Vidmatic Privacy Policy

This Privacy Policy explains how Vidmatic collects, uses, shares and protects personal information, and the choices you have. Vidmatic.ai ("Vidmatic," "we," "us," or "our") is operated by FOLIOVIZ LLC, a limited liability company organized under the laws of the State of Illinois, United States.

This policy is part of, and should be read together with, the Vidmatic Terms of Service. Capitalized terms that are not defined here (such as "Service" and "User Content") have the meaning given in the Terms.

1. Who we are and what this policy covers

This policy applies to personal information that Vidmatic processes on its own behalf when you use vidmatic.ai, the Vidmatic web application, browser extensions, desktop applications, embedded recorders and players, developer SDKs and APIs, the hosted Vidmatic MCP server, and our emails and support channels (together, the "Service").

When you use Vidmatic to collect information about other people. Many customers use Vidmatic to record, share and collect feedback from their own colleagues, customers, users or audiences. When you do that, you decide what is recorded, who it is shared with and why. For that information you are responsible for giving any notice and obtaining any consent the law requires, and Vidmatic processes it on your behalf and on your instructions. If you are a viewer or participant and have a question about a recording someone else made, please contact that person or organization first.

This policy does not cover third-party websites, services or applications that you reach through the Service, or that you connect to it. Their own privacy policies apply.

2. Information we collect

We collect information in three ways: information you give us, information collected automatically when you use the Service, and information we receive from third parties.

Information you provide

• Account information. When you sign in with Google we receive your name, email address, profile picture and Google account identifier. We store your role and account status, and the settings and preferences you choose.
• User Content. The screen, camera and microphone recordings you make or upload, and everything derived from or attached to them: transcripts, AI-generated titles and summaries, narration scripts and narrated audio, thumbnails, trims, crops and other versions, comments, reactions, drawings, boards, projects, channels, contacts, inbox items and agent workstreams.
• Sharing information. The email addresses of people you invite to view a recording, and the settings you choose for a share.
• Billing information. If you buy a paid plan, our payment processor collects your payment details. We receive and keep your plan and billing status, the brand, last four digits and country of your card, and the billing name, email and country the processor provides. We never receive or store full card numbers.
• Communications. Support tickets, feedback, survey answers and anything else you send us.
• Developer and integration information. API keys you create, and the configuration of integrations you connect, such as a GitHub repository.

Information collected automatically

• Device and log information. IP address, browser and device type, operating system, referring page, pages and features used, timestamps, and error and performance data.
• Approximate location. A general location (such as country or city) that can be inferred from your IP address, including by our analytics providers. We do not collect precise geolocation.
• Viewing activity. When someone views a recording, we record that a view happened, when, how much was watched and, if the viewer is signed in, who they are. We show this activity to the recording's owner.
• Analytics. We measure how the Service is used with our own first-party page-view analytics and with Google Analytics, which is loaded through Google Tag Manager.
• Error monitoring and Session Replay. We use Sentry to detect and fix errors. Sentry's Session Replay feature records a reconstruction of page interactions (such as clicks, navigation and page structure) for a sample of sessions and for sessions in which an error occurs. Text on the page is masked and images and media are blocked by default, so replays are not intended to capture what you type or the content of your recordings.
• Terms acceptance records. When you accept the Terms, we record the version accepted, the time, your IP address and your browser's user agent.
• Payment-protection records. If you buy a paid plan, we keep, each with a timestamp: your IP address and a device identifier (a hash of basic browser settings: browser version, platform, languages, time zone, screen size and processor count) when you open checkout and when you use the Service; your IP address when you sign in; and the payment details our payment processor returns for each payment (billing name, email, phone and address, card brand, last four digits and country, and the card's verification results, such as whether the security code matched). We use these records only to prevent fraud and to answer payment disputes and chargebacks, and we share them only with our payment processor and the card networks and banks that decide a dispute. The device identifier is not used to track you on other websites.
• Cookies and similar technologies. See section 8.

Information from third parties

• Google, when you sign in (see above). If you grant it, we also store a Google refresh token, encrypted at rest, so that you can stay signed in.
• GitHub, when you connect the Vidmatic GitHub App: your GitHub account and installation identifiers, and the repositories and issues the integration reads or writes for you.
• Our payment processor, which tells us whether a payment succeeded and the status of your subscription.
• Other users, who may invite you by email, mention you, or add you to a channel, board or recording.

