Privacy Policy

1. Who is responsible for your data

The data controller is Alessio Battagliero, Via Orti 12, Milano (VAT IT02771920069). For anything in this notice, including to exercise the rights in section 9, write to [email protected].

This notice explains what personal data GPT-Video collects, why, on what legal basis, how long we keep it and who else touches it.

2. What we collect

What you give us. Your email address, the password you choose (stored only as a cryptographic hash — we cannot read it) or the identifier of the sign-in provider you use instead, and anything you write to us for support.

What you upload and make. The videos, audio and images you bring in, the transcripts and clips derived from them, the projects you build, and the instructions and images you send to the editing assistant.

Payment data. Your subscription status, plan and invoices. Card numbers are handled entirely by our payment provider and never reach our systems. If you buy from one of our offer pages without having an account, our payment provider passes us the email address you paid with, and we create your account from it.

Technical data. Your IP address and request metadata reach our servers as part of any web request and appear in short-lived operational logs. We record aggregate counters — how many requests, how fast, how many failed — which are not tied to an individual. When you use an API key, we keep a log of the requests made with it: the time, the key, the operation, the result, how long it took and the kind of program that sent it. We do not keep what the request or the answer contained, and we do not keep your IP address in this log. You can read it on the Developers page. When you create an API key or connect an AI assistant, we keep a one-way code made from your network address, which we use only to limit how many API bonuses one network receives. When your account receives the API bonus, we also keep a one-way code made from the domain of your email address, which we use only to limit how many API bonuses one domain receives.

How we count pages. The public site's visit counter records the day, the page path, the referring site and, when the link that brought you carried one, a short source code taken from ?ref= or utm_source. It does not record an identifier, a country or the rest of the address bar, and it cannot be traced back to a person. That counter is ours; the advertising measurement described in sections 3 and 6 is a different thing, and it is not anonymous.

Where you first came from. When you create an account, we save on it the first source that brought your browser to us, as recorded by the source cookie (section 3): the source code (from ?ref= or utm_source) and the referring site, the campaign and medium tags when the link carried them, the first page you saw (its path, without the rest of the address) and the date.

3. Cookies

We use as few as possible. All of them are ours except one group, set by the Meta Pixel to measure our advertising.

• Session cookie. Set when you sign in, so the app knows it is you. Strictly necessary. It lasts thirty days of inactivity and slides forward each time you use the app.
• Sign-in state cookie. Set for ten minutes while you are being sent to Google and back, to protect that exchange. Strictly necessary.
• Referral cookie. If you arrive through a partner's link, a cookie records which partner, for sixty days, so their commission can be attributed. This one is not strictly necessary: it is set only when you follow a partner link, and you can remove it in your browser at any time without affecting the service.
• Source cookie (gptv_src). Set when you first arrive through a link, a UTM tag or another website, it records that first source for ninety days so we can tell which sites and links bring people who become customers: the source code and the referring site, the campaign and medium tags when the link carried them, the first page you saw and the date. It is ours, it is not strictly necessary, and you can remove it in your browser at any time without affecting the service.
• Advertising cookies (_fbp, _fbc). Set by the Meta Pixel on our website and in the app, so that Meta can tell which visits, sign-ups and purchases came from our ads on Facebook and Instagram. _fbc is set only when you arrive by clicking one of those ads. These are not strictly necessary. They last ninety days, and you can block or delete them in your browser at any time without affecting the service.

4. Why we use it, and on what basis

• To provide the service — your account, your projects, the editing itself, and support. Legal basis: performance of the contract with you.
• To take payment and keep accounts — subscriptions, invoices and tax records. Legal basis: performance of the contract, and our legal obligations.
• To keep the service working and safe — logs, error and performance counters, abuse and fraud prevention, capacity planning. Legal basis: our legitimate interest in a service that runs and is not abused.
• To send you service email — verification, password resets, notices about your plan or a change to these documents. Legal basis: performance of the contract.
• To send you product email you asked for — onboarding tips and product news. Legal basis: your consent, withdrawable at any time from the link in every such message.
• To attribute partner referrals — where you arrived through a partner link. Legal basis: our legitimate interest in running a partner programme, and the contract with the partner.
• To know which sites and links bring us customers — the source recorded by the source cookie, kept on your account. Legal basis: our legitimate interest in knowing which of our listings and partnerships work.
• To measure and improve our advertising — which of our ads on Facebook and Instagram bring visitors, sign-ups and customers, and showing those ads to people more likely to find the service useful. Legal basis: our legitimate interest in knowing whether our advertising works.

