Privacy Policy

Last updated: 28.07.2026

1. Who is responsible for your personal data

Videola.ai ("Videola", "we", "us" or "our") is operated by:

Legal name: Oleg Tatarciuc Business status: Self-employed professional / autónomo established in Spain NIF/NIE: Z1704146N Professional address: San Mames de Aras, Cantabria, Spain Privacy contact: support@videola.ai

For the processing described in this Privacy Policy, Videola is generally the data controller. This policy explains what personal data we process, where it comes from, why, on what legal basis, who receives it, how long we keep it, how international transfers are protected, and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law.

It should be read together with our Terms of Service, our AI Transparency Notice, and our Legal Notice (Aviso Legal).

2. When Videola acts as a controller or a processor

Videola acts as a data controller when it decides why and how personal data is processed — for account administration, operation of the Service, subscription and credit management, security and abuse prevention, customer support, service communications, and its own legal compliance.

Where a Business User uploads personal data about other people (for example employees, clients, or people appearing in their material) and decides the purposes of that processing, Videola may process that content on the Business User's instructions as a data processor. Business Users who need Videola to process personal data on their behalf should enter into Videola's Data Processing Agreement. Videola may still act as an independent controller for limited security, fraud-prevention, billing-reconciliation and legal-compliance processing relating to its own operation of the Service.

3. The personal data we process

3.1 Information you provide directly

• Account details: your email address, and any display name or profile information you choose to add. Authentication is handled by Clerk; where Clerk manages your password, we never receive or store it in readable form.
• Your Inputs: narration scripts and other text, prompts and instructions, project titles, uploaded images, and your voice/caption/language/format selections. Your Inputs may contain personal data about you or other people — see Section 11.
• Communications: the content of any message you send us, including attachments and any details you include.

3.2 Information collected automatically when you use the Service

You do not enter this information manually — it is transmitted by your browser and processed by our hosting, authentication and security providers as a normal part of delivering an online service. Depending on the provider and configuration it may include:

• IP address and approximate location derived from it;
• browser type and version, device type, and operating system (from the User-Agent your browser sends);
• session and authentication identifiers, and login/security events;
• the pages or API routes requested, and request timestamps;
• error and diagnostic information; and
• security and abuse-prevention records.

Videola does not necessarily store all of this in its own database. Some of it is processed only transiently in provider infrastructure or logs for delivery, security, and troubleshooting.

3.3 Information we receive from third parties

• From Clerk, when you register or sign in (and, if you use social sign-in, limited OAuth profile information from your chosen provider).
• From Creem, concerning a purchase, subscription, renewal, cancellation, refund, or chargeback. We receive limited transaction information such as Creem customer/transaction identifiers, the plan or credit pack purchased, amount and currency, payment and subscription status, and an invoice reference. We never receive or store your full payment-card number.

We also maintain credit and usage records (subscription- and purchased-credit balances, grants, deductions, failed-generation restorations, and related timestamps) and generated content (images, translated text, voiceovers, captions, rendered videos, and job records).

4. Why we process your data and our legal bases

• Providing and administering the Service — creating and authenticating your account, generating images, narration, captions and videos, managing projects, and maintaining credits and subscription access. Legal basis: performance of our contract with you.
• Payments, subscriptions and credit administration — granting credits, activating and maintaining subscriptions, processing cancellations, assisting with refunds, reconciling transactions, and resolving billing disputes. Legal basis: performance of our contract, our legitimate interest in accurate commercial records, and compliance with legal obligations.
• Transactional communications — verification and security notices, video-ready notifications, subscription and cancellation notices, material Service/legal notices, and support replies. Legal basis: performance of our contract and, where applicable, legal obligation.
• Security, fraud prevention and acceptable-use enforcement — securing accounts, preventing unauthorised access and payment abuse, investigating prohibited use, and enforcing our Terms. Legal basis: our legitimate interests in a secure, lawful Service, and compliance with legal obligations.
• Diagnostics and support — investigating failures, restoring credits after verified technical failures, and improving reliability. Legal basis: performance of our contract and our legitimate interests in a reliable Service.
• Accounting, disputes and legal compliance — meeting accounting and tax duties, responding to lawful requests, and establishing, exercising or defending legal claims. Legal basis: compliance with legal obligations and our legitimate interests in protecting our rights.

We do not sell your personal data, and we do not use it for advertising. If we ever introduce optional marketing or non-essential cookies, we will rely on consent or another lawful basis and provide a simple way to opt out.

5. How your content is processed by AI and video services

Depending on the feature you use:

OpenAI. We may send OpenAI your narration text for translation or transformation, relevant portions of a script for contextual analysis, scene descriptions or prompts derived from your script, and image-generation prompts. OpenAI returns translated/transformed text, contextual results, or generated images. We configure supported OpenAI API requests with storage disabled (store: false) and do not opt in to voluntary API data sharing for model training. OpenAI may still retain limited API content for a short period for abuse monitoring, security and legal-compliance purposes, as described in its applicable terms.

