Privacy

0. Scope

This policy governs the Vidoby web app at vidoby.com, operated by Alpit Tare, sole proprietor trading as EXAFABS.AI (India). It is separate from the EXAFABS mobile apps, which are governed by their own app store policies.

1. Information we collect

We collect only what we need to run the service:

• Account. Your email and name, with authentication handled by Clerk (email and password, or Google sign-in).
• Generation inputs you provide. Project details (niche, tone, brand colors, deep link); reference "hook" videos you upload or import via a public Instagram, TikTok, or YouTube link; avatar images you upload or have AI-generated; optional product or app demo footage; voice and language choices; and scripts you edit or approve.
• Generated assets we produce for you. Scripts, voiceovers, avatar videos, lip-synced hooks, and final renders.
• Discover and Account Spy. Public social posts you choose to browse or track (handles, URLs, and public view and like counts).
• Billing. Subscription status and entitlement metadata from Dodo Payments — never your card or bank details.
• Product usage. Basic usage data to operate and improve the service.

We deliberately do not collect card or bank numbers (Dodo is the Merchant of Record), and we never connect to your bank.

2. How we use your information

We use your information to run the generation pipeline; process subscriptions and credit top-ups via Dodo; improve the service; send service-related messages; detect and prevent abuse; and meet our legal and tax obligations. We do not sell your personal information, and we do not use your content to train our own models.

3. AI generation & processing

To produce your videos, we send your inputs to AI providers: Google (Gemini) for script remixing, voice synthesis, and avatar image generation; and Kling (Kuaishou) for image-to-video and lip-sync. Only the inputs needed for your generation are sent, and per these providers’ API terms your content is not used to train their public models.

4. Reference-hook import & discovery

When you import a hook by link or use Discover or Account Spy, we fetch the public post media and metadata via ScrapeCreators (and yt-dlp for YouTube). Only the public URL you supply is sent. We analyze the hook to help you remix your own script — we do not republish the original.

5. Storage & security

Your data is stored on Convex (database) and Cloudflare R2 (your uploaded media and generated assets). The app is hosted on Vercel and the generation worker runs on Render. Data is encrypted in transit (TLS), and authentication and MFA are handled by Clerk.

6. Cookies

Vidoby uses essential cookies only — the cookies Clerk sets to keep you signed in and to secure your session. We do not use analytics, advertising, or cross-site tracking cookies, and we ship no analytics or ad SDK. Because we set only strictly necessary cookies, no cookie-consent banner is required under the EU ePrivacy rules; the limited essential cookies we do use are exempt from consent. (Draft wording — confirm with counsel.)

7. Sub-processors

We share data with the following sub-processors, each acting on our instructions under their own policies:

• Clerk — authentication
• Convex — database and backend
• Vercel — web hosting
• Cloudflare R2 — media storage
• Dodo Payments — Merchant of Record for billing, tax, and remittance (web only)
• Google / Gemini — AI script, voice, and image
• Kling / Kuaishou — AI video and lip-sync
• ScrapeCreators — public social fetch for import and discovery
• Render — generation worker hosting

EXAFABS maintains Data Processing Agreements (DPAs) with these sub-processors and, where data leaves the EEA or the UK, relies on Standard Contractual Clauses (SCCs) and other appropriate safeguards as the transfer basis. In particular, Kling (Kuaishou) processes your generation prompts and inputs in China; we rely on SCCs and appropriate safeguards as the transfer basis for that processing. (Draft wording — confirm with counsel.)

8. Your rights

You can access, correct, export, delete, and withdraw consent for your data. You can Export my data and Delete my data yourself on /app/account, and delete your whole account from the same page — or email alpit@exafabs.ai. We respond within 30 days, usually within 1 business day.

Your data export includes your account, project, and job metadata, together with download links to the media we generated for you.

9. Data retention & deletion

We keep account data while your account is active. When you delete your data or your account, we delete both your database records and the generated media we hold for you in object storage (Cloudflare R2). We remove personal data within 1 business day and purge backups within 30 days. Tax-relevant transaction records are kept as required by Indian law (currently 8 years).

10. Children’s privacy

Vidoby is intended for business and professional use, and is not for anyone under 18.

11. International transfers

Vidoby is operated from India. By using it, you consent to processing in India and in our sub-processors’ regions, including the United States, the EEA, and China (see section 7). Where data is transferred outside the EEA or the UK, we rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards as the transfer basis. (Draft wording — confirm with counsel.)

12. Changes

We post updates here, update the "Last updated" date, and email active subscribers at least 14 days before material changes take effect.

13. Contact

Questions? Email alpit@exafabs.ai. Operator: Alpit Tare, sole proprietor trading as EXAFABS.AI, India.