Privacy Policy

1. Information we collect and its sources

We receive information from you, your browser, account activity and the providers needed to deliver the features you choose.

• Account and authentication: email address, user/account identifiers, sign-in and session records, and, where provided by your selected sign-in provider, name, profile image and authentication credentials or tokens. We do not ask you to create a Vidda password when using our email-code or Google sign-in flows.
• Orders and payments: order references, product, price, currency, payment/refund status, transaction identifiers and access or unit balances. Stripe and Link collect payment details and billing information directly. We do not store full card numbers or card security codes.
• Content and generated results: topics, interview answers and transcripts, recordings submitted for speech recognition, scripts, prompts, uploaded reference material, generated text, frames and clips, and associated generation and usage records. We process recordings to provide recognition; this is not a voiceprint-identification feature.
• Technical and security information: IP address, browser/device information, request times, errors, authentication events, usage limits and security or fraud signals. Logs may contain relevant request identifiers and limited information necessary to investigate an issue.
• Communications and legal requests: contact details, messages, order references and identity-verification information reasonably necessary to address support, withdrawal, refund, privacy or abuse requests. Do not send passwords, full card details or unnecessary sensitive information.

2. Local processing and online features

Merch Kit edits source images in your browser; those source images are not uploaded to Vidda by the current editing/export feature. Account, payment and entitlement checks still communicate with our servers. Local image processing does not mean that every part of the Service works offline or that no account information is collected.

Mind Pencil and Video Essay Director use server-side processing. Content needed for AI generation, speech recognition or storage is sent to the relevant service providers. A feature's request to generate or transcribe content is not a request to publish it to other users.

3. Purposes and EEA/UK legal bases

Where EEA or UK data-protection law applies, we rely on the following bases as appropriate to the activity. We do not treat use of the Service or acknowledgement of this Policy as universal consent.

• Contract: creating and managing your account, providing requested editing/generation/speech features, delivering purchases, administering access and responding to requests about the service we owe you. If you are not personally a party to the contract, the relevant operational processing may instead rely on our legitimate interests in delivering services to the customer organization.
• Legitimate interests: proportionate security, fraud and abuse prevention, troubleshooting, service reliability, responding to business contacts and establishing or defending legal claims. We consider your rights and interests and apply limits appropriate to the purpose. We do not rely on a general improvement purpose to train models with your content.
• Legal obligation: applicable tax, accounting, consumer-rights, regulatory and lawful disclosure requirements.
• Consent: optional processing for which the law requires consent, such as non-essential tracking if introduced. You may withdraw such consent without affecting prior lawful processing. We seek any legally required explicit consent separately rather than through this Policy.

4. Content use, training and human access

We do not use your inputs or outputs to train or fine-tune AI models or for general human product-improvement review. We use content to provide the requested features, necessary support, security and abuse prevention, and to comply with law. Access by authorized personnel is limited to what is reasonably necessary for these purposes. We do not make your private content publicly available for marketing without a separate lawful authorization.

Our use of Google Cloud AI services is subject to the applicable service terms, including training restrictions. Providers may still process or retain information for necessary service functions, safety checks, abuse monitoring or legal obligations. A restriction on training does not mean zero retention or that no authorized person can ever review flagged content. We do not promise that all provider processing can be disabled.

• Google Cloud service terms

5. Service providers and other recipients

We disclose only information relevant to the recipient's role. Providers processing on our behalf are subject to appropriate contractual restrictions. Some recipients also act independently for their own legal and transaction purposes, as explained in their notices.

We may disclose information where required by law, to protect people and legal rights, or in a genuine merger, acquisition or business transfer subject to applicable protections and notice. We do not sell personal information or share it for cross-context behavioral advertising. Payment to a vendor is not permission for unrelated advertising use.

• Google Cloud and Vertex AI: hosting/infrastructure, storage and AI or speech processing needed for the feature. Relevant content, technical information and service metadata may be processed. Google sign-in is a separate authentication service chosen by you; Google also handles information under its own applicable privacy terms.
• Stripe, Sold through Link and applicable affiliates: checkout, payment, receipts, indirect-tax functions, refunds, fraud prevention and transaction support. Stripe/Link may act as independent controllers for their merchant-of-record, financial and legal obligations, rather than solely following Vidda's instructions.
• Resend: delivery of sign-in codes, purchase/service messages and support or rights-request confirmations. We disclose recipient addresses and message content needed to send those emails.
• Infrastructure and professional support providers: hosting, database, file storage, security, accounting or legal support, where engaged and needed for the stated purpose. We remain responsible for selecting and instructing processors appropriately; using a cloud provider does not make all recipients the same legal entity.

• Google Cloud data processing terms
• Stripe Privacy Policy
• Resend Privacy Policy

6. International processing and transfers

Vidda is incorporated in the United States. Cloud and AI processing may occur in the United States and in other locations used for the selected services. An endpoint name or storage location is not a promise that every processing activity takes place there. Authorized personnel may work remotely from the United States, China or Thailand for the limited purposes described above. We do not represent that all personnel or all access are located in the United States.

