POLICIES & OPERATIONAL DISCLOSURES
Privacy Policy
Draft for owner and legal review · Based on the current implementation
Status of this document
This is a draft operational disclosure based on the current application. It requires approval by the business owner and legal counsel before public launch. The operator’s legal identity, jurisdiction, privacy contact, controller responsibilities, regional rights, and retention obligations have not yet been supplied.
Accounts and sessions
When account sign-in is enabled, Firebase handles Google or email/password authentication. The application stores account identity, email, profile details, verification status, roles, and server-side session information. Session and request-protection cookies support authentication and secure changes. Local mode is restricted to the computer running the application.
Projects and user assets
The studio stores project scripts, storyboards, settings, prompts, generated media, uploads, narration, edits, and related production records. Authenticated workspaces use account ownership controls. Depending on deployment configuration, records and media are stored locally or in configured database and object storage services.
AI providers
When you request generation, relevant prompts, scripts, speech text, settings, and selected references may be sent to the configured provider for that task. Provider handling depends on your selected model and the operator’s provider agreements. This document does not promise provider training exclusions or a universal retention period; those agreements require review.
Payments and usage
Stripe handles checkout and billing management. The application stores customer mappings, subscription state, payment references, credit grants, usage, and webhook processing records. It does not collect card details in the application.
Contact requests
The contact form stores your name, email, topic, message, consent, submission time, and a request reference in a private administrator inbox. A hash of the connection address is used to limit abuse. This implementation removes contact records after 90 days when contact handling or inbox access runs; administrators can delete records sooner. Requests are not automatically sent to email.
Deletion and recovery
Deleted projects and assets can remain recoverable in Trash until their configured retention expires. Named versions and undo history are part of the workspace. Account deletion closes access and runs a permanent-content deletion workflow; required billing and audit records can be retained. Backup retention and legal retention schedules still require owner review.
Your choices and questions
Manage your profile, sign-in, billing, and account deletion in My account. Use the contact form for a privacy or deletion request. Applicable privacy rights, verification requirements, response deadlines, subprocessors, international transfers, and a formal privacy contact must be confirmed before this draft becomes an approved policy.
Contact Video Studio for questions about these disclosures.