Privacy Policy

Last updated: July 13, 2026

Draft for counsel review. Items marked [LIKE THIS] are placeholders that must be completed or confirmed by an attorney before this document is final.

1. Overview

This Privacy Policy explains what personal information [COMPANY LEGAL NAME] ("VideoPronto," "we," "us") collects when you use videopronto.com and the VideoPronto service, how we use and share it, and the choices you have. If you create an AI avatar double, the collection and use of your face photos and voice recordings is additionally governed by our Biometric Data Consent Policy, which controls if the two documents conflict on that topic.

2. Information we collect

2.1 Information you give us

Account data: name, email address, password (stored hashed), and language preference (English or Spanish).
Billing data: processed by our payment processor; we store your purchase history and credit balance but never your full card number.
Content you upload: prompts, brand kits (URLs, colors, offers), product photos, and — if you create an avatar double — face photos and voice recordings (see the Biometric Data Consent Policy).
Research queries: competitor names, ad-library URLs, and related inputs you submit to the research feature.
Communications: messages you send to support.

2.2 Information collected automatically

First-party analytics: we record product events (for example: page views, sign-ups, videos created, renders completed, credits purchased, research runs) together with the page URL, referrer, UTM campaign parameters, and a hashed session identifier. These records are stored in our own database, not sold, and used to understand and improve the product.
Google Analytics 4: when enabled in production, we use GA4 with IP anonymization to measure site traffic. GA4 sets cookies; see Section 6.
Log data: IP address, browser type, device information, and timestamps, kept in server logs for security and debugging.

3. How we use information

To provide the Service: generating your videos, building your avatar double, running research, managing credits and billing.
To operate, secure, and improve the Service, including debugging, fraud prevention, and abuse detection.
To communicate with you about your account, renders, purchases, and material changes to our terms or policies.
To send product news or marketing only where permitted — you can opt out at any time.
To comply with law and enforce our Terms of Service.

We do not use your uploaded photos, voice recordings, or generated videos to train our own or third parties' AI models, and our contracts with processing providers restrict them from doing so except as needed to provide their service to us.

4. Service providers and subprocessors

VideoPronto is built on specialized providers that process data on our behalf. Depending on the features you use, your data may be processed by:

kie.ai — video generation gateway (receives prompts, scene plans, and reference images to render video).
Google (Gemini) — vision analysis of advertising creative for the research feature; Google Analytics 4 for site analytics when enabled.
Anthropic (Claude) — script writing, planning, and research report generation (receives prompts and research context).
Apify — public ad-library scraping for competitor research (receives your research queries, not your personal content).
ElevenLabs — voice cloning and text-to-speech (receives voice recordings if you create an avatar double; see the Biometric Data Consent Policy).
Payment processor — [STRIPE / PROCESSOR NAME] for purchases.
Hosting and infrastructure — [HOSTING PROVIDER(S)] for compute, storage, and content delivery.

Each provider receives only what its function requires, under agreements limiting use to providing the service. We will update this list as providers change; material changes to how biometric data is processed require your renewed consent as described in the Biometric Data Consent Policy.

5. When we share information

We share personal information only:

With the service providers listed above, as processors;
To comply with law, legal process, or enforceable governmental requests;
To protect the rights, safety, or property of VideoPronto, our users, or the public;
In a merger, acquisition, or asset sale — in which case this policy continues to apply to your data and we will notify you of any successor;
With your direction or consent.

We do not sell personal information, and we do not sell or share biometric data — ever.

6. Cookies and similar technologies

Essential cookies: session and CSRF cookies required for login and security. These cannot be disabled.
Analytics cookies: set by Google Analytics 4 only when GA4 is enabled in production. You can block these with browser settings or opt-out tools without affecting the Service.
First-party analytics uses a hashed session identifier rather than a tracking cookie of its own.

7. Data retention

Account data: kept while your account is active; deleted or anonymized within 30 days of account deletion, except records we must keep for tax, accounting, or legal purposes.
Generated videos and uploads: kept until you delete them or your account.
Face photos and voice recordings: retained and deleted per the Biometric Data Consent Policy — deleted within 30 days of you deleting the avatar or your account, including provider-side voice clones.
Analytics events: retained up to 24 months, then deleted or aggregated.
Server logs: retained up to 90 days.

8. Your rights

Depending on where you live (including under the California Consumer Privacy Act and similar state laws), you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. You can exercise most of these directly in the app (download or delete your content, delete your avatar, delete your account) or by emailing [email protected]. We will respond within the time required by applicable law, verify your identity before acting, and never discriminate against you for exercising your rights.

9. Security

We use industry-standard safeguards: encryption in transit (TLS), hashed passwords, access controls limiting staff access to production data, and encrypted storage for sensitive content. No system is perfectly secure; if a breach affects your personal information we will notify you as required by law.

10. International transfers

We are based in the United States and our providers may process data in the U.S. and other countries. Where required, we rely on appropriate safeguards for cross-border transfers. [COUNSEL: confirm transfer mechanism if EU/UK users are in scope.]

11. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We will post updates here and revise the "Last updated" date. For material changes we will notify you by email or in-app notice before they take effect.

13. Contact

[email protected] · [COMPANY LEGAL NAME], [REGISTERED ADDRESS].