Privacy policy

1. What we collect

• Account: your email address, name and a secure hash of your password (never the password itself).
• Sign-in and security: Google or Discord account ID if you sign in with them, two-factor secrets (encrypted), sessions and a sign-in log with IP address and browser.
• Activity in the app: pages you open and actions you take, with time, device type and approximate city, kept 30 days, for support and improving the product. Never what you type.
• Payments: payments go through Whop; we never see your full card details. We receive your Whop ID, plan, payments, refunds and disputes, and for receipts the name, email, billing country/address and amounts (including tax) Whop reports.
• What you make: topics, settings, scripts, uploads, personas, ebooks, websites, finished videos, captions and your credit history.
• Faces and voices: photos you upload of yourself (with your consent, metadata removed) and voice recordings you provide to create a voice, used only to make your content.
• Support chats and messages you send us.
• How you found us: when you visit and when you sign up, the kind of link, ad, campaign or site that brought you (for example X, Google search or a campaign’s name). Never the page you came from or anything else about your browsing.

We don’t use advertising cookies or tracking pixels, and we don’t buy data about you. Our cookie policy covers cookies and browser storage in more detail.

2. How we use it

• To make your content: research, writing, narration, pictures, video and editing.
• To run your account, keep it secure and stop fraud and abuse.
• For payments: adding credits, handling refunds and disputes, keeping receipts and issuing the electronic receipts Bulgarian law requires.
• To email you receipts, links and important notices, and to answer support requests.
• To see which of our posts, links and ads bring people to Vidform.
• To meet legal duties such as tax and accounting records.

We don’t sell your personal data or use it for advertising.

3. Legal bases (EU/EEA/UK)

• Contract: to provide your account, make your content and handle payments.
• Legitimate interests: security, preventing fraud and abuse, defending payment disputes, fixing and improving the service, and seeing which of our marketing works.
• Legal obligation: payment, tax and fiscal records.
• Consent: for example uploading your own face, or showing your work in public examples. You can withdraw consent at any time.

4. Who we share it with

We use trusted service providers to run Vidform (hosting, payment processing, AI generation, email, and an electronic receipt service that reports our sales to the Bulgarian National Revenue Agency as the law requires). They process data only on our instructions. We may also share data when the law requires it, to protect people’s rights and safety, or in a merger or sale of the business, in which case we’ll tell you first.

5. Your persona website visitors

If you publish a persona website and collect sign-ups, you decide how those contacts are used and are responsible for them; we store them for you and give every sign-up a way to unsubscribe.

6. International transfers

Some providers process data outside your country, including in the United States. Where required we rely on safeguards such as the European Commission’s standard contractual clauses.

7. How long we keep it

• Account, content and personas: while your account is open, deleted within 30 days of closing it.
• Receipts, payment and fiscal records: as long as tax law requires, up to 10 years.
• Sessions: up to 30 days. Sign-in log: 12 months. In-app activity log: 30 days, except for paying customers: the records of their purchases, terms acceptance, sign-ins (IP address and device), credits used and content made or downloaded are kept for 18 months after each payment, to handle payment disputes and chargebacks.
• Working files are removed after a video is finished, except what’s needed to edit it. Finished video files are deleted 14 days after the video is made to save space, so download each video within 14 days.

8. Security

Passwords are stored as argon2id hashes, two-factor secrets are encrypted, one-time links are hashed, and sign-in cookies are HTTPS-only and unreadable by page scripts. If a breach affects your data we’ll tell you and the authorities as the law requires.

9. Your rights

You can ask for a copy of your data, correction, deletion, restriction or objection, data portability, or to withdraw consent. Email support@vidform.ai and we’ll reply within 30 days. You can also complain to your data protection authority (in Bulgaria: the Commission for Personal Data Protection, cpdp.bg).

10. Children

Vidform isn’t for anyone under 18 and we don’t knowingly collect their data.

11. Changes

When our practices change we update this policy and its date, and tell you before significant changes take effect.