Privacy policy

1. Who is responsible

The controller is XX (legal name), XX (address). To reach us about your data: XX (e-mail address).

Data protection contact: XX (name, or "the publication director").

2. What we collect

• The beta list: your e-mail address and the profile you pick (media network, brand, agency, creator or expert, other). Nothing else.
• Your account: your name, e-mail address and password. The password is stored only as a one-way hash that cannot be read back.
• Your workspace: your ideas, briefs, scripts, series, brand settings (name, logo, colours, voice, glossary, characters) and the files you upload (videos, photos, sounds). Files are stored on our server and served only to your workspace.
• Connected social accounts: when you connect a TikTok, Instagram or YouTube account, we receive an access token from the platform, the account's name and id, the videos you publish through Vertiscale and their public numbers (views, likes, comments, shares). Tokens are stored encrypted (AES-256-GCM).
• Billing: your plan, your monthly AI credit and its use. Card payments are handled by Stripe; we never see your card number.
• Technical data: the session cookie that keeps you logged in, and server logs (IP address, date, page) kept for security.
• Sign-up checks, against automated and repeated sign-ups: your browser solves a small calculation before signing up (nothing is stored), the domain of your e-mail is checked against a public list of disposable addresses and must be able to receive mail, and the connection's IP address that our sessions already record limits new accounts to a few a day. For the short video analyzer, a coded (one-way) form of that address is kept with the analysis to limit analyses per connection; the address itself is not.

3. Why, and on what legal basis

• To provide the service you signed up for (contract): your account, writing and making your videos, publishing them to the accounts you connected, showing their results.
• To tell beta members when their place opens (consent, given by joining the list; you can withdraw it at any time).
• To keep the service secure and to fix errors (legitimate interest).
• To keep invoices as the law requires (legal obligation).

We do not sell your data, we do not use it for advertising, and we do not use your content to train AI models.

4. Who receives it

We use providers that receive only what their task needs:

• Hosting of the site, database and files: XX (host's name, country).
• Anthropic (United States): writes and checks scripts and analyses video formats. Receives the text of your idea, the facts found and your brand's rules.
• ElevenLabs (United States): makes voice-overs and transcribes the recordings you turn into clips. Receives the script text or the recording's sound.
• KIE.ai (XX: country to confirm): makes the AI pictures of your videos. Receives the description of each picture.
• TwelveLabs (United States): analyses the video files you mark as your own, when you ask for a full analysis, and the short you send to the free short video analyzer. Receives that file, which is deleted from its side once the analysis is done.
• Stripe (United States, Ireland): payments, once paid plans open.
• TikTok, Meta (Instagram) and Google (YouTube): receive the videos, captions and settings you choose to publish to your own accounts, through their official APIs.

Some providers are outside the European Union. Transfers rely on the European Commission's adequacy decisions or on its standard contractual clauses. XX: list each provider's data processing agreement once signed.

We may also disclose data when the law requires it.

5. YouTube, TikTok and Instagram

Vertiscale uses the YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's Privacy Policy applies to what Google does with your data.

We use the access you give only to upload the videos you schedule, read their status and read the public numbers of those videos and of the channels you choose to follow. We keep these numbers while your account exists and delete them with it.

You can disconnect an account at any time from the accounts page of the studio, which deletes its token from Vertiscale. For Google, you can also remove the access from your Google security settings. TikTok and Instagram offer the same in their own app settings.

6. The free tools

The free tools run in your browser: the files you check are not sent to us. The auto-subtitles tool downloads its open-source speech model to your browser from jsDelivr and Hugging Face, which see your IP address like any website you visit; your recording stays on your device.

One tool is different: the short video analyzer. It needs a free tools account (your name, e-mail and password, kept to run the account; it gives no access to the studio). The short you send is uploaded to our server, measured there, sent to TwelveLabs for the analysis and deleted from both sides right after; we keep only the result, shown on your account, and its cost. One analysis per account.

7. Cookies and storage on your device

Vertiscale uses only the cookie needed to keep you logged in. There is no advertising or audience-measurement cookie, so no consent banner is needed.

Your browser may also keep a few conveniences on your device (for example a draft being written). You can clear them in your browser at any time.

8. How long we keep it

• The beta list: until your place opens or until you ask us to remove you, and at most XX months.
• Your account and workspace: while your account exists. After you close it, we delete it within XX days, except invoices, which French law requires us to keep for 10 years.
• Backups: the database is copied every night and each copy is deleted after 14 days; files after 7 days.
• Server logs: XX days.

9. Your rights

You can ask to access, correct or delete your data, to receive it in a portable format, to limit or object to its use, and to withdraw your consent. Write to XX (e-mail address); we answer within one month.

If you think your rights are not respected, you can complain to the CNIL (cnil.fr).

10. Security

Passwords are hashed, platform tokens are encrypted, files are served only to their workspace, and the site is served over HTTPS. No system is perfectly safe: if a breach put your data at risk, we would tell you and the CNIL as the law requires.

11. Changes

If we change this policy in a way that matters, we will tell you by e-mail before it applies. The date at the top shows the latest version.