Privacy Policy

1. Who we are and what this policy covers

Vidorio ("Vidorio", "we", "us", or "our") provides the video creation and publishing service available at vidorio.com. This policy covers the Vidorio website, account, workspace, creation and editing tools, billing features, support, and optional connections to third-party platforms.

For purposes of the EU General Data Protection Regulation (GDPR) and applicable Czech data-protection law, Vidorio is the controller of the personal data described here unless another notice says otherwise. Contact us at vidoriocom@gmail.com.

2. Information we collect and receive

Account and authentication data

When you sign in by email, we process the email address, one-time authentication challenge, account and session identifiers, and security timestamps needed to authenticate you. If you use Google sign-in, Google provides your email address and basic profile details such as name and profile image, where available. We do not receive your Google password.

Profile, workspace, and collaboration data

We store profile settings, workspace ownership, projects, preferences, plan and credit state, saved presets, favorite voices, synchronization records, and related account settings. For team features we process owner and member names or emails, invitation and acceptance records, membership, seat billing references, collaboration presence, and changes made to shared projects.

Content and media

We process the prompts, ideas, scripts, narration, generated audio, transcripts, subtitles, search terms, selected stock, uploaded video, images and audio, generated visuals, thumbnails, presets, timeline edits, publishing fields, project backups, export inputs and results, and other material you submit or create through Vidorio ("Your Content"). Content may include personal data about you or other people, so upload it only when you have an appropriate reason and permission.

Billing and transaction data

Stripe processes payment-card details. Vidorio does not store full card numbers. We keep Stripe customer, checkout, invoice, subscription, and payment identifiers; plan, billing interval, credit and seat records; transaction history; cancellation or scheduled-change status; and limited payment-method details such as card brand and last four digits when Stripe provides them.

Connected-platform data

If you connect YouTube, TikTok, Facebook, or Instagram, we receive the identifiers, display names, handles, avatars, channel, Page, or professional-account details, creator settings, permissions, access and refresh tokens where provided, expiry information, selected destination, and publishing status needed for that connection and the actions you request.

Usage, device, and security data

We process information such as IP address, request and event timestamps, browser and device characteristics, pages or features used, session activity, credit and job events, performance information, diagnostics, crash or error details, and abuse or security signals. Some editor state and media cache are stored locally on your device as described below.

Communications

If you contact support, submit feedback, respond to an invitation, or otherwise communicate with us, we process your contact details, message, attachments you choose to send, and the related support or delivery records.

Where this information comes from

We receive information from you and your device, from authorized members or owners of a shared workspace, and from services you choose to use with Vidorio, including Google, Stripe, connected social platforms, stock providers, and model providers.

3. Why we use personal data and our legal bases

• Provide the Service. Authenticate users; create, save, synchronize, render, export, and publish projects; manage workspaces, members, credits, plans, support, and connected profiles. Legal basis: performance of our contract with you or steps you request before entering it.
• Process billing. Complete purchases, administer renewals and seat charges, issue transaction and invoice records, prevent payment fraud, and keep legally required accounting records. Legal basis: contract and legal obligation.
• Keep Vidorio reliable and secure. Detect abuse, protect accounts, investigate errors, recover jobs, maintain availability, enforce terms, and improve performance and usability. Legal basis: our legitimate interests in operating and protecting the Service and its users.
• Communicate. Send one-time codes, workspace invitations, billing or service notices, support responses, security messages, and product communications where permitted. Legal basis: contract, legitimate interests, legal obligation, or consent, depending on the message.
• Comply with law and protect rights. Respond to lawful requests, maintain required records, resolve disputes, and establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we consider the purpose, necessity, and effect on your rights. Where processing is based on consent, you may withdraw that consent without affecting processing already carried out.

4. AI and generated-content processing

When you request an AI feature, Vidorio sends the instructions, relevant project context, media, voice or model settings, and other input needed to model gateways or providers. Depending on the selected feature, those providers may include services such as OpenRouter, OpenAI, fal.ai, and the model provider selected through a gateway. We receive and store the resulting text, audio, transcript, image, timing, or metadata as part of your project or requested job.

We limit the request to information reasonably needed for the feature. Vidorio does not sell Your Content and does not use it to train Vidorio's own generalized models. A third-party provider processes request data under its applicable terms, configuration, and our arrangements with it. Do not place special-category, highly confidential, or unnecessary personal data in prompts or uploads. Connected Google, YouTube, TikTok, Facebook, or Instagram account data is not used to train generalized AI models.

5. Google sign-in and connected publishing platforms

Connecting a publishing platform is optional. A connection begins only after you select it and approve the platform's authorization screen. Vidorio uses the resulting data to identify the connected destination, load the settings needed for a valid submission, transmit the video and metadata you choose, and show processing or publishing status.

• Google sign-in. We use the basic Google profile data you approve to create or access the matching Vidorio account.
• YouTube. We use authorized Google and YouTube data to identify the channel and upload or schedule only the video and metadata you intentionally submit. Vidorio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• TikTok. We use the authorized TikTok profile, creator settings, permissions, privacy options, tokens, and status information needed to display the connection and publish only a submission you approve.
• Facebook and Instagram. We use the permissions and Meta account, Page, or professional-account data needed to display the selected destination and publish only content you approve.

