Privacy Policy

1. What information do we collect?

In Short: We collect the information you give us, a small amount we receive from Google if you sign in with it, and technical information collected automatically when you use the Services.

Personal information you give us

You give us personal information when you create an account, upload videos, edit clips, buy a plan or contact us. Depending on what you do, this includes:

• Account details — your email address, display name, password, profile photo if you add one, and the date and version of the terms you accepted. Your password is held by our sign-in provider, Google Firebase, which stores it in hashed form; we never see it.
• Your videos and what we make from them — the videos you upload, their transcripts (which record what people in the video say and tell speakers apart), and the clips, captions, hooks, thumbnails, edits, saved caption styles, brand templates and SEO reports made from them.
• Billing information — your plan, subscription status and the reference Stripe gives us for you. Your card details and billing address are entered on Stripe’s own checkout page and held by Stripe, not by us. Stripe’s privacy notice is at https://stripe.com/privacy.
• Messages — what you send through our contact form, bug reports and feedback (including likes and dislikes on clips), and emails you send us.

Please make sure the information you give us is accurate and tell us if it changes.

Sensitive information

We do not ask for sensitive information, such as information about health, religion, ethnic origin or sexual orientation. However, a video can contain anything, including people’s faces and voices and things they say about themselves. We process that content only to make your clips. To frame each clip, the Services detect where faces and people appear in the picture and work out who is speaking. Face and person detection and speaker detection (the open-source YuNet, NanoDet and Light-ASD models, credited on our Credits page) run on our own processing servers on Google Cloud, not at another company. Stills from your video are also sent to Google Gemini to help find where people are in the frame, as shown in the service provider table below. None of this identifies who anyone is, and we do not keep face or voice prints. Please only upload videos you are entitled to use, including where other people appear in them.

Information from third parties

If you sign in with Google, Google shares your name, email address and profile photo with us. We do not buy personal information or obtain it from other companies.

Information collected automatically

When you use the Services we automatically collect some technical information. It does not on its own tell us your name, but it can be linked to your account. It includes:

• Usage and security data — your IP address, browser and device details, when you sign in, and how many processing minutes you have used. We use this to run the Services, apply your plan limits, and limit request rates to prevent abuse.
• Error data — when something goes wrong we record the error, the page or feature involved, your browser details, and your account ID and email address so we can find and fix the problem. A bug report you send also includes the page you were on and your screen size.
• Basic usage records — we keep basic records of how our service is used (for example, that an account was created or a video upload started or failed), linked only to an internal account number, to understand and fix problems. These records don’t use cookies, aren’t shared with third parties, are deleted after 90 days, and are included if you ask for a copy of your data.
• Analytics data, only with your consent — pages viewed, clicks and a masked recording of your session, collected through PostHog and Sentry session replay. See section 5 and our Cookie Policy.

We do not collect your precise location and do not use GPS. Your IP address can indicate roughly where you are, and that is the only location information we have.

2. How do we process your information?

In Short: We use your information to provide, operate and secure the Services, take payment, communicate with you and comply with the law. We use it for other purposes only with your consent.

We process your personal information to:

• Create and manage your account, including signing you in, verifying your email address and resetting your password.
• Provide the Services you ask for — receiving and storing your videos, transcribing and analysing them, making, storing and delivering your clips, and running the editing tools.
• Take payment and manage your plan, including your monthly minutes, renewals, upgrades, downgrades and refunds.
• Email you about your account and the Services, such as verification and password reset emails, notices that your clips are ready or that a project waiting for your review is about to close, and notices about changes to our terms or policies. Now and then one of our team may also write to you personally — for example to ask how you are finding the Services or to offer help if something seems to have gone wrong. These messages are about your own account and use of the Services, not marketing: we do not send marketing emails, newsletters or promotional offers. If you would rather not receive the personal messages, reply and tell us and we will stop.
• Answer your questions and support you, including replying to messages and bug reports.
• Receive your feedback, such as likes and dislikes on clips, and use it to improve the Services.
• Protect the Services — preventing fraud and abuse, limiting request rates, monitoring errors and enforcing our terms.
• Understand how the Services are used, through analytics, but only if you have agreed to it.
• Protect someone’s vital interests, for example where a person’s safety is at risk.
• Comply with the law, such as keeping tax and payment records and responding to lawful requests.