Access by a person acting within the same legal entity is assessed separately from disclosure to an independent service provider or another company. Where a restricted international transfer is made under applicable EEA or UK law, we must use an applicable lawful mechanism, such as an adequacy decision covering the specific recipient and transfer, or appropriate contractual safeguards with any necessary supplementary measures. We do not rely on your acceptance of this Policy as routine consent to unrestricted transfers.

You may contact hi@viddastudio.com for information about relevant recipients, processing locations and the applicable safeguards, including how to obtain a copy subject to necessary redactions. We assess access and transfer arrangements in light of applicable law; a provider's certification does not automatically cover Vidda or every onward recipient.

7. Cookies, local storage and tracking choices

We use session cookies and similar storage for authentication and security, and local storage for tool state and preferences. Disabling necessary cookies can prevent sign-in or access checks. Browser controls may remove local tool data; keep your own copies of important work.

We do not use Google Analytics or Google advertising measurement tags in the current Service. Google authentication, Stripe/Link checkout and other external services can use their own cookies and technologies under their notices. Server-side AI processing is separate from a browser advertising tag. We do not promise control over another provider's own-domain cookies.

We do not use browser signals to authorize tracking. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no such sale/sharing to opt out of in the current Service. We do not otherwise change necessary session processing in response to Do Not Track. Where a legally recognized opt-out signal applies to an activity, we honor it as required. Before adding non-essential tracking, we will provide the required notice and choice or consent.

8. Retention and deletion

We retain information only for as long as reasonably necessary for its stated purpose and applicable obligations. Account information is needed while the account is active; content is needed to provide the requested feature, make results available and address related support. You may request earlier deletion subject to lawful exceptions. A unit pack's expiry determines spending rights, not a promise of permanent content storage or an automatic deletion date.

We determine retention using the type of information, the service and access period, outstanding support or disputes, fraud/security needs, limitation periods and applicable recordkeeping duties. Transaction and tax records may need to remain after account closure. Security logs are retained only as necessary for investigation and protection. We do not keep content for model training or general human product-improvement review.

When deletion applies, it must cover relevant active records and stored files, subject to lawful retention and provider limitations. Residual backups can remain until their scheduled replacement, with their use restricted to recovery and required purposes; an applicable deletion must be reapplied if a backup is restored. We do not promise an instant purge of every backup or deletion of records Stripe independently must retain. We will explain a refusal or restriction where required by law.

9. Security and confidentiality

We use measures appropriate to the risks, including encrypted transport and access restrictions, and require appropriate confidentiality and processing obligations for authorized recipients. These measures do not guarantee absolute security. Report a suspected security issue to our contact address without including unnecessary personal content. We will address personal-data incidents and make notifications where required by applicable law.

10. Your rights and requests

Depending on the law applicable to you, you may request access, a copy, correction, deletion or portability; restriction of processing; or objection to processing based on legitimate interests. You may withdraw consent for processing based on it. These rights have conditions and exceptions. We will not unlawfully discriminate or retaliate against you for exercising a right.

Use the online request form or email hi@viddastudio.com. We may reasonably verify identity or authority and request clarification needed to locate the information. We do not require a new account solely to exercise a right. An authorized agent may submit a request with appropriate authority. We respond within applicable legal deadlines; EEA/UK requests are generally due within one month, subject to permitted extensions that we explain as required. If we refuse, we provide reasons and information about available review or complaint rights.

Account closure, a content deletion request and a transaction dispute are different requests. Tell us which you want. We review applicable billing retention and unresolved entitlements rather than treating every request as immediate deletion of all business records. Product generation is not a feature for making solely automated decisions about you with legal or similarly significant effects.

• Submit a refund, withdrawal or privacy request

11. EEA, UK and US state rights

EEA and UK individuals may complain to their competent supervisory authority, including an authority in their place of residence or the UK Information Commissioner's Office, as applicable. You may contact us first, but do not have to. Applicable rights and transparency obligations apply from the relevant processing, not only after we reach a particular number of customers.

Where a US state privacy law applies to our processing, you may have rights to know/access, correct, delete, receive a portable copy, and opt out of applicable sale, targeted advertising/sharing or certain profiling; some laws provide sensitive-data limits and an appeal after denial. Submit a request or appeal through the contact methods above. If we deny an applicable appeal, we explain any further complaint route. We assess statutory applicability; we do not claim that every state statute applies to every activity or that a consumer can waive mandatory rights through our Terms.

• Find an EEA supervisory authority
• UK Information Commissioner's Office

12. Adults, other people's information and sensitive content

The Service is intended only for people aged 18 or older and is not directed to children. If you believe a child has provided information, contact us so we can investigate and take appropriate action. An age restriction does not remove duties that apply if we learn of a child's information.

Submit another person's information only with lawful authority. Avoid unnecessary health, biometric-identification, financial-account, criminal-offence or other sensitive information. The Service is not designed for regulated clinical use or legally significant automated decisions. If a proposed business use requires a DPA or additional safeguards, contact us before submitting that content.

13. Changes to this Policy

We identify the effective date and version of this notice. We provide appropriate notice of material changes and obtain consent where required before a new processing activity. Updating this page does not authorize retroactive use of content for training or waive rights that already apply. A copy of this published version is available using the download link.

14. Contact

Vidda Studio LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. Email: hi@viddastudio.com. This is our registered mailing address.