Privacy Policy

Controller and contact

Vexel is the controller of your personal data. For anything about privacy, write to privacy@vexel.video.

What we collect

• Account data: email address, name if you give one, studio name and role, sign-in records.
• Your content: projects, scripts, prompts, uploads, references, voices and generated media.
• Billing data: plan, credit balance and history, invoices. Card details are handled by Stripe; we never see or store them.
• Usage and technical data: the jobs you run, their cost and status, connected apps, IP address and browser information in server logs, error reports.
• Messages you send to support.

Why we use it and on what legal basis

We do not sell your data and we do not use your content to train AI models.

• To provide Vexel and do what you ask (run generations, store projects, sign you in): performance of our contract with you (GDPR art. 6(1)(b)).
• To bill you and keep accounting records: contract and legal obligation (art. 6(1)(b) and (c)).
• To keep Vexel secure, prevent abuse and fix errors: our legitimate interest (art. 6(1)(f)).
• To send service emails such as sign-in codes and important changes: contract. We send marketing only if you agree, and you can unsubscribe at any time.

Who we share it with

We use service providers that process data for us under data processing agreements:

• Hosting and infrastructure: Amazon Web Services (EU, Frankfurt), Supabase (database and sign-in, EU, Frankfurt), Vercel (web hosting).
• Email: Amazon SES.
• Payments: Stripe.
• AI model providers, only for the jobs you run, receiving the prompts and media that job needs: for example BytePlus (Seedance, Seedream), Google Cloud Vertex AI, fal, ElevenLabs and Sync Labs, and Anthropic for the Director assistant.
• Error monitoring: Sentry, when enabled.
• Apps you connect yourself (such as ChatGPT) receive what you ask them to do with Vexel, under their own privacy policies.

Transfers outside the EU

Some providers process data outside the European Economic Area, for example in the United States or Singapore. Such transfers rely on an adequacy decision (including the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

How long we keep it

• Account data and content: while your account exists. After you ask for deletion we delete it within 30 days; backups roll over within a further 30 days.
• Billing records: as long as Romanian accounting law requires (currently up to 10 years).
• Server logs and error reports: up to 90 days.

Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its use, and withdraw consent you gave. Write to privacy@vexel.video; we answer within one month. You can also complain to the Romanian data protection authority, ANSPDCP, or the authority where you live.

Security

Data is encrypted in transit and at rest, access to it is restricted per studio by database rules, and media is delivered through short-lived signed links.

Children

Vexel is not meant for anyone under 18 and we do not knowingly collect their data.

Changes

We will post updates here and tell you about important changes by email or in the app.