3. What legal bases do we rely on to process your personal information?

In Short: We process personal information only when the law gives us a valid reason: to perform our contract with you, for our legitimate interests, with your consent, to comply with the law, or to protect someone's vital interests.

If you are in the UK or the EU

The UK GDPR and the EU GDPR require us to explain the legal bases we rely on. They are:

• Performance of a contract — to provide the Services you have signed up for, take payment and send you service messages, and to take steps you ask for before entering a contract.
• Legitimate interests (Article 6(1)(f) of the UK GDPR and the EU GDPR) — to keep the Services secure and working, prevent fraud and abuse (including rate limiting and checking where requests come from), monitor and fix errors, answer your messages, occasionally contact you personally to ask for feedback or offer help, improve the product from feedback, and enforce our terms, where those interests are not outweighed by your rights and interests.
• Consent — for analytics and session replay. You can withdraw consent at any time from ‘Cookie preferences’ in the site footer. Withdrawing does not affect processing that happened before.
• Legal obligation — to keep financial records, respond to lawful requests from courts and authorities, and establish or defend legal claims.
• Vital interests — in the rare case where processing is needed to protect someone’s life or safety.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The AI in the Services makes editing suggestions about your videos; you decide what to keep and publish.

If you are in Canada

We process your personal information with your express consent or, where appropriate, your implied consent — for example, implied by your choice to upload a video for processing. You can withdraw consent at any time by contacting us. In limited cases permitted by Canadian law, such as investigating fraud or complying with a court order, we may process information without consent.

4. When and with whom do we share your personal information?

In Short: We share personal information with the named service providers that help us run the Services, and otherwise only where the law requires it or the business changes hands.

We use the service providers below. They process personal information on our behalf to run the Services, under contracts that limit what they may do with it.

• Provider

  Vercel

  What it does and what it receives

  Hosts the website and app. Receives every request, including your IP address and browser details.

  Where

  Not fixed by us

• Provider

  Google Firebase Authentication

  What it does and what it receives

  Sign-up, sign-in, email verification, password reset. Receives your email, password (Firebase stores it hashed; we never see it), display name, and — if you use Google sign-in — your Google name, email and photo.

  Where

  Google infrastructure

• Provider

  MongoDB (our database)

  What it does and what it receives

  Stores your account, projects, clip settings, transcripts, reports, messages you send us, and error records.

  Where

  Our database provider

• Provider

  Cloudflare R2

  What it does and what it receives

  Stores your uploaded source videos, caption files and images.

  Where

  Cloudflare

• Provider

  Cloudflare Stream

  What it does and what it receives

  Stores, encodes and plays the clips we make. Your IP address reaches Cloudflare when you watch a clip.

  Where

  Cloudflare

• Provider

  Google Cloud (Cloud Run, Cloud Tasks)

  What it does and what it receives

  Runs our video processing: reads your source video and transcript to cut, reframe and caption clips.

  Where

  London (europe-west2)

• Provider

  AssemblyAI

  What it does and what it receives

  Transcribes the audio of your videos, including telling speakers apart.

  Where

  United States

• Provider

  Google Gemini API

  What it does and what it receives

  AI analysis of your video, stills from it and its transcript, to choose clips, frame them and write hooks and captions.

  Where

  Google infrastructure (may be outside the UK)

• Provider

  OpenAI

  What it does and what it receives

  Writes SEO reports from your clip titles, topic and chosen platforms, if you use that feature.

  Where

  United States

• Provider

  Stripe

  What it does and what it receives

  Payments and subscriptions. Receives your email and payment details (on Stripe's own checkout pages — they never pass through us).

  Where

  Stripe

• Provider

  Resend

  What it does and what it receives

  Sends our emails: verification, password reset, clip-ready notices, replies to messages you send us. Receives your email address and the email content.

  Where

  Resend

• Provider

  Upstash

  What it does and what it receives

  Rate limiting to stop abuse. Receives your IP address or internal account ID as a short-lived counter.