Vidorio does not use connected-platform data for targeted advertising, sell it, or publish an unsolicited post. If you explicitly schedule a supported post, the platform may release it at the time you selected. Disconnecting stops future use of that connection but does not delete content already published to the platform.

6. How we share data

We disclose personal data only as needed for the purposes described in this policy:

• Infrastructure providers that supply cloud hosting, databases, object storage, queues, content delivery, monitoring, and related technical operations.
• Stripe for checkout, payment processing, subscriptions, invoices, and fraud prevention.
• Google and email-delivery providers for authentication, one-time codes, invitations, and service messages.
• AI gateways and model providers for the generation, transcription, voice, image, or other processing you request.
• Pixabay, Jamendo, and similar media providers when you search, preview, or retrieve third-party assets.
• YouTube, TikTok, Facebook, and Instagram when you connect an account or send a chosen publishing package.
• Workspace owners and members who are authorized to access a shared workspace and its content.
• Advisers, authorities, or transaction participants where reasonably necessary to comply with law, protect rights or security, resolve a dispute, or complete a reorganization or transfer subject to appropriate safeguards.

Providers may process data as our processors, independent controllers, or both, depending on the service. We do not sell or rent personal data and do not share it with data brokers for behavioral advertising.

7. Cookies, local storage, and device cache

Vidorio uses an essential session cookie and similar security mechanisms to keep you signed in and protect authenticated requests. The editor also uses browser local storage, IndexedDB, memory, and media caches to preserve workspace state, preferences, upload progress, and working media on your device. These technologies are needed for account, synchronization, editing, export, and publishing functions; blocking or clearing them can sign you out or remove unsynchronized local work.

Vidorio does not use this essential browser storage to sell personal data or build third-party advertising profiles. Server-side diagnostic and usage records may still be processed for the purposes described in this policy.

8. How long we keep data

• Accounts and projects. We generally keep account, workspace, project, upload, and settings data while the account remains active and until you delete it or ask us to do so. Cancelling a paid plan does not by itself delete projects or uploaded library media. Paid plans retain a limited number of project recovery backups for up to 30 days; Free accounts do not retain server-side project recovery backups.
• Generated jobs and exports. Job records may be kept to operate, recover, bill, and troubleshoot a request. A completed server-rendered MP4 is normally removed about one hour after completion, whether or not it has been downloaded, so save files you need promptly.
• Platform connections. Connection records and tokens are kept until you disconnect the platform in Vidorio, delete the account, we remove them in response to a verified request or platform event, or they are otherwise no longer needed. Revoking access at the platform prevents future authorized use but may leave a Vidorio connection record until you also disconnect or request deletion.
• Authentication and security. One-time challenges, sessions, technical logs, abuse signals, and security records are retained for limited periods appropriate to their purpose.
• Billing and legal records. Transaction, invoice, tax, fraud-prevention, audit, and dispute records are kept for the period required or permitted by applicable law.
• Deletion and backups. When data is deleted, limited residual copies may remain temporarily in protected backups or logs until overwritten or no longer needed. We may retain or anonymize information where required for legal compliance, security, fraud prevention, disputes, or enforcement.

9. Your account and platform controls

You can permanently delete your Vidorio account in account settings by requesting an email code, entering it, and confirming the final warning. In-app deletion removes the account and associated server-side workspace data, signs out account sessions, clears the current browser's primary saved Vidorio workspace record, and cancels active Vidorio subscriptions tied to that account. Some browser media caches may remain until the browser clears them or you remove vidorio.com site data. You may also request deletion by emailing vidoriocom@gmail.com from the account address. Review the Data Deletion Instructions before proceeding.

To remove only a connected platform, disconnect it in Vidorio. You can also revoke access in Google Account connections, TikTok's connected-app settings, or Facebook and Instagram app settings. Revocation prevents future access but does not necessarily erase data already held by Vidorio, so use the in-app disconnect or deletion request when you also want Vidorio's stored connection removed. Posts already published remain with the platform until you manage them there.

10. International data transfers

Some providers may process data in countries outside the European Economic Area. Where EU data-protection law applies and a transfer requires safeguards, we use or require an applicable lawful transfer mechanism, which may include an adequacy decision or approved Standard Contractual Clauses. Connected platforms and providers may also process data under their own privacy notices.

11. Your privacy rights

Depending on applicable law and the circumstances, you may have rights to be informed; access and receive a copy of your personal data; correct inaccurate data; request erasure or restriction; object to processing based on legitimate interests or direct marketing; receive portable data; and withdraw consent. These rights can have legal exceptions.

To exercise a right, email vidoriocom@gmail.com from the relevant account address and describe your request. We may request reasonable information to verify identity and will respond within the deadline required by applicable law. You may also complain to your local supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection.

12. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, authenticated sessions, access controls, server-side storage of social tokens, and established infrastructure providers. Stripe handles full payment-card numbers. No internet service or storage method is completely secure, so keep control of your email account and device, never share one-time codes, and contact us if you suspect misuse.

13. Children

Vidorio is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has provided personal data through Vidorio, contact us so we can investigate and take appropriate action.

14. Changes to this policy

We may revise this policy when the Service, providers, law, or our data practices change. The current version will be posted here. If a change is material, we may also provide notice in the Service or by email where appropriate or required.

15. Contact

Questions, privacy requests, or concerns about this policy? Email vidoriocom@gmail.com.