Privacy Policy

1. Data controller

2. Data processed

• Clerk user identifier and data necessary for authentication and the account;
• subscription projection, Stripe customer and subscription identifiers, billing status, and quota;
• uploaded VOD, file name and size, duration, video and audio processing metadata, transcripts where used, candidates, ranking information, and Vodyra Score;
• clips, variants, captions, exports, result metadata, and positive or negative feedback;
• for optional social connections: provider, account identifier, display name, permissions, encrypted OAuth tokens, and expiry information;
• for a requested publication: selected options, status, publication identifiers, and errors;
• limited product events, analysis states, error categories, and operational metadata;
• technical data, security data, and logs, including IP addresses, that may be generated by the application or its providers during requests.

3. Purposes and legal bases

Data necessary for the account, VOD analysis, generation and export, quota enforcement, billing, and requested social actions is processed to perform the contract or requested pre-contractual steps. Security, abuse prevention, diagnostics, limited internal product instrumentation, and service improvement rely on the legitimate interest in providing a reliable service, subject to your rights. Applicable tax, accounting, and legal duties rely on the relevant legal obligations. Social connections and publications remain optional and are initiated by your choice and authorization.

4. OpenAI-assisted processing

Vodyra uses OpenAI for semantic ranking, selection, and boundary-adjustment steps. The workflow sends reduced elements useful to those steps—such as candidate context, timestamped transcript excerpts, summaries of audio and visual signals, and, depending on configuration, candidate images—not the multi-hour raw video file.

The Vodyra Score helps explain and order moments; it neither predicts nor guarantees their virality or performance.

5. Recipients and providers

• Clerk: authentication and session management;
• Stripe: payment, subscription, billing, and taxes;
• Cloudflare R2: private storage of media and artifacts;
• Vercel: frontend and public website hosting;
• Modal Labs: backend compute and video processing;
• a PostgreSQL database: durable metadata;
• OpenAI: processing of the reduced elements described above;
• Google/YouTube, Meta/Instagram, and TikTok only if you connect the provider or request publication.

These recipients access only the data needed for their role or the requested action.

6. International transfers

Some providers may process data outside the European Economic Area. Where required by law, Vodyra relies on appropriate legal mechanisms and safeguards made available for the relevant processing. Vodyra does not promise processing located exclusively in the European Union.

7. Video and media retention

After successful pipeline completion, the source VOD is removed from processing storage. A failed or abandoned upload may remain until the 30-day R2 lifecycle is applied. Generated heavy media expires 30 days after analysis completion. The application blocks access at that deadline; physical deletion by R2 may occur asynchronously. Lightweight result metadata may remain longer, and Vodyra does not claim that every database row is deleted after 30 days.

8. Other retention criteria

• Account: while the account exists, then according to applicable legal or security needs.
• Social connection: until disconnection, revocation, or the end of the account lifecycle; disconnecting removes the connection and its encrypted tokens from Vodyra.
• Billing: during the subscription relationship and as long as necessary for applicable accounting, tax, or legal obligations.
• Social publications and lightweight metadata: according to the account lifecycle, the need to provide history and diagnose the service, and applicable obligations.
• Product events: no automatic expiry is currently implemented; they are retained according to the need for internal service measurement and improvement and must be covered by an operational deletion policy.

9. Security

R2 media is private and access is checked before a temporary URL is produced. Social OAuth tokens are encrypted server-side and are not returned to the browser. No measure removes every risk; contact us if you suspect unauthorized access.

10. Your rights

Depending on your situation and the legal basis, you may request access, rectification, erasure, restriction, or portability; object to processing based on legitimate interests; and withdraw consent where processing relies on consent. Withdrawal does not affect prior lawfulness. Send requests to dev.triven.kadiata@gmail.com. Reasonable identity verification may be requested. You may also lodge a complaint with the French data protection authority, the CNIL.

11. Cookies and trackers

See the Cookie Policy for technologies necessary for authentication and payment and the result of the current audit.