ElevenLabs. We send ElevenLabs the narration text to be synthesised, the selected voice, and the technical settings needed to produce the audio. It returns a synthetic voiceover. Videola has disabled ElevenLabs' optional setting permitting submitted content to be used to improve models.

Uploaded images. Uploaded images are temporarily stored in a private Cloudflare R2 bucket configured with European Union jurisdictional restrictions. They are retrieved by Videola's own server-side processing and assembled into your video locally using FFmpeg. Uploaded images are not sent to OpenAI, ElevenLabs, or any other AI-model provider. Images are deleted when the generation job completes or fails; a scheduled cleanup process also removes images and temporary files left behind by interrupted, abandoned, or failed jobs no later than 48 HOURS after upload. If we ever introduce image analysis, editing, or image-to-image features that would send uploaded images to an AI provider, we will update this policy and show a clear notice in the Service before doing so.

Background music. If you select background music from Videola's catalog, you are selecting a pre-existing AI-generated track (created with Suno); no data of yours is sent to a third party for this. If you upload your own track, it is temporarily stored in a private Cloudflare R2 bucket configured with European Union jurisdictional restrictions. It is retrieved by Videola's own server-side processing and mixed into your video locally using FFmpeg. Uploaded music is not sent to OpenAI, ElevenLabs, or any other AI-model provider. It is deleted when the generation job completes or fails; a scheduled cleanup process also removes music files and temporary files left behind by interrupted, abandoned, or failed jobs no later than 48 HOURS after upload.

Beast Mode. When Beast Mode is used, we may send all or relevant parts of your script to OpenAI to interpret context, identify scenes, divide the narration into visual segments, create image prompts, and generate corresponding imagery. Beast Mode makes automated creative choices that shape the video but do not produce legal or similarly significant effects concerning you (see Section 13).

6. AI-model training

Videola does not use your Inputs or Output to train its own AI models, and does not voluntarily opt in to programs that would allow its AI providers to use your content for general model training. Our providers may still process limited information as permitted by their agreements to supply the requested service, maintain security, detect abuse, comply with law, or provide support. If our practices materially change, we will update this policy before applying the change to your content where required.

7. C2PA Content Credentials (provenance transparency)

Videola embeds C2PA Content Credentials into supported exported video files. These identify Videola as the service that generated or assembled the file and may describe the use of AI-generated or AI-modified components, related actions, and timestamps, together with cryptographic information used to verify provenance.

The C2PA manifest is not intended to identify you. It does not intentionally include your name, email address, Videola account identifier, payment information, narration text, prompts, uploaded images or filenames, private storage addresses, or internal project/job identifiers — only the Videola service name and identifier, and a fixed generic video title (not derived from your script). For that reason we describe it here for transparency rather than as a category of your personal data.

C2PA metadata may be preserved, altered, or removed when a video is edited, compressed, converted, re-encoded, or uploaded to a third-party platform, and it does not replace any visible AI disclosure required by law or by a publishing platform.

8. Service providers and other recipients

We use the following providers to operate the Service. Exact entities, roles, and configurations should be confirmed against each provider's current data-processing terms before publication.

We may also disclose personal data to professional advisers under confidentiality; to competent authorities where legally required; where necessary to protect the rights, safety, or security of users or others; in connection with a merger, reorganisation, or sale of the Service (subject to safeguards); or where you instruct or authorise us to do so. We do not sell personal data.

9. International data transfers

Some providers, or their affiliates and sub-processors, are located outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on a mechanism recognised under the GDPR — an adequacy decision, the EU–US Data Privacy Framework where the recipient is validly certified, the European Commission's Standard Contractual Clauses, and/or supplementary safeguards.

Our infrastructure is configured as follows:

• Railway PostgreSQL: EU West (Amsterdam).
• Railway application service, Redis, and worker: EU West (Amsterdam).
• Cloudflare R2: configured with Cloudflare's European Union jurisdictional restriction, so objects in that bucket are stored and processed within the EU. Cloudflare may separately process limited account, security, or operational information under the safeguards in its data-processing terms.
• Sentry data region: European Union (EU).
• Vercel: European Union (EU).

Even where primary hosting is in the EEA, authorised provider personnel or sub-processors may process limited data from another country for support, security, or operational purposes under applicable safeguards. You can ask for more information about relevant safeguards at support@videola.ai.

10. How long we keep your data

We keep personal data only as long as necessary for the purpose. Our intended periods — to be finalised so they match what production actually enforces — are:

When you delete your account, we delete or anonymise your personal data except where retention is required by law, for accounting/tax records, to prevent fraud, or to resolve an active dispute or legal claim. Data may remain briefly in encrypted backups until the backup cycle ends.

