Privacy Policy

Effective Date: October 30, 2026

This Privacy Policy describes what information VidGlade collects, why we collect it, how we store it, and your privacy rights.

1. Information We Collect

Account information: Your name, email address, and bcrypt-hashed password when you register.

Login activity: Timestamps of your logins, your last IP address, your last user-agent string, and an approximate geographic location (country, region, city — derived from your IP via the free ipapi.co service; no GPS, no coordinates).

Generation prompts: The text prompts you submit for AI generation (project topic, scene visual prompts, narration text, instructions). These are stored in the Project and Scene tables so you can resume editing.

Generated projects: All generated scripts, images, voice audio, captions, and rendered MP4 files are stored in the private Supabase Storage bucket and referenced from the Project table.

Moderation records: When content moderation blocks a request, a ModerationLog row is created containing: the original prompt text, the matched policy category, the severity, your user or guest ID, your IP address, and approximate location. These are admin-only — never exposed to other users.

Contact Us messages: When you submit the Contact Us form, your name, email, subject type, message text, IP address, and user-agent are stored as a SupportTicket row. Admin replies are stored as SupportTicketReply rows.

Email notifications: When notifications are enabled, your admin Gmail address is stored in the AdminNotifySetting table. This address is never exposed to customers — it is only used as the "To" address on private admin notifications.

YouTube OAuth connection data: When you connect a YouTube account, your access and refresh tokens are stored AES-256-GCM encrypted in the YouTubeAccount table. The plaintext tokens never appear in API responses.

2. How We Use Your Information

To operate the Service (process generation requests, render videos, manage your projects).
To enforce our Content Guidelines (automated moderation).
To respond to support requests.
To send you email verification links and password reset links.
To send private admin notifications (only to the configured admin Gmail address).
To maintain audit logs of sensitive admin actions.

We do not sell your personal information.

3. Subprocessors

VidGlade uses these third-party services to process data:

Supabase (database, file storage) — your account, projects, generated files, and support tickets are stored here.
Vercel (web hosting) — the application is hosted on Vercel's serverless platform.
Resend (transactional email) — verification emails, password reset emails, support replies, and admin notifications are sent through Resend from support@vidglade.com.
Z.ai (AI generation) — scripts, images, and voice narration are generated via the Z.ai SDK when available. Falls back to Pollinations.ai for images and gTTS for voice when Z.ai is unavailable.
Google/YouTube (publishing) — when you connect a YouTube account, OAuth tokens are used to upload videos on your behalf.
ipapi.co (approximate IP geolocation) — used to determine country/region/city from your IP for moderation and login security. No GPS, no coordinates.

4. Data Retention

Account information: retained until account deletion.
Generated projects and files: retained until you delete the project.
Moderation records: retained indefinitely for abuse prevention and audit. Admins can review and dismiss records.
Contact Us tickets and replies: retained until the ticket is archived or deleted.
Login activity records (UserActivity): retained indefinitely for security audit.
YouTube OAuth tokens: retained until you disconnect the channel.

5. Your Privacy Rights

You may:

Request a copy of your personal data by contacting support@vidglade.com.
Request correction or deletion of your personal data.
Disconnect your YouTube account at any time from the Channels view.
Delete your account by contacting support@vidglade.com. Account deletion does not remove content you have already published to third-party platforms.

[OWNER REVIEW REQUIRED — depending on the operating jurisdiction and user location, additional rights may apply, such as GDPR rights for EU/UK users, CCPA rights for California residents, etc. Counsel should confirm which regimes apply.]

6. Security Practices

Passwords are bcrypt-hashed (cost factor 12) before storage. We never store plaintext passwords.
YouTube OAuth tokens are AES-256-GCM encrypted at rest.
All new database tables use Row Level Security (RLS) with deny-all policies. The application accesses data via a server-side Prisma client using the service-role key (which bypasses RLS); direct browser access is blocked.
API keys are stored as Vercel encrypted environment variables and never appear in client-side code or API responses.
The admin Gmail address is stored in the AdminNotifySetting table (RLS deny-all) and never exposed in customer-facing emails.

These practices reduce but do not eliminate risk. No system is perfectly secure.

7. International Processing

VidGlade is hosted on Vercel (us-east-1 region) and Supabase (us-east-1 region). If you access the Service from outside the United States, your information may be transferred to and processed in the United States.

[OWNER REVIEW REQUIRED — confirm whether additional international transfer safeguards are needed for users in EU/UK/other jurisdictions with cross-border data transfer requirements.]

8. Changes to This Policy

We may update this Privacy Policy. Material changes will require renewed acceptance. We will not silently change material terms without notice.

9. Contact

Questions about your privacy? Contact us or email support@vidglade.com.

[OWNER REVIEW REQUIRED — confirm operating entity, address, and any privacy-law-specific contact requirements.]