Privacy Policy

1. Controller

Controller within the meaning of the GDPR: [FULL NAME / COMPANY], [ADDRESS], email: [CONTACT EMAIL] (“we”, “us”). This policy explains what personal data we process when you use txtovid.com, for which purposes, and which rights you have.

2. Data we process

Account data: name, email address, password hash (or Google account link), username, avatar, bio.
Content data: your prompts, generated videos, comments, likes, follows, reports.
Payment data: transaction amounts, VAT country, invoice data — card details are processed exclusively by Stripe and never touch our servers.
Usage data (with your consent): video impressions, watch time, completions, skips, searches and similar interaction events, linked to your account or an anonymous ID.
Technical data: IP address (transient, for security/rate limiting), browser and device information in server logs.

3. Purposes and legal bases (Art. 6 GDPR)

Providing the service, account management, video generation and storage — Art. 6(1)(b) (contract).
Payments, invoicing, VAT compliance (One-Stop-Shop) — Art. 6(1)(b) and (c) (legal obligations).
Transactional emails (verification, password reset, video-ready, billing alerts) — Art. 6(1)(b).
Personalized feed and analytics events — Art. 6(1)(a) (consent via cookie banner, revocable anytime).
Security, abuse prevention, rate limiting, content moderation — Art. 6(1)(f) (legitimate interest).
Marketing emails — only with opt-in, Art. 6(1)(a).

4. Processors and recipients

We use the following processors under Art. 28 GDPR data processing agreements:

Alibaba Cloud (Model Studio, Singapore) — video generation from your prompts. Prompts are transferred to Alibaba Cloud for processing; transfer to third countries is safeguarded by EU Standard Contractual Clauses.
Stripe Payments Europe Ltd. — payment processing, tax calculation, invoicing.
Cloudflare Inc. — video storage (R2) and content delivery.
Vercel Inc. — application hosting.
Resend (Plus Five Five Inc.) — transactional email delivery.
Google Ireland Ltd. — optional Google login (OAuth).

5. Storage periods

Account data: until account deletion (30-day grace period after deletion request, then permanent removal).
Videos and prompts: until you delete them or your account.
Payment and invoice records: 7–10 years (statutory retention obligations).
Raw analytics events: maximum 90 days, then aggregated or deleted.
Server logs: up to 14 days.

6. Cookies and consent

We use strictly necessary cookies for login sessions and security. Analytics/personalization tracking runs only after you accept it in the cookie banner; your choice is stored locally and can be changed anytime via “Cookie settings” in the footer. Declining never blocks core functionality.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), plus the right to withdraw consent at any time with future effect. You can delete your account in Settings → Account. To exercise any right, contact [CONTACT EMAIL]. You also have the right to lodge a complaint with a supervisory authority — in Austria the Datenschutzbehörde (dsb.gv.at), or the authority of your habitual residence.

8. Public content

Videos you actively publish to the community feed are visible worldwide together with your username and prompt. You can unpublish them anytime; copies shared by third parties outside txtovid are beyond our control.

9. Changes

We update this policy when the service or the legal situation changes. The current version is always available at txtovid.com/legal/privacy. Last updated: [DATE].