11. Personal data about other people

Your Inputs may contain personal data about other people (a name, image, or likeness). You are responsible for ensuring you have a valid legal basis and any required permission to submit and use it, and that your use does not infringe privacy, publicity, personality, or intellectual-property rights.

Please do not upload identity documents, medical or financial-account information, passwords, biometric templates, or other highly sensitive data that is not necessary for video generation. We do not intentionally use uploaded images to uniquely identify people or infer sensitive characteristics.

12. Children and content depicting minors

Only people aged 18 or over may create or control a Videola account, and we do not knowingly permit minors to operate accounts. Adult users may, however, submit lawful content that depicts a minor, which we then process only to provide the requested Service. You may submit such content only where you are the parent or lawful guardian, have their valid permission, or another lawful basis applies. The Service must not be used to exploit, sexualise, endanger, impersonate, or unlawfully expose a minor. If we learn that a minor controls an account, or that content depicting a minor was submitted without lawful authority, we may suspend the account and delete the relevant content, subject to legal-retention requirements. Contact support@videola.ai with any concern about a child's data.

13. Automated processing and decision-making

Videola uses automated systems to interpret scripts, create prompts, select or generate creative elements, synthesise voices, assemble videos, detect technical failures, and detect certain fraud or abuse. These processes affect the creative content you receive and whether a particular request is accepted, but Videola does not use automated processing to make decisions producing legal or similarly significant effects about you within the meaning of Article 22 GDPR. Where an account is permanently suspended for a serious violation, we aim to provide human review where reasonably appropriate, particularly if the decision is contested.

14. Your rights

Subject to the conditions and exceptions in applicable law, you may have the right to: confirm whether we process your data and access it; correct inaccurate or incomplete data; request erasure; restrict processing; object to processing based on legitimate interests; receive certain data in a portable format and have it transmitted to another controller; withdraw consent where processing is based on consent; and lodge a complaint with a supervisory authority.

Some rights are conditional: portability applies mainly to data you provided where processing is automated and based on consent or contract; the right to object applies particularly to legitimate-interest processing; and erasure can be refused where retention is legally required or necessary for legal claims. Withdrawing consent does not affect processing carried out lawfully beforehand.

To exercise a right, contact support@videola.ai, identifying the account and the right concerned. We may ask for reasonable information to verify your identity, and no more than necessary. We normally respond within one month; for particularly complex or numerous requests we may extend this where the law permits, and will tell you. Exercising your rights is normally free, though a reasonable fee or refusal is permitted for manifestly unfounded or excessive requests.

15. Complaints

You may complain to the data-protection authority in your country of residence or work, or where you believe an infringement occurred. In Spain the competent authority is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. We would appreciate the chance to address your concern first at support@videola.ai.

16. Data security

We use technical and organisational measures designed to protect personal data, including encryption in transit, provider-supported encryption at rest, role-based and least-privilege access, restricted production access, time-limited/signed access to stored files, authentication and session controls, secrets management, logging and incident monitoring, dependency and security updates, and contractual data-protection obligations for our processors. No internet service is completely secure. You are responsible for protecting your credentials and for downloading any Output you wish to keep. Where a personal-data breach is likely to create a high risk to affected individuals, we will notify them where required by law.

17. Cookies and similar technologies

Videola uses cookies, local storage, and similar technologies that are necessary to authenticate users through Clerk, maintain secure sessions, prevent fraud, remember essential settings, and operate checkout and subscription functionality. Strictly necessary technologies may operate without consent where the law permits.

At the date of this policy, Videola does not use advertising cookies or cross-site behavioural advertising, and no client-side analytics or session-recording tools (such as Vercel Analytics, Sentry Session Replay, or Cloudflare Web Analytics) are enabled. If we enable any such tool in future, we will disclose it here and, where it is non-essential, request your consent before it runs. Creem may use its own cookies on its hosted checkout and customer portal, explained in Creem's own privacy and cookie information.

If we introduce optional analytics, personalisation, or advertising technologies, we will update this policy, request consent where required (LSSI Article 22 and the ePrivacy rules), prevent them from operating before consent, and let you withdraw consent as easily as you gave it.

18. Changes to this Privacy Policy

We may update this policy to reflect changes to the Service, new providers or processing activities, security or operational changes, or changes in law or regulatory guidance. The "last updated" date shows the latest version. Where a change materially affects how we use personal data, we will give appropriate notice through the Service, by email, or another suitable method before it takes effect where required. We will not rely on a revised policy alone to obtain consent where the law requires separate consent.

19. Contact

For privacy questions, complaints, or to exercise your rights:

Oleg Tatarciuc
Self-employed professional / autónomo
NIF/NIE: Z1704146N
Professional address: San Mames de Aras, Cantabria, Spain
Email: support@videola.ai\

You may also contact the AEPD (www.aepd.es) or your local EU supervisory authority.