Privacy Policy — Vidpitch

1. Introduction

Vidpitch("we", "us", "our") operates vidpitch.com. This Privacy Policy explains how we collect, use, and share information about you when you use our service.

2. Data We Collect

We collect the following categories of data:

Account data — your email address and (optionally) display name, collected when you sign up.
Campaign content — webcam video recordings and CSV files you upload to create campaigns.
Usage data — the number of videos generated, campaign names, and job status, used to enforce your plan quota and display your dashboard.
Billing data — payment is processed by Stripe. We store your Stripe customer ID and subscription status but never your raw card details.
Log data — server logs including IP addresses, browser type, and request timestamps, retained for security and debugging purposes.

3. How We Use Your Data

We use the data we collect to:

Provide and operate the Vidpitch service.
Process your campaigns and deliver personalised video output.
Send transactional emails (campaign completion notifications, email confirmation, password reset).
Enforce free-tier limits and paid subscription quotas.
Detect abuse, secure the service, and comply with legal obligations.

4. Sub-processors

We share data with the following third-party sub-processors to provide the service:

Supabase — authentication and database (PostgreSQL). Your account and campaign data is stored in a Supabase-hosted Postgres instance.
Cloudflare R2 — object storage. Your uploaded webcam clips and generated MP4 videos are stored in Cloudflare R2.
Stripe — payment processing. Stripe stores your payment method and manages your subscription.
Resend — transactional email delivery. Your email address is passed to Resend to send campaign completion and account emails.
Vercel — application hosting and edge network. Request data (including IP) passes through Vercel infrastructure.

5. Data Retention

We retain your account data for as long as your account is active. Campaign content (videos and CSV files in R2) is retained until you delete the campaign or your account. Log data is retained for up to 90 days. Stripe retains billing records in accordance with its own retention policy.

6. Your Rights (GDPR and Similar Laws)

If you are located in the European Economic Area or another jurisdiction with comparable data protection laws, you have the following rights regarding your personal data:

Right to access — you may request a copy of the personal data we hold about you.
Right to erasure (right to be forgotten) — you can delete your account at any time from the Account Settings page. Deleting your account removes your profile, campaigns, and all associated R2 objects from our systems.
Right to data portability — to request an export of your personal data, email us at support@vidpitch.com with the subject line "Data export request". We will respond within 30 days.
Right to rectification — if any data we hold about you is inaccurate, contact us and we will correct it.
Right to object / restrict processing — you may object to or request restriction of processing of your personal data by contacting us.

To exercise any of the above rights (other than account deletion, which you can action yourself in-app), please contact us at support@vidpitch.com.

7. Cookies

We use only strictly necessary cookies: a session cookie managed by Supabase Auth to keep you logged in. We do not use tracking or advertising cookies.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, by email.

9. Contact

If you have questions about this Privacy Policy or your personal data, please contact us at support@vidpitch.com.