Privacy policy

1. Scope

This policy covers the VideoFlow Studio website, its account system, and the command-line tool ("the CLI") that drives it. It does not cover any third-party site your own submissions point at, any third-party AI, hosting, storage, email, or payment service we rely on to operate (described only in general terms below, since the specific providers we use can change), or any other product, including any separately branded "VideoFlow" product or open-source project that is not this Service. If you reach this Service through a link on another site, that site's own policy governs your visit there, not this one.

2. What we collect

We collect the following categories of information in the ordinary course of operating the Service:

• Account information. An email address — there is no password to collect; sign-in happens by emailing a short-lived link and code to that address instead. We may also store a display name if you provide one, your selected plan, and billing status as reported to us by our payment processor.
• Project and run data. When you use the CLI or the dashboard, we create a project record identifying which coding-agent provider and model you selected, authentication tokens for that project, and timestamps for when it was created, last active, and expired.
• Submitted URLs and derived content. The web address you submit, and material an automated process gathers from the public-facing pages at that address in the course of producing a video — this may include screenshots, images, logos, page text, layout and styling information. We do not access anything behind a login wall, paywall, or other access control unless you separately and explicitly provide us the means to do so.
• Generated output. The video files, intermediate images, and structured data your session produces, stored so they can be shown back to you, edited, and downloaded.
• Usage and diagnostic data. What steps a run went through, how long each took, error messages, and aggregate counts (such as how many renders or edits an account has used in a given period), so the product can function, be debugged, and be billed accurately.
• Communications. If you contact us, we keep a record of that correspondence, including any account or technical details you choose to share with us, for as long as is reasonably necessary to address it and maintain a record of the interaction.
• Technical and log data. Standard web request information (such as IP address, browser or client identification, and timestamps) generated automatically by visiting the site or calling its programmatic interfaces, retained for security, abuse-prevention, and operational purposes.

We do not intentionally collect information from anyone we know to be under the age of 16, and the Service is not directed at children. If you believe a child has provided us information, contact us and we will take reasonable steps to remove it.

3. How we use it

We use the information above to:

• Provide, operate, and maintain the Service, including producing and storing the videos you request;
• Authenticate you, secure accounts, and enforce plan limits and fair use;
• Process payments and manage subscriptions, through a third-party payment processor;
• Send you service-related communications, such as email verification, security notices, and, where you have not opted out and it is permitted, occasional product updates;
• Diagnose problems, improve reliability, and understand how the Service is used in aggregate;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of use; and
• Comply with legal obligations and enforce our agreements.

We do not use the content of what you submit to train any general-purpose model that we control, and we do not sell personal information. Where a request is processed by a third-party AI provider as part of generating your video (see Section 5), that provider's own handling of the request is governed by their terms and policies, not this one.

4. The two ways to run it, and what that means for your data

The Service is designed around a "bring your own agent" model: the coding-agent that actually plans and builds your video runs using your own separate subscription to that agent's provider, on your own machine, driven by our command-line tool. In that mode, the content of your submission and the reasoning behind your film pass through your own agent account under your own credentials — we relay the instructions and skill library needed to do the work, and receive back the artifacts (screenshots, stills, the finished film, logs) needed to show progress and store your result, but we are not a party to, and do not control, your relationship with your agent provider.

If we offer, now or in the future, any mode in which we run infrastructure or an agent account on your behalf, the corresponding data described in this policy would, for that portion of the work, pass through infrastructure and accounts we control instead of yours, and we would process it as described elsewhere in this policy.

5. Who we share information with

We disclose information only in the following circumstances:

• Service providers. We use third-party providers for functions such as cloud file storage, database hosting, transactional email delivery, and payment processing. These providers process data on our behalf, under contractual confidentiality and security obligations, and only to the extent needed to perform their function. We do not name specific providers here because the vendors we rely on can change without changing what we promise about how your data is handled.
• AI providers. Producing a film requires sending captured content (such as page text, layout information, and screenshots) to a third-party AI model provider so it can plan, compose, and check the result. Which provider is used depends on the coding-agent you select. That provider's own terms and privacy practices apply to its processing of that request.
• Legal and safety reasons. We may disclose information if we reasonably believe it is necessary to comply with a legal obligation, protect the rights, property, or safety of ourselves, our users, or the public, investigate fraud or security issues, or enforce our Terms of use.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality arrangements.
• With your direction. Where you explicitly direct us to share something — for example, by making a link public or exporting your own content.

We do not sell personal information, and we do not share what you submit with unrelated third parties for their own marketing purposes.

6. Internal access

A limited number of people involved in operating this Service can access session, account, and run data through an internal administrative interface, gated separately from the public product, to provide support, investigate abuse, debug failures, and maintain the Service. Access is limited to what is reasonably necessary for those purposes, and we take reasonable steps to log and restrict it.

7. How long we keep information

We retain account and run data for as long as your account remains active, and for a reasonable period afterward to allow you to return to your work, resolve any outstanding billing matter, and to meet our own legal, accounting, security, and abuse-prevention obligations. Backups and logs may persist for a limited additional period after deletion from primary systems, for operational and security reasons, after which they age out in the ordinary course.

If you would like your account and associated data deleted, contact us. We will act on that request within a reasonable time, subject to any information we are required or permitted to retain by law, for dispute resolution, or to enforce our agreements. We do not currently offer instant, fully self-service account deletion; this may change.

8. Security

We use reasonable administrative, technical, and physical safeguards designed to protect the information we hold, including encrypting credentials in transit and at rest where appropriate, and limiting internal access as described above. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own account credentials confidential and for the security of the machine you run our CLI on, including any coding-agent credentials it uses.

9. Cookies and similar technology

We use a small number of strictly necessary cookies to keep you signed in to the website dashboard and, separately, to gate an internal administrative view. We do not currently use third-party advertising or cross-site tracking cookies on this Service. If that changes, we will update this section. Your browser lets you block or delete cookies; doing so may prevent parts of the Service that depend on staying signed in from working.

10. International use

The Service may be operated using infrastructure located in one or more countries other than your own. By using the Service, you understand that your information may be transferred to, stored in, and processed in a country that may have data protection laws different from those of your own jurisdiction. Where required by applicable law, we take steps intended to provide an adequate level of protection for such transfers.

11. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of the personal information we hold about you, to object to or restrict certain processing, or to withdraw consent where processing is based on it. To exercise any of these, contact us as described below. We will respond within a reasonable time and may need to verify your identity before acting on a request. We will not discriminate against you for exercising a privacy right available to you under applicable law.

You may opt out of non-essential email communications at any time using the unsubscribe mechanism included in those messages; you will still receive essential service and account-related messages, such as security notices and billing receipts.

12. Third-party links

The Service may link to third-party websites, including sites you submit for the Service to visit and comparison pages we maintain about other products. We are not responsible for the content, security, or privacy practices of any third-party site, and this policy does not apply to them.

13. Changes to this policy

We may update this policy from time to time as the Service, our providers, or applicable law change. If we make a change we consider material, we will provide reasonably prominent notice, such as a notice on this page or, where appropriate, by email, and update the date at the top. Continued use of the Service after a change becomes effective constitutes acceptance of the revised policy to the fullest extent permitted by law.

14. Contact

Questions about this policy, or a request concerning your data: reach us through videoflow.dev. Please include enough detail (such as the account email or session identifier involved) for us to locate the relevant records; we may not be able to act on a request we cannot verify.