Biometric information

We do not collect or derive biometric identifiers or biometric information (such as voiceprints or face geometry) from your recordings. Recordings can show faces and contain voices, but the Service stores and plays them as ordinary video and audio. It does not create templates to recognize or identify a person by their face or voice.

3. How we use information

We use personal information to:

• Provide the Service: create and secure your account, record, upload, store, process, transcribe, narrate, encode and play your recordings, and deliver the features you use.
• Enable sharing and collaboration: deliver invitations and notifications, show viewing activity to owners, and route comments and feedback.
• Operate AI features (see section 5).
• Process payments and manage subscriptions.
• Communicate with you: service, security and billing messages, replies to support requests and, where permitted, product news. You can opt out of non-essential emails at any time.
• Keep the Service safe and reliable: detect, investigate and prevent fraud, abuse, security incidents and violations of the Terms, and monitor and fix errors.
• Understand, improve and develop the Service: measure usage, test features, and build new products and features.
• Comply with the law and enforce our rights: respond to lawful requests, keep records we are required to keep, and establish, exercise or defend legal claims.

4. Aggregated and de-identified data

We may create aggregated or de-identified information from the personal information we collect, so that it can no longer reasonably be linked to you. We may use and share that information for any lawful purpose, including to analyze and improve the Service and to publish statistics. We keep such information in de-identified form and do not try to re-identify it, except where the law allows us to check that our de-identification works.

5. AI features

Vidmatic uses automated and AI-assisted processing to make recordings more useful.

• Transcription, encoding and narration run on infrastructure we operate or control, including processing workers we authorize.
• Language features, such as generated titles and summaries, narration script rewriting, feedback context and GitHub issue drafts, work by sending text derived from your content (for example transcripts, narration scripts, feedback and issue drafts) to large-language-model service providers. They process it to return a result to us.
• We may use information about how the Service and its AI features are used, and de-identified data, to improve Vidmatic's own features.

We do not sell User Content, and we do not permit our AI service providers to train their general-purpose models on it.

AI output can be inaccurate. Review it before relying on it.

6. How we share information

We share personal information only as described in this policy.

• Service providers. Companies that process information on our behalf and under our instructions, bound by contract to protect it. These include cloud hosting and storage, large-language-model providers (such as OpenAI), payment processing (Stripe), transactional email delivery, error monitoring and Session Replay (Sentry), analytics (Google), and authentication (Google).
• People you share with. When you share a recording, the people you share it with can see it, along with your name and profile picture and the content you attach. A public link can be viewed by anyone who has the link, and they can pass it on. Comments and reactions are visible to others who can see the recording.
• At your direction. When you connect an integration (for example GitHub) or use our API, we exchange the information needed for it to work.
• Legal, safety and enforcement. When we believe in good faith that disclosure is needed to comply with law or legal process, to protect the rights, property or safety of Vidmatic, our users or the public, or to enforce the Terms.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, sale of assets or bankruptcy, information may be transferred as part of that transaction and will remain subject to this policy's protections.
• With your consent, or at your instruction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. Recordings you share and information about viewers

Recordings are private by default. When you make a recording public or share it, you control who can see it, and you can change or remove access at any time. Copies already downloaded, or links already passed on, are outside our control.

We record viewing activity on shared recordings and show it to the owner, so that owners know who watched and how much. If you view someone else's recording, the owner may see that you did.

If your recording includes other people, you are responsible for having any consent the law requires to record them and to share the recording. This includes telling participants when a call or meeting is being recorded.

8. Cookies and similar technologies

We use cookies, local storage and similar technologies for these purposes:

• Strictly necessary: keeping you signed in, securing your session (including an administrator verification cookie), remembering your settings, and protecting against fraud. The Service does not work without them.
• Analytics and performance: our first-party page-view analytics, Google Analytics, and Sentry error monitoring and Session Replay. These help us understand usage and fix problems.

We do not use advertising or remarketing cookies.

Your choices. You can block or delete cookies in your browser settings, although parts of the Service may then stop working. You can opt out of Google Analytics with Google's browser add-on. We honor Global Privacy Control: if your browser sends a GPC signal, our pages do not run the Google Tag Manager or Google Analytics scripts. Browsers' "Do Not Track" setting has no agreed standard, so we do not respond to it.

