Privacy Policy

1. What we collect

• Account data: your name, email address, a hashed password, whether your email is verified, and your language preference.
• Content: the video and audio you upload, and everything derived from it — transcripts, word timings, speaker labels, edit history, clips, chapters, captions, glossary terms, cleaned audio, any voice sample you enrol for overdub, and your exports.
• Billing data: your plan, your minute balance and its ledger, and the subscription, order and payment identifiers Razorpay returns to us. We never receive your full card number, UPI PIN or netbanking credentials.
• Security and abuse data: the IP address and time of signup, upload counts, and rate-limit records. We use these to stop bulk fake accounts and free-tier abuse.
• Technical data: server and application logs — IP address, browser user agent, request time and errors — and the internal job records that move your video through the pipeline.
• Analytics: page views and a small set of named product events (for example: pricing page viewed, checkout completed), collected by a self-hosted, cookieless Umami install. It records URL, referrer, country and device class. It does not set tracking cookies, does not follow you across other websites, and no advertising network receives any of it.

2. Cookies

We only use cookies the site needs to function: a session cookie to keep you signed in, a CSRF token to protect forms, a "remember me" cookie if you choose it, and a cookie storing your language choice. We run no advertising, profiling or cross-site tracking cookies — which is why you are not asked to dismiss a cookie banner.

3. Why we process your data

• To provide the service you asked for: storing your media, transcribing it, applying your edits and rendering exports. This is performance of our contract with you.
• To bill you and to keep the tax and accounting records the law requires.
• To keep the service secure and to prevent abuse and fraud — our legitimate interest, and yours.
• To send transactional email: address verification, password resets, "your transcript is ready", and warnings before media is deleted at the end of its retention window.
• To understand which parts of the product are used, through the cookieless analytics described above.

4. Who else processes your data

We keep this list short on purpose. These are the only third parties that touch your data, and what each one receives:

• Cloudflare R2 — object storage for your uploads, intermediates and exports, in the Asia-Pacific region. Your browser uploads and downloads directly to and from R2 using short-lived signed URLs.
• A speech-recognition provider operating in India — transcription for Indian languages. The audio track of your upload is sent to their API to produce the transcript.
• GPU containers we operate on Modal — English transcription and voice overdub run on models we host ourselves. These containers pull your media from R2 and write results back; the media is not shared with anyone else.
• OpenRouter and the model providers it routes to — used for clip suggestions, chapter titles and speaker-name guesses. Only transcript TEXT is sent. Your video and audio never are. These providers may briefly retain a request for their own abuse monitoring under their own policies.
• Razorpay — payments and subscriptions. They receive your payment details directly and give us only identifiers and status.
• Our own servers in Singapore — the application, database and job queue, plus a separate server running our self-hosted analytics.
• An email delivery provider, for the transactional email listed above.

5. Where your data is processed

We operate from India, but the service does not run only in India. Our application servers are in Singapore and your media is stored in the Asia-Pacific region. Indic transcription is performed in India; some model providers reached through OpenRouter operate elsewhere, so transcript text may be processed outside the region under those providers’ own terms.

If you would rather no transcript text went to a general-purpose model provider, do not use the clip, chapter and speaker-naming features — the rest of the product does not need them.

6. How long we keep it

• Source media and processing intermediates: deleted automatically at the end of your plan’s retention window — 7 days on the free plan, 60 days on paid plans today. We email you before this happens.
• Exports, transcripts and edit history: kept until you delete the project or close your account.
• Account and billing records: kept while your account is open, and afterwards only as long as tax and accounting law requires.
• Server logs: kept for a short period for debugging and security, then rotated away.
• Analytics: aggregate counts with no account identifier attached.

7. Your rights

You can ask us to give you a copy of your data, correct it, or delete it, and you can object to processing based on our legitimate interests. Deleting a project inside the app already removes its files, transcript and history permanently.

To close your account and have the remaining data erased, email contact@vidcarve.com from your registered address. We action deletion requests within 30 days, apart from records we are legally required to retain. If you are unhappy with how we have handled a request, write to the same address — that is also our grievance contact under India’s data protection law — and you may complain to your local data protection authority.

8. Security

Traffic is encrypted with TLS. Passwords are hashed, never stored in readable form. Media moves between your browser and storage over short-lived signed URLs, and every call between the application and our processing workers is signed and verified in both directions.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

9. Children

The service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us at contact@vidcarve.com and we will remove it.

10. Changes to this policy

We will update the date at the top of this page whenever this policy changes, and email registered users if the change is material.