Privacy Policy

1. Who we are

The controller of your personal data is [PLACEHOLDER] BrollBot Ltd., [PLACEHOLDER] Registered address, City, Country (“we”, “us”). You can reach us at support@brollbot.example. [PLACEHOLDER: add a data protection officer or EU/UK representative if one is required.]

This policy applies to our website, our editor and any other service that links to it (together, the “Service”).

2. Information we collect

Information you provide

• Account data: name, email address, business name (if given), password or sign-in credentials, and your training opt-out choice.
• Content you upload: videos, audio, logos, fonts and brand settings, plus the transcripts, captions and edit decisions we generate from them. This content can contain personal data about you or other people who appear or speak in it.
• Billing data: handled by Stripe. We receive your subscription status and limited payment details such as card brand and last four digits, not your full card number.
• Communications: support requests, refund requests, feedback and anything else you send us, for example through the contact form.

Information collected automatically

• Log and usage data: IP address, browser type, pages visited, actions in the product, timestamps and error reports.
• Device data: device type, operating system, language and screen size.
• Cookies and similar technologies: described in our Cookie Policy.

Information from others

If you sign in with a third-party identity provider such as Google, we receive the basic profile details you allow it to share. Payment providers tell us whether a payment succeeded.

3. How we use your information and our legal bases

• To provide the Service: transcribing your videos, matching B-roll from licensed stock libraries, rendering and exporting. Legal basis: performance of a contract.
• To process payments, issue invoices and prevent fraud. Contract, legal obligation, legitimate interests.
• To secure, maintain and improve the Service, including debugging and measuring which features are used. Legitimate interests.
• To communicate with you: confirmations, security alerts, support replies and important service notices. Contract, legitimate interests.
• To send product news or marketing, only where you have opted in or where the law allows, and you can unsubscribe at any time. Consent or legitimate interests.
• To comply with the law and to establish, exercise or defend legal claims. Legal obligation, legitimate interests.

Where we rely on legitimate interests, we balance them against your rights and interests. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

4. AI-generated content and training opt-out

The Service uses automated systems to transcribe speech, choose footage and draft captions. Output is generated by AI, can contain mistakes and is a suggestion for you to review. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

When you sign up you can switch on a training opt-out. If you opt out, your uploaded videos and the transcripts generated from them will not be used to train or improve our models. You can change this choice by emailing support@brollbot.example. [PLACEHOLDER: confirm the default setting and whether it can be changed in account settings.]

5. How we share your information

We do not sell your personal data. We share it only in these situations:

• Service providers (sub-processors) that process data on our behalf, such as hosting, speech-to-text, email delivery and payments (listed in section 8).
• Others in your workspace, where you have chosen to give them access to a project or brand kit.
• Authorities and advisers, where required by law, court order or valid legal process, or to protect the rights, safety and property of our users, the public or us.
• A successor, if we are involved in a merger, acquisition, financing or sale of assets. We will tell you if your data becomes subject to a different privacy policy.
• Anyone else, with your consent or at your direction.

6. People who appear in your videos

If your video contains other people, you are responsible for having the right to upload it and for telling those people where the law requires it. We process their data only to produce your edit. If you are a data controller for that content and we process it for you, contact us about a data processing agreement. [PLACEHOLDER: publish a DPA if you offer one.]

7. Data retention

• Uploads, transcripts and exports: deleted automatically 30 days after upload or creation, or earlier when you delete a project.
• Account data: kept while your account is open and deleted or anonymised after you close it, except where we must keep it.
• Billing and tax records: kept for the period required by accounting and tax law. [PLACEHOLDER: state the period for your country.]
• Logs and support messages: [PLACEHOLDER: state retention periods].
• Backups: [PLACEHOLDER: state how long deleted data remains in backups].

8. Sub-processors and international transfers

We may process and store data in countries other than your own, including countries that may not offer the same level of data protection. Where we transfer personal data out of the EEA, UK or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses. The providers below process data on our behalf:

9. Your rights and choices

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA or similar laws), you may have the right to:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate or incomplete data.
• Delete your data (“erasure”), subject to legal exceptions.
• Export your data in a portable format.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of personal data. We do not sell or share it for cross-context advertising.
• Not be discriminated against for using these rights.
• Complain to your local data protection authority.

To use a right, email support@brollbot.example from your account address. We may ask you to verify your identity, and we aim to respond within one month, or sooner where the law requires. You may also use an authorised agent where your local law allows.

10. Cookies and similar technologies

We use a small number of cookies and local storage entries. Details, including how to control them, are in our Cookie Policy. We do not currently respond to “Do Not Track” signals because no industry standard exists. [PLACEHOLDER: update if you add analytics.]

11. Security

We use technical and organisational measures to protect personal data. No system is completely secure, so we cannot guarantee absolute security. Our Security page describes our practices and how to report a vulnerability. If a breach affects your data, we will notify you and the relevant authorities where the law requires.

12. Children

The Service is not directed at anyone under 16 and we do not knowingly collect personal data from children. If you think a child has given us data, email support@brollbot.example and we will delete it.

13. Third-party links

Our site may link to other websites, including our social media profiles and Stripe checkout. Their privacy practices are their own and this policy does not cover them.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here and change the “Last updated” date. For material changes we will notify account holders by email or in the product before they take effect.

15. Contact and complaints

[PLACEHOLDER] BrollBot Ltd., [PLACEHOLDER] Registered address, City, Country. Email: support@brollbot.example. If you are not satisfied with our response, you can contact your local data protection authority.