9. How long we keep information

We keep personal information for as long as it is needed for the purposes described in this policy, using these criteria:

• Account information and User Content are kept for as long as your account is active and you keep the content. When you delete content or your account, we delete it from our active systems. If another user has saved their own copy of a recording you shared with them, that copy and the media it relies on remain available to them until they delete it. Copies in our rolling database backups expire within approximately 14 days, and deleted video files are removed in the ordinary course.
• Terms acceptance records and security logs are kept for as long as they are needed to show what was agreed and done, to protect the Service, and to establish or defend legal claims.
• Administrator audit logs (the record of actions our staff take with administrator access) are kept for 30 days and then deleted, except entries held for a security review, which we keep until that review is finished.
• Billing records are kept for as long as tax and accounting law requires.
• Payment-protection records (the IP addresses, device identifiers and payment details described in section 2) are kept indefinitely, so that we can answer a chargeback or other payment dispute whenever one is filed and establish or defend legal claims.
• Analytics and error data are kept according to the retention settings of the relevant provider, and then deleted or aggregated.
• Email suppression records (addresses that asked not to receive our emails) are kept so that we can keep honoring the request.

We may keep information for longer when the law requires it, or to resolve disputes and enforce our agreements.

10. Security

We use reasonable administrative, technical and physical safeguards to protect personal information. These include encryption in transit (TLS), encryption of stored OAuth refresh tokens, role-based access controls, additional verification for administrative access, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account and API keys secure. If you believe your account has been compromised, contact us immediately.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and receive a copy in a portable format;
• correct inaccurate information;
• delete your information or your account;
• object to or restrict certain processing, and withdraw consent where processing is based on consent; and
• opt out of marketing emails and share-invitation emails, using the unsubscribe link in any such email.

You can view and edit much of your information, and delete your recordings, from within the Service and your account settings. To delete your account or make any other request, use our contact form.

We will verify your identity before acting on a request, and may ask for information to do so. We respond within the time the law requires. We may decline or limit a request where the law allows, for example where it would affect another person's rights, where we must keep the information for legal reasons, or where the request is manifestly unfounded or excessive. We will not discriminate against you for exercising your rights.

12. Additional information for the EEA, UK and Switzerland

FOLIOVIZ LLC is the controller of the personal information described in this policy. We rely on the following legal bases:

• Performance of a contract: to provide the Service you signed up for, including your account, recordings, sharing and billing.
• Legitimate interests: to secure and improve the Service, measure usage, prevent abuse, communicate about the Service, and establish or defend legal claims. We balance these interests against your rights, and you may object.
• Consent: where we ask for it, for example for certain cookies or optional features. You may withdraw consent at any time without affecting processing that happened before.
• Legal obligation: to keep records and respond to lawful requests.

You have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first. Please reach us through our contact form.

13. Additional information for US state residents

Residents of California and other US states with consumer privacy laws have the rights described in section 11, including the right to know, access, correct and delete personal information, and to opt out of sale, sharing for cross-context behavioral advertising, and certain profiling. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

In the past 12 months we have collected the following categories of personal information:

We do not use or disclose sensitive personal information for purposes that give rise to a right to limit its use.

You may use an authorized agent to make a request on your behalf. We may require the agent to show written permission and may ask you to verify your identity directly. We will not discriminate against you for exercising your privacy rights.

14. International transfers

Vidmatic is based in the United States, and we process and store information in the United States. Our service providers may process it in other countries. Those countries may have data protection laws that differ from the laws where you live. Where the law requires, we transfer personal information from the EEA, the UK and Switzerland using appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK addendum to them.

15. Children

The Service is not directed to children under 13, or under 16 in the EEA and the UK, and we do not knowingly collect personal information from them. Users between 13 and 18 must have a parent's or guardian's permission, as described in the Terms. If we learn that we have collected personal information from a child in violation of this section, we will delete it. If you believe a child has provided us with personal information, please tell us through our contact form.

16. Third-party services and links

The Service may link to, embed or integrate with third-party websites and services, such as Google, GitHub and Stripe. Their collection and use of information is governed by their own privacy policies, not this one. We are not responsible for their practices.

17. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version on this page and change the "Last updated" date. If a change is material, we will give you advance notice, for example by email or in the Service, before it takes effect. If you keep using the Service after a change takes effect, the updated policy applies to you. However, a material change that expands how we use personal information we collected before the change will apply to that information only with your consent, where the law requires it.

18. Contact us

If you have questions or requests about this policy or our privacy practices, including a request to access, correct, export or delete your information, contact FOLIOVIZ LLC (operator of Vidmatic.ai) using the contact form below. Your message goes privately to our team, and we will reply to the email address you give us.