Controller and scope
Prem Pratap Singh Tomar operates Facily from India and determines how personal data is processed across the Facily websites, mobile apps, creator tools, advertiser portal, and administration portal.
Data we process
Account data includes email, display name, roles, credential hashes, verification state, sessions, device and request metadata, and legal acceptance records. Product data includes channels, videos, uploads, comments, reports, subscriptions, library actions, watch progress, searches, feedback, campaigns, creatives, billing records, and administrative decisions.
Technical data may include IP address, user agent, anonymous session identifiers, security logs, playback diagnostics, device push tokens after opt-in, and service telemetry. Facily does not need your precise location, address book, microphone, camera, or advertising identifier for ordinary viewing.
Why we process data
We process data to provide requested services and perform our contract; secure accounts and prevent abuse; comply with legal obligations; operate support, moderation, billing, and rights requests; and pursue legitimate interests in reliability, fraud prevention, measurement, and product improvement where those interests do not override your rights.
Optional push notifications, marketing messages, and personalization depend on your choice and can be disabled. Facily does not sell personal data or share it for cross-context behavioral advertising.
Sharing and processors
Data is shared only with service providers needed for hosting, storage, databases, networking, TLS, security, push delivery, payment processing when enabled, and legal compliance. Current public infrastructure uses Google Cloud; Android push uses Firebase Cloud Messaging only after opt-in; Apple push uses Apple Push Notification service only after opt-in. Providers process data under their own terms and applicable processing commitments.
International transfers
Facily is operated from India and providers may process data in other countries. We use contractual, technical, and organizational safeguards required for applicable transfers. Some jurisdictions may require additional transfer mechanisms before service is offered there.
Retention
Retention depends on purpose, account status, legal duties, disputes, fraud prevention, and backup cycles. The current schedule is published at /data-retention. Account export and deletion are available from account settings; deletion fails closed if a data-owning service cannot participate.
Your rights and choices
Depending on applicable law, you may request access, a portable copy, correction, deletion, restriction, objection, withdrawal of consent, or review of a decision. You may also complain to the competent authority. Use account export/deletion controls first, then /feedback for a verified request. Withdrawing consent does not affect earlier lawful processing.
Security
Facily uses password hashing, short-lived access sessions, revocation, role and ownership checks, encryption in transit, restricted service identities, rate limits, audit events, vulnerability scanning, backups, and incident procedures. No system is risk-free; report suspected security issues through /feedback without accessing other users' data.
Children
Facily accounts are currently limited to adults age 18 or older. We do not knowingly create accounts for children. The Child Safety Policy at /child-safety explains reporting and removal. Content marked as made for kids does not change the account age requirement or permit behavioral advertising to children.
Changes and contact
Material changes receive a new version and renewed acceptance where required. Use /feedback for privacy questions or verified rights requests. Do not include passwords, payment credentials, or unnecessary identity documents.