Privacy Policy

1. Who is responsible for your data

The data controller is Alessio Battagliero, Via Orti 12, Milano (VAT IT02771920069). For anything in this notice, including to exercise the rights in section 9, write to [email protected].

This notice explains what personal data GPT-Video collects, why, on what legal basis, how long we keep it and who else touches it.

2. What we collect

What you give us. Your email address, the password you choose (stored only as a cryptographic hash — we cannot read it) or the identifier of the sign-in provider you use instead, and anything you write to us for support.

What you upload and make. The videos and audio you bring in, the transcripts and clips derived from them, the projects you build, and the instructions you type to the editing assistant.

Payment data. Your subscription status, plan and invoices. Card numbers are handled entirely by our payment provider and never reach our systems.

Technical data. Your IP address and request metadata reach our servers as part of any web request and appear in short-lived operational logs. We record aggregate counters — how many requests, how fast, how many failed — which are not tied to an individual.

How we count pages. The public site's visit counter records only the day, the page path and the referring site. It does not record an identifier, a country or an advertising parameter, and it cannot be traced back to a person.

3. Cookies

We use as few as possible, and we do not run advertising or analytics trackers.

• Session cookie. Set when you sign in, so the app knows it is you. Strictly necessary. It lasts thirty days of inactivity and slides forward each time you use the app.
• Sign-in state cookie. Set for ten minutes while you are being sent to Google and back, to protect that exchange. Strictly necessary.
• Referral cookie. If you arrive through a partner's link, a cookie records which partner, for sixty days, so their commission can be attributed. This one is not strictly necessary: it is set only when you follow a partner link, and you can remove it in your browser at any time without affecting the service.

4. Why we use it, and on what basis

• To provide the service — your account, your projects, the editing itself, and support. Legal basis: performance of the contract with you.
• To take payment and keep accounts — subscriptions, invoices and tax records. Legal basis: performance of the contract, and our legal obligations.
• To keep the service working and safe — logs, error and performance counters, abuse and fraud prevention, capacity planning. Legal basis: our legitimate interest in a service that runs and is not abused.
• To send you service email — verification, password resets, notices about your plan or a change to these documents. Legal basis: performance of the contract.
• To send you product email you asked for — onboarding tips and product news. Legal basis: your consent, withdrawable at any time from the link in every such message.
• To attribute partner referrals — where you arrived through a partner link. Legal basis: our legitimate interest in running a partner programme, and the contract with the partner.

5. How long we keep it

• Source uploads: deleted seven days after they are processed.
• Derived material — transcripts, clips, exports: deleted fourteen days after it is produced, unless you delete it sooner.
• Your account and projects: for as long as the account exists. When you close it we delete your material and your account data, keeping only what we are legally required to keep.
• Invoices and tax records: for the period Italian tax law requires, currently ten years.
• Sign-in sessions: thirty days of inactivity, then removed.
• Operational and performance counters: up to one hundred and eighty days, in aggregate form.

6. Who else handles it

We use a small number of providers to run the service. Each acts on our instructions under a data processing agreement, and each sees only what it needs.

The last one is used only if you connect an AI assistant with one click, and only receives your user id and your email address so it can tell the assistant which account approved the connection; it never sees your videos, your clips or your payment data. An assistant connected with an API key instead does not involve it at all.

The three before it are used only when the UGC room is switched on, and only for the projects you make in it. What reaches them is what that room needs to generate the video: the product photos, the photos and voice samples of a character, and the prompts written from your brief. They do not see your account, your other projects or your payment data.

We also disclose data where the law requires it, to respond to a lawful request from an authority, or to establish or defend a legal claim. We do not sell your data and we do not share it for anyone else's advertising.

7. When you connect an AI assistant

If you let an AI assistant use GPT-Video on your behalf, data moves in a direction this notice would otherwise not describe, so here it is plainly.

What reaches the assistant. Only what it asks for and what an answer needs: the titles and status of your projects, the clips found in them with their scores and short transcript excerpts, the progress of a job, and a temporary link to download a finished export. Your password, your payment details and your other account data are never sent, and we never send the contents of the assistant's own conversations back to ourselves — we do not log them, not even for diagnostics.

Who receives it. The company operating the assistant you chose, which is an independent controller of what it receives and handles it under its own privacy notice, not ours. We are not able to delete data from their side; the assistant's own settings are where you do that.

Why we may do it. Because you asked us to: connecting an assistant is your instruction, and the transfer is necessary to perform the contract you have with us. You can end it at any moment from the Connections page, which revokes the credential — anything using it stops working on its next call. Revoking does not undo what has already been sent.

Download links. A link to an exported file is signed, points at one file only and expires within minutes. We do that because an assistant needs to fetch the file without holding your session, and a link that never expired would be a credential anyone could pass on.

8. Transfers outside the European Economic Area

Some of the providers above process data in the United States, and one in Singapore. Those transfers are made under the European Commission's Standard Contractual Clauses, and where the provider is certified, under the EU–US Data Privacy Framework. You can ask us for details of the safeguards for a specific provider at [email protected].

9. Your rights

Under the GDPR you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent you may withdraw it at any time, which does not affect what we did before you withdrew it.

Write to [email protected] and we will answer within one month.

If you think we have handled your data badly you may complain to your national supervisory authority. In Italy that is the Garante per la protezione dei dati personali. You may also complain to the authority of the country where you live or work.

10. Security

Passwords are stored only as salted hashes and are never readable, by us or by anyone who obtained a copy of the database. Traffic is encrypted in transit. Access to production systems is limited to the people who operate them. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data and is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.

11. Children

GPT-Video is not for people under 18 and we do not knowingly collect their data. If you believe a minor has an account, write to [email protected] and we will remove it.

12. Changes to this notice

We may update this notice. The date it took effect is printed at the top of the page, and where a change materially affects you we will tell you by email before it takes effect.