5. How long we keep it

• Uploaded files (videos, pictures and audio, including the ones you attach in the editing assistant's chat): kept while one of your projects or characters uses them. A file nothing uses is deleted after seven days without use. Backgrounds you save to your background library stay until you delete them. Videos imported from a link through the API are kept like uploaded files.
• Exports (the videos you export, clips included): the file is deleted fourteen days after it is made. The export stays listed in its project, and you can export it again at any time.
• Transcripts and other analysis of a video you uploaded: kept as long as that video, and deleted with it.
• Your account and projects: for as long as the account exists. When you close it we delete your material and your account data, except what the law requires us to keep and, if the account received the API bonus, the codes below. When an account is deleted, we keep a one-way code made from its email address, only to know that it already received the API bonus. We also keep the one-way codes made from the domain of that address and from the network address it used, because they still count toward the limits on API bonuses per domain and per network.
• Invoices and tax records: for the period Italian tax law requires, currently ten years.
• Sign-in sessions: thirty days of inactivity, then removed.
• Operational and performance counters: up to one hundred and eighty days, in aggregate form.
• API request log: fourteen days, then deleted.
• Webhook delivery records: thirty days.

6. Who else handles it

We use a small number of providers to run the service. Each acts on our instructions under a data processing agreement, and each sees only what it needs.

The last one is used only if you connect an AI assistant with one click, and only receives your user id and your email address so it can tell the assistant which account approved the connection; it never sees your videos, your clips or your payment data. An assistant connected with an API key instead does not involve it at all.

The three before it serve the UGC room: fal.ai and BytePlus are used only when the UGC room is switched on, and only for the projects you make in it. What reaches them is what that room needs to generate the video: the product photos, the photos and voice samples of a character, and the prompts written from your brief. Google (Gemini) is also used outside that room: when the editing assistant needs to know what an image you attached in its chat shows, it sends Gemini that image and gets back a short description. None of the three see your account, your other projects or your payment data.

Paying with PayPal. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. handles that payment as a controller in its own right, under its own privacy statement. We receive from it, through Stripe, only what we need to record the payment.

Advertising measurement. When you use our website or the app, the Meta Pixel sends Meta Platforms Ireland Limited the address of the page you are on; the steps listed in section 4 — creating an account, confirming your address, starting a checkout and completing a purchase, with its price; your IP address; information about your browser and device; and the cookies described in section 3. If you type your email address into our sign-up form, the pixel may also send Meta a scrambled (hashed) form of it, so the sign-up can be matched to an ad. It never receives your password, your videos, your projects or your card details, and it is kept away from the links in our emails that carry a one-time code or an invitation. If you are signed in to Facebook or Instagram in the same browser, Meta can connect these events to that account.

For collecting and sending this data, Meta and we are joint controllers under Meta's Controller Addendum. What Meta does with it afterwards — including using it to improve how ads are delivered — is Meta's own responsibility, described in Meta's Privacy Policy. You can control how Meta uses it from your Facebook or Instagram ad settings, and you can object to it at any time by blocking the cookies above or third-party scripts in your browser, or by writing to us.

We also disclose data where the law requires it, to respond to a lawful request from an authority, or to establish or defend a legal claim. We do not sell your data, and apart from the advertising measurement above we do not share it for advertising.

7. When you connect an AI assistant

If you let an AI assistant use GPT-Video on your behalf, data moves in a direction this notice would otherwise not describe, so here it is plainly.

What reaches the assistant. Only what it asks for and what an answer needs: the titles and status of your projects, the clips found in them with their scores and short transcript excerpts, the progress of a job, and a temporary link to download a finished export. Your password, your payment details and your other account data are never sent, and we never send the contents of the assistant's own conversations back to ourselves — we do not log them, not even for diagnostics.

Who receives it. The company operating the assistant you chose, which is an independent controller of what it receives and handles it under its own privacy notice, not ours. We are not able to delete data from their side; the assistant's own settings are where you do that.

Why we may do it. Because you asked us to: connecting an assistant is your instruction, and the transfer is necessary to perform the contract you have with us. You can end it at any moment from the Developers page, which revokes the credential — anything using it stops working on its next call. Revoking does not undo what has already been sent.

Download links. A link to an exported file is signed, points at one file only and expires within minutes. We do that because an assistant needs to fetch the file without holding your session, and a link that never expired would be a credential anyone could pass on.

Webhooks. A webhook sends identifiers and statuses to an address you choose. Whoever runs that address receives them under their own terms.

8. Transfers outside the European Economic Area

Some of the providers above, and Meta, process data in the United States, and one in Singapore. Those transfers are made under the European Commission's Standard Contractual Clauses, and where the provider is certified, under the EU–US Data Privacy Framework. You can ask us for details of the safeguards for a specific provider at [email protected].

9. Your rights

Under the GDPR you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent you may withdraw it at any time, which does not affect what we did before you withdrew it.

Write to [email protected] and we will answer within one month.

If you think we have handled your data badly you may complain to your national supervisory authority. In Italy that is the Garante per la protezione dei dati personali. You may also complain to the authority of the country where you live or work.

10. Security

Passwords are stored only as salted hashes and are never readable, by us or by anyone who obtained a copy of the database. Traffic is encrypted in transit. Access to production systems is limited to the people who operate them. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data and is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.

11. Children

GPT-Video is not for people under 18 and we do not knowingly collect their data. If you believe a minor has an account, write to [email protected] and we will remove it.

12. Changes to this notice

We may update this notice. The date it took effect is printed at the top of the page, and where a change materially affects you we will tell you by email before it takes effect.