  Where

  Upstash

• Provider

  Sentry

  What it does and what it receives

  Error monitoring. Receives technical details when something breaks (page, browser, error trace). Session replay — a masked recording of the page — only runs if you accept analytics.

  Where

  Sentry

• Provider

  PostHog

  What it does and what it receives

  Product analytics and session recording, only if you accept analytics. Not linked to your name or email.

  Where

  EU

Some pages also load images, video or map data from content delivery services run by Cloudflare and GitHub. These see your IP address and browser details, but nothing about your account.

We may also share personal information:

• Business transfers — in connection with a merger, sale, financing or restructuring of all or part of our business, or negotiations for one. This notice would continue to apply to your information.
• Legal requirements — where the law requires it, or where it is needed to protect our rights, our users or other people’s safety.

We do not sell personal information and we do not share it with anyone for advertising.

5. Do we use cookies and other tracking technologies?

In Short: We use a sign-in cookie and browser storage to make the Services work and remember your settings. Analytics runs only if you accept it, and we use no advertising cookies.

We use a cookie to keep you signed in and browser storage to remember your settings, such as editor layout and saved styles. Analytics tools — PostHog and Sentry session replay — are not loaded at all until you press ‘Accept’ on our cookie banner, and you can change your choice at any time from ‘Cookie preferences’ in the site footer. We do not allow advertising cookies, tracking pixels or third-party advertising on the Services.

Every cookie and storage item our own site sets is listed in our Cookie Policy, along with what Stripe, Google and Cloudflare may set on their own domains.

6. Do we offer artificial intelligence-based products?

In Short: Yes. Our AI features are provided through AssemblyAI, Google and OpenAI, which receive the material each feature needs.

The Services use artificial intelligence and machine learning (our ‘AI features’) to transcribe speech, analyse video and images, choose and frame clips, and write hooks, captions, titles, descriptions and hashtags.

Who provides them

We provide the AI features through these AI service providers:

• AssemblyAI — transcribes the audio of your videos and tells speakers apart.
• Google (Gemini) — analyses your video, still frames from it and its transcript to choose and frame clips and to write hooks and captions.
• OpenAI — writes SEO reports from your clip titles, topic and chosen platforms, if you use that feature.

The material a feature needs — your video, stills from it, its transcript and your instructions — is sent to the relevant provider, and the result is returned to us. You must not use the AI features in a way that breaks the usage rules of these providers.

How we handle your data

We do not train our own AI models on your videos. The providers process the material under their terms for business customers, and they keep it according to their own retention terms (see section 8). AI output can be wrong, so please review clips and text before you publish them.

7. Is your information transferred internationally?

In Short: Some of our providers process information outside the UK, and we rely on recognised legal safeguards when they do.

We are based in the United Kingdom. Our video processing runs in London, but several providers listed in section 4 process information in other countries — in particular AssemblyAI and OpenAI in the United States, PostHog in the European Union, and Google and others on infrastructure around the world. Those countries may not have data protection laws as strong as those where you live.

Where personal information leaves the UK, the European Economic Area or Switzerland, we rely on an adequacy decision or on safeguards in our providers’ data processing terms, such as the UK International Data Transfer Addendum or the European Commission’s standard contractual clauses. You can ask us for details of these safeguards.

8. How long do we keep your information?

In Short: We keep your information while your account is open and for as long as the law requires, and we delete or anonymise it after that.

We keep personal information only for as long as we need it for the purposes in this notice, unless the law requires us to keep it longer (for example for tax and accounting). In particular:

• Your account, videos, clips and projects are kept until you delete the project or your account. They do not expire while your account is open. One exception: if you choose to review clips before they are cut, a project left waiting for your review for 7 days is closed and no clips are made from it. We email you about a day before. The project and its video stay in your account until you delete them.
• Error records are deleted automatically after 30 days.
• Basic usage records are deleted automatically after 90 days.
• Rate-limit counters expire within minutes to hours.
• Analytics data is kept by PostHog and Sentry under their retention settings.
• Copies held by AI providers — AssemblyAI, Google and OpenAI keep the material we send them according to their own retention terms. We do not currently ask them to delete it when you delete a project or your account.

