; Wrap does not store full card numbers.
- Security information: IP addresses, user agents, session activity and a hash of browser characteristics used to limit abuse of free accounts.
- Affiliate programme: application and promotion information, accepted terms version, permanent signup attribution, pseudonymous referred customer activity, commissions and payout records. Bank details supplied by affiliates are encrypted with AWS KMS; routine views are masked and administrator access is audited. Payout requests retain an encrypted snapshot of the bank details used.
- Communications: support requests, email preferences and service messages.
Please avoid submitting sensitive personal information or content about someone else without an appropriate legal basis.
3. Why we process data
We use account and content data to provide the service you request, including authentication, generation, storage and billing. Where the GDPR or similar rules apply, these activities are necessary to perform our contract with you.
We use technical and usage information for our legitimate interests in preventing fraud, protecting users, investigating abuse and maintaining the service. We retain relevant records when necessary to meet legal obligations or handle legal claims. Where consent is required, we seek it before the relevant processing and you may withdraw it.
Affiliate attribution uses only a referral code supplied at signup, without attribution cookies. Affiliates see pseudonymous customer identifiers, commercial status and commissions, not customer names or emails. We process programme data to administer the affiliate agreement, prevent fraud and reconcile payments. Authorised staff and the banks handling manual payouts may access the information necessary to make and document a transfer.
We send transactional emails for account security, generation status and billing. Optional email preferences can be managed in your account.
4. AI generation and safety checks
We send your prompts, reference images and generation settings to fal.ai and the providers operating your selected model to produce the requested output. Their processing may depend on the model and their applicable terms. We do not use your content to train our own models.
By default, safety checks use a local prompt blocklist and the safety controls available from the generation provider. This mode does not send content to OpenAI. An optional additional moderation service, if enabled, uses OpenAI to process prompts, reference images and sampled video frames, and to transcribe generated audio for checking. Temporary media created for those additional checks is removed after processing.
Automated checks can block a request or output and can make mistakes. They do not guarantee detection of every prohibited item. You can contact us to contest a restriction. We may use relevant records to investigate abuse or respond to lawful requests.
5. Providers and recipients
| Provider or recipient | Role and data involved |
|---|---|
| Amazon Web Services | Application hosting, database, media storage, operational logs and transactional email. The infrastructure is configured in the Paris region (eu-west-3). |
| fal.ai and the selected model provider | Prompts, reference media and settings needed for AI generation. |
| OpenAI, only when additional moderation is enabled | Content moderation and transcription for the safety checks described above. |
| Paddle | Merchant of record for payments, subscriptions, invoicing and payment-related fraud checks. Paddle also processes data under its own Privacy Policy. |
| Sentry, when error monitoring is enabled | Diagnostic information used to investigate application failures. |
| Advisers and competent authorities | Information necessary for accounting, legal advice, claims or legal obligations. |
We do not sell your personal data. The application does not install advertising or audience-measurement trackers. Contact us for information about a particular provider or model before submitting sensitive content.
6. International processing
One Octet FZCO is established in the UAE. Some providers may process data in other countries, including the United States, even where our application infrastructure is in Paris. Data protection rules can differ between countries.
Where applicable law requires safeguards for an international transfer, the transfer must be covered by an appropriate mechanism, such as an adequacy decision or approved contractual safeguards. Contact us for information about the arrangements relevant to your data.
7. Retention and deletion
We keep account and content data while needed to provide your account and requested services. You can delete your account from its settings. The deletion process revokes sessions, removes or anonymises account identifiers and prompts, and requests deletion of generated media. Copies in backups, provider systems and records subject to legal or security retention may persist separately.
Operational log groups are configured with a 30-day retention period and automated database backups with a 7-day retention period. These infrastructure settings do not mean that every category of data is deleted on the same schedule. Billing and credit records, evidence needed for disputes, and records of abuse may be retained for the applicable accounting, legal or security purpose. Support correspondence is kept as needed to resolve and document the request.
Account deletion closes an affiliate profile, clears its current bank details and anonymises application information. The financial ledger, corrections and encrypted payout snapshots needed for reconciliation, disputes or accounting obligations are retained with restricted access. The self-service export includes programme records and masked bank details; contact us for a verified request concerning full banking records.
We assess retention using the purpose of the record, account status, outstanding disputes and legal obligations. Contact us for the retention information relevant to a specific record or to request deletion where applicable. The fact that PAYG Credits do not expire does not make all personal data subject to indefinite retention.
8. Cookies and browser storage
Wrap uses session cookies to keep you signed in and browser storage to remember your composer mode and draft prompt. Paddle may use technologies needed to provide checkout and prevent payment fraud. See our Cookie Policy for details and controls.
9. Your rights
Depending on the law applicable to you, you may request access, correction, deletion or a copy of your data, object to or restrict processing, and withdraw consent. Account export and deletion are available in account settings. Send other requests to contact@wrap-video.ai. We may need to verify your identity before acting.
We respond within the deadlines set by applicable law. Where the GDPR applies, this is normally one month; extensions permitted by law will be explained to you. You may complain to the relevant data protection authority, including the authority in your country of residence where applicable.
10. Security
We use measures including password hashing, encrypted connections, session controls and restricted administrative access. No service can guarantee complete security. We handle suspected breaches and any required notifications under applicable law.
11. Business use and third-party data
If you submit personal data belonging to clients or other people, you must have the necessary authority and provide appropriate information to them. Roles and contractual safeguards depend on the processing involved. Contact us to arrange any required data processing agreement before using Wrap to process client personal data. This policy does not claim that a separate agreement has already been signed automatically.
12. Age and changes
Wrap is intended for adults aged 18 or over. If you believe a minor has supplied personal data, contact us so we can investigate.
We update the date above when this policy changes. We communicate material changes through the service or by email as appropriate, and obtain consent where required. Continued use does not replace consent required by law.
13. Contact
One Octet FZCO
Unit No: BA979
DMCC Business Centre
Level No 1
Jewellery & Gemplex 3
Dubai, United Arab Emirates
Registration number: DMCC197454
Privacy and support: contact@wrap-video.ai