Privacy Policy

Effective Date: December 12, 2025

This Privacy Policy describes how VidForge AI ("we," "our," or "us") collects, uses, and discloses your personal data when you use our AI-powered video generation platform and its associated services (collectively, the "Services"). We are committed to protecting your privacy and handling your personal data in an open and transparent manner, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

VidForge AI is the data controller responsible for processing your personal data in connection with the Services.

2. Personal Data We Collect

We collect various types of personal data to provide and improve our Services. This may include:

• Identity and Contact Data: Firebase User ID (`firebase_uid`), email address, Stripe customer ID (`stripe_customer_id`).
• Financial Data: Information related to your subscription plans, credits, billing history, and transactions. Note: We do not directly store your full payment card details; these are handled by our third-party payment processor, Stripe.
• Usage Data: Information about how you use our Services, such as job IDs, video topics, configurations used for video generation, credit consumption, and features accessed.
• Content Data:
  • Input Data: Text prompts, user-uploaded images and videos you provide for content generation.
  • Output Content: The generated videos, images, audio, and subtitles created through your use of the Services.
  • Voice Data: In cases where you use our Text-to-Speech (TTS) features, the text input may be processed to generate synthetic speech.
• Technical Data: Internet Protocol (IP) addresses, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access our Services.
• Communication Data: Any communications you send to us, such as support queries or feedback.

3. How We Use Your Personal Data (Purpose and Legal Basis)

We use your personal data for the following purposes and rely on the following legal bases under UK GDPR:

• To Provide and Maintain the Services (Contractual Necessity):
  • Managing your account and providing access to our features.
  • Processing your video generation requests and delivering Output Content.
  • Tracking your credit balance and subscription status.
  • Providing technical support and responding to your inquiries.
• For Billing and Payment Processing (Contractual Necessity):
  • Processing your subscription payments and managing auto-renewals.
  • Facilitating transactions through our payment processor (Stripe).
• To Improve and Personalize Our Services (Legitimate Interests):
  • Analyzing usage patterns to enhance features and user experience.
  • Personalizing your experience (e.g., showing relevant history).
  • Protecting against fraud and ensuring system security.
• For Legal and Regulatory Compliance (Legal Obligation):
  • Complying with applicable laws, regulations, and legal processes.
  • Responding to lawful requests from public authorities.
• With Your Consent: We may process your data for other purposes where you have given your explicit consent.

4. Sharing Your Personal Data

We may share your personal data with the following categories of recipients:

• Service Providers: Third-party vendors and service providers who perform services on our behalf, such as:
  • Authentication: Firebase (Google LLC) for user authentication.
  • Payment Processing: Stripe, Inc. for managing subscriptions and processing payments.
  • Cloud Infrastructure: Modal Labs, Inc. for hosting our backend services and data storage.
  • AI Model Providers: Google (e.g., Gemini, VEO), AWS (e.g., Polly for TTS), HuggingFace, InsightFace for various AI generation tasks.
  • Analytics Providers: For monitoring and analyzing service usage.
• Legal and Regulatory Authorities: When required by law or to protect our rights, property, or safety.
• Business Transfers: In connection with any merger, sale of company assets, or acquisition of all or a portion of our business.

5. International Data Transfers

As many of our service providers (e.g., Google, AWS, Stripe, Firebase, Modal) are based in the United States, your personal data may be transferred to and processed in countries outside the UK and the European Economic Area (EEA), which may not provide the same level of data protection as your home country. To ensure adequate protection, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) or other legally recognized transfer mechanisms.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our data retention practices include:

• Generated video files are typically retained for 30 days within our storage volume for your convenience.
• Video history (metadata of up to 5 recent videos) is kept for a longer period to allow you to track your creations.
• Account information is retained as long as your account is active.
• Financial transaction records are retained for periods required by tax and accounting laws.

7. Your Data Protection Rights (UK GDPR)

Under UK GDPR, you have the following rights regarding your personal data:

• Right to be Informed: To receive clear, transparent, and easily understandable information about how we use your personal data.
• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): To request that we delete your personal data in certain circumstances.
• Right to Restrict Processing: To request that we restrict the processing of your personal data in certain situations.
• Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to Object: To object to our processing of your personal data in certain circumstances, particularly when processing is based on legitimate interests or for direct marketing.
• Rights in Relation to Automated Decision-Making and Profiling: To obtain human intervention, express your point of view, and contest automated decisions.
• Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the details provided in Section 9.

8. Security of Your Personal Data

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, accidental loss, destruction, or damage. However, no method of transmission over the Internet or method of electronic storage is 100% secure.

9. Contact Us & Complaints

You can delete your account from the main generation page by going to My Account. If you choose to delete your account, we will delete all our stored information about you.

If you have any questions or concerns about this Privacy Policy or our data protection practices, please contact us at admin@vidforgestudio.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top. We encourage you to review this Privacy Policy periodically for any changes.