Privacy Policy
Our four core promises
- We do not sell your footage or derived signals. Not now, not later.
- We do not use your footage to train our models or any third-party models. If that ever changes, we require explicit opt-in.
- Your footage is encrypted in transit (TLS) and at rest (AES-256 or equivalent).
- Your footage is deleted 90 days after your last access, or immediately on request.
1. What we collect
We collect only what we need to provide the Service and run the business.
Account information
- Name, email, hashed password (or OAuth identifier).
- Billing information handled by Stripe (we don't store card numbers).
- Team membership and role, if you're part of an Agency workspace.
Uploaded content
- Video and audio files you upload.
- Derived data produced from that content: transcripts, per-word prosody signals, take groupings, clip candidates, captions, and visual notes.
Usage data
- Feature usage, hours consumed, credits spent (aggregated for billing and product improvement).
- Basic device and browser info for security and troubleshooting.
- IP address for anti-fraud and geographic tax compliance.
2. How we use it
We use collected information to:
- Provide the Service — analyze your footage, produce scored transcripts, mine clip candidates, render outputs.
- Bill you and process payments (through Stripe).
- Notify you of important account and service events.
- Improve the product in aggregate (never using your individual footage to train models).
- Comply with legal obligations.
3. Your uploaded footage — special treatment
Your uploaded video and audio and the signals we derive from it are the most sensitive data you give us. They get stricter handling than any other data category:
- Not used for training. Not by us. Not shared for training by our sub-processors under our contracts. If a sub-processor's default policy differs, we opt out or route around it.
- Not sold, not licensed to advertisers, not commercially disclosed to third parties.
- Accessed only for support, security, or legal compulsion, and only with your permission for support cases.
- Deleted 90 days after your last account access, or on request within 30 days. Backups purge on a 60-day rolling cycle.
4. Sub-processors
To operate the Service we use the following sub-processors. Each processes only the data required for its function.
| Sub-processor | Purpose | Data |
|---|---|---|
| Stripe | Payment processing | Billing info; we never receive full card numbers |
| AssemblyAI | Speech-to-text with speaker labels | Audio track from uploaded footage |
| Google (Gemini API) | Visual analysis and clip-mining reasoning on flagged segments | Sampled video frames, transcript context |
| Vercel | Web hosting and CDN | Static site assets, request logs |
We keep a current sub-processor list. Material additions or changes are announced 30 days in advance.
5. Cookies and tracking
We use a small number of cookies. See our Cookies policy for the full list, what each does, and how to manage them.
6. Retention and deletion
- Uploaded footage and derived signals: 90 days after your last account access, or 30 days after an explicit deletion request. Backups purge within 60 days of primary deletion.
- Account records and billing history: retained as long as required for tax and accounting purposes (typically 7 years in the US).
- Support tickets: 2 years after resolution.
- Anonymized aggregate usage stats: retained indefinitely.
7. Security
We employ industry-standard measures to protect your data:
- TLS 1.2+ encryption for all data in transit.
- AES-256 (or equivalent) encryption for stored footage and derived data.
- Hashed password storage (bcrypt/argon2). We never store plaintext passwords.
- Least-privilege access controls for our team; no ambient production access.
- Optional two-factor authentication on your account.
- Regular security reviews and dependency patching.
No system is perfectly secure. If we ever detect a breach that affects you, we will notify you within 72 hours in accordance with applicable law.
8. Your rights (GDPR, CCPA)
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your account and associated data.
- Port your data to another service.
- Object to or restrict certain processing.
- Opt out of "sale" of personal information (we do not sell personal information under any interpretation, but you can confirm this election).
- Lodge a complaint with your local data protection authority.
You can exercise most of these rights directly from your account dashboard. For anything else, contact us.
9. Children
The Service is not directed to children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect data from children. If you believe we have, contact us immediately and we will delete it.
10. International transfers
We are based in the United States. If you are outside the US, your information will be transferred to and processed in the US or in other countries where our sub-processors operate. We rely on standard contractual clauses and other lawful transfer mechanisms as applicable.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced by email or in-app notice at least 15 days in advance.
12. Contact
Questions? Reach us at will@four28creative.com.