When you delete your account, we delete most of your information within about 24 hours, anonymise some records, and keep a few, as described in section 16. If deleted information remains for a time in a provider’s backups, it is kept out of use until those backups expire.

9. How do we keep your information safe?

In Short: We protect your information with technical and organisational measures, but no system is completely secure.

We use measures designed to protect the personal information we process, including encryption of data in transit, restricted access to production systems, and a log of every time our staff open a customer’s account. More detail is on our Security page.

No method of sending or storing information over the internet is completely secure, so we cannot guarantee that unauthorised people will never gain access to it. You use the Services at your own risk and should use them only in a secure environment. If a breach affects you, we will tell you and the regulator where the law requires.

10. Do we collect information from minors?

In Short: We do not knowingly collect information from, or market to, anyone under 18.

The Services are only for people aged 18 or over, and we do not knowingly collect personal information from, or market to, anyone under 18. If we learn that we hold information about someone under 18, we will close the account and delete it. If you think a child has given us information, please email support@globalvextraai.com.

11. What are your privacy rights?

In Short: Depending on where you live, you can ask to access, correct, delete or move your information, object to or restrict how we use it, and withdraw consent.

In the UK, the EEA, Switzerland, Canada and some other places, you have rights over your personal information. Subject to the law, you can ask us to:

• give you access to, and a copy of, your personal information;
• correct information that is wrong or incomplete;
• delete your information;
• restrict how we use it, or object to our using it;
• give you your information in a portable format; and
• not make decisions about you based solely on automated processing (we do not make any such decisions).

To make a request, email support@globalvextraai.com from your account’s email address or use our contact form. We may need to confirm your identity first. We will respond within one month, as the law requires. There is no self-service data export in the app yet, so we prepare copies on request.

If you believe we are processing your information unlawfully, you can complain to the UK Information Commissioner’s Office at ico.org.uk, to the data protection authority in your EEA country, or, in Switzerland, to the Federal Data Protection and Information Commissioner. We would appreciate the chance to resolve it with you first.

Withdrawing your consent: Where we rely on your consent, which in our case means analytics, you can withdraw it at any time from ‘Cookie preferences’ in the site footer, or by contacting us. This does not affect the lawfulness of processing before you withdrew, or processing we carry out on other legal bases.

Account information

You can review and change your display name and profile photo, and delete your account, in your account settings. For anything else, contact us. Section 16 explains what happens when an account is deleted.

Cookies and similar technologies: Most browsers accept cookies by default, but you can set yours to remove or reject them. If you block our sign-in cookie you will not be able to sign in. See our Cookie Policy.

If you have any questions about your privacy rights, email us at support@globalvextraai.com.

12. Controls for Do-Not-Track features

In Short: We do not respond to Do-Not-Track signals, but analytics only runs with your consent and we use no advertising trackers.

Many browsers can send a ‘Do Not Track’ (DNT) signal to say that you do not want your browsing tracked. There is no agreed standard for how websites should respond to it, so we do not respond to DNT signals. In practice this makes little difference here: analytics is not loaded unless you accept it on our cookie banner, and we do not use advertising or cross-site trackers. If a standard is adopted that we must follow, we will update this notice.

13. Do United States residents have specific privacy rights?

In Short: If you live in certain US states, you may have rights to know about, access, correct and delete your personal information. We do not sell or share personal information.

Residents of several US states — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — have specific rights under their state privacy laws.

Categories of personal information we collect

Over the last 12 months, we have collected personal information in the categories marked ‘Yes’ below. Section 1 gives the full detail.

