Privacy Policy

1. Who is responsible

The operator of RPT AI Video Studio is the controller of the personal data described here. The legal name, registered address and contact address of the operator will be added here before this document takes effect.

For material you upload about other people, you decide why it is processed, and we process it on your instructions.

2. What we collect

• Account data: username, display name, a hash of your password, the workspaces you belong to, and your language, time zone and theme choices.
• Content: briefs, scripts, product and reference images, audio and video you upload, and the outputs generated for you.
• Work and billing records: projects, quotes, runs and media tasks with their prices and status, and the API tokens you issue with their modes.
• Product telemetry for signed-in users, used to measure quality: which screens and actions are used, how projects move from plan to quote to delivery, the MCP tools agents call, processing times, and a fingerprint of each prompt sent to AI models (a hash, its length and role) with its outcome. Where prompt text capture is switched on, the prompt text itself is kept with personal details removed. You can stop interface event recording in the account menu. Section 6 says how long each kind is kept.
• Technical data: IP address, browser user agent and request logs needed to run and protect the service.

3. Why we use it

• To provide the service you signed up for (performance of a contract).
• To keep the service and your account secure and to prevent abuse (legitimate interests).
• To measure and improve quality (legitimate interests; you can opt out of interface event recording).
• To meet legal duties such as tax and accounting (legal obligation).

We do not sell personal data and we do not use it for advertising.

4. Who receives it

Service providers process data on our behalf: cloud hosting, GPU compute and storage (Modal), network delivery and protection (Cloudflare), and the AI model providers that perform a step you ask for, such as Google Gemini for planning and image steps.

When a workspace connects its own AI vendor account, the inputs for that step go to that vendor under the workspace’s own agreement with it. We disclose data to authorities only when the law requires it.

5. International transfers

Our providers may process data outside your country, including in the United States. Where the law requires it, transfers rely on safeguards such as standard contractual clauses.

6. How long we keep it

• Account data: while your account is open.
• Content: until you delete it or close your account, plus the time it takes for backups to roll over.
• Interface events, project flow events and agent turns: 180 days.
• MCP tool calls made by agents: 365 days.
• Prompt fingerprints and outcomes, run and GPU job records, and the summary of each project flow: 730 days (two years).
• Prompt text with personal details removed, where it is captured: 60 days.
• Request, provider call and other operational records: 30 days.
• Billing records: as long as tax and accounting law requires.

7. Your rights

Depending on where you live, for example under the EU or UK GDPR or Vietnam’s personal data protection law, you can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent you gave. You can also complain to your data protection authority. The address for requests will be added here before this policy takes effect.

8. Children

The service is not meant for anyone under 18, and we do not knowingly collect their data.

9. Security

Session cookies are HTTP-only and sent only over secure connections, every write is checked against cross-site requests, and a workspace can be reached only by its members and the tokens they issue. No system is perfectly secure; please report a vulnerability to the contact that will be listed here.

10. Changes

We publish each new version of this policy with a new version line and tell account holders about material changes before they apply.