• Category

  Identifiers

  Examples

  Name, email address, account ID, IP address

  Collected

  Yes

• Category

  Customer records

  Examples

  Name, email, billing details held by Stripe

  Collected

  Yes

• Category

  Protected characteristics

  Examples

  Age, gender, race and similar

  Collected

  No

• Category

  Commercial information

  Examples

  Plan, subscription and payment history

  Collected

  Yes

• Category

  Biometric information

  Examples

  Face or voice prints used to identify someone

  Collected

  No

• Category

  Internet activity

  Examples

  How you use the app; analytics only with consent

  Collected

  Yes

• Category

  Geolocation

  Examples

  Only the rough area an IP address points to — no GPS

  Collected

  Approximate only

• Category

  Audio, video and images

  Examples

  The videos you upload and the clips made from them

  Collected

  Yes

• Category

  Professional or education information

  Examples

  Job, employer, education

  Collected

  No

• Category

  Inferences / profiling

  Examples

  Profiles of your preferences or characteristics

  Collected

  No

• Category

  Sensitive personal information

  Examples

  Collected deliberately

  Collected

  No

We collect this information from you, from your use of the Services, and from Google if you sign in with Google. We use it for the purposes in section 2 and keep it while you have an account, subject to the exceptions in section 8.

Will your information be shared?

We disclose personal information to the service providers in section 4, under written contracts, for business purposes only. In the past 12 months we have disclosed identifiers, customer records, commercial information, internet activity information, approximate location (from IP addresses), and audio and video to those providers for that purpose.

We have not sold or ‘shared’ personal information (as those terms are defined in US state privacy laws, including for targeted advertising) in the past 12 months, and we do not use it for profiling that has legal or similarly significant effects.

Your rights

Depending on your state, and subject to exceptions in the law, you may have the right to:

• know whether we process your personal information;
• access it and receive a copy in a portable format;
• correct inaccuracies in it;
• ask us to delete it;
• be told which kinds of recipients, or which named recipients, we have disclosed it to;
• opt out of its sale, its use for targeted advertising and profiling (we do none of these);
• limit the use of sensitive personal information (we do not collect it deliberately); and
• not be treated differently for using any of these rights.

How to exercise your rights

Email support@globalvextraai.com, use our contact form, or write to us at the address in section 15.

Request verification. We verify a request by matching it against the information in your account, and may ask for more information if we cannot. We use what you provide only to verify the request.

Authorised agents. You can ask an authorised agent to make a request for you. We will ask for your signed permission and may need to verify your identity directly, and we may decline a request from an agent who cannot show they are authorised.

Appeals. If we decline your request, you can appeal by emailing support@globalvextraai.com. We will tell you in writing what we have decided and why. If we turn down your appeal, you may take the matter to the attorney general of your state.

California ‘Shine the Light’ law. We do not disclose personal information to third parties for their own direct marketing purposes.

14. Do we make updates to this notice?

In Short: Yes. We update this notice when what we do changes, or when the law requires.

We may update this notice from time to time. The date at the top shows when it was last changed. If we make a material change, we will tell you by email or by a notice in the app before it takes effect. Please check this page from time to time.

15. How can you contact us about this notice?

In Short: Email us, use our contact form, or write to us.

To ask about anything in this notice, email us at support@globalvextraai.com, use our contact form, or write to us at:

Global Vextra AI Ltd
Company number SC889787
5 South Charlotte Street
Edinburgh
EH2 4AN
Scotland, United Kingdom
support@globalvextraai.com

16. How can you review, update, or delete the data we collect from you?

In Short: You can review, change and delete some information yourself, and ask us for the rest.

You can change your display name and profile photo, and delete your account, in your account settings. To ask for a copy of your information, a correction, or anything else, email support@globalvextraai.com.

What happens when you delete your account

You are signed out and locked out straight away, and any subscription is cancelled. Within about 24 hours we then permanently delete:

• your projects, source videos, clips, transcripts and caption files;
• your uploaded files and profile photo;
• your SEO reports and messages sent through our contact form;
• your Firebase sign-in identity and your Stripe customer record; and
• your account record itself.

Some records are anonymised rather than deleted, so they can no longer be linked to you: bug reports and feedback, likes and dislikes on clips, error records, basic usage records, and our record of minutes used. We keep these to improve the product and keep accurate usage records.

Some records are kept as they are. Our internal audit log of actions staff took on accounts, which includes the account’s email address at the time, is kept for security and accountability. Stripe keeps payment records that it is legally required to keep. Copies held by AI providers are described in section 8.