Privacy Policy

1. Controller

Controller: BLACKBOX CHANNELS LLC, which operates Vexels. For any privacy question or to exercise your rights, write to soporte@vexels.app.

2. What data we process

• Account data: your email (it is how you sign in), your name if you give it to us, your language and notification preferences, and the dates you signed up and last signed in.
• Acceptance of the terms: which version you accepted, when and in which language.
• If you join the waiting list: your email, your channel, the language and the note you write.
• Your content: the titles and scripts you write, the videos you order and your channel settings. A script may contain personal data if you write it in; please do not include unnecessary data about third parties or sensitive data (health, beliefs, etc.).
• Service usage: your credit history, the videos ordered and their status, and what you tell us about a video (stars, whether you would publish it and the scenes you flag as "doesn't fit").
• Payments: what Stripe tells us (subscription status, plan, amounts, billing country and the last digits of the card). Only Stripe handles the full card number.
• Desktop app (Vexels Echo 1): the name and system of your linked computers, the app version and usage information needed for licensing. If you save API keys on the website, we receive and store them encrypted so we can deliver them to your linked app or test them. Titles, scripts and settings submitted through the website also reach our servers; locally generated video files are not uploaded unless you use a feature that says otherwise.
• Technical data: IP address, browser, and access and error logs of our servers, for security.
• If you use a real person's face in an avatar: the photo (without its metadata) and the consent declaration with its text, the date, your account and, when available, the IP address you signed it from. They are deleted when you delete the avatar or your account, and with them the videos made with that face (see "Synthetic content").
• If you write to us: your email and what you tell us.

3. Purposes and legal bases

• Giving you access, making and delivering your videos, managing your credits, subscription and app, and supporting you: performance of the contract (Art. 6(1)(b) GDPR).
• Charging, invoicing and meeting tax and accounting obligations: legal obligation (Art. 6(1)(c)) and performance of the contract.
• Security, preventing fraud and abuse, and enforcing the terms (for example, reviewing a reported video): legitimate interest (Art. 6(1)(f)).
• Improving image verification with what you flag as "doesn't fit" and with your feedback: legitimate interest. You can object by writing to us.
• Telling you when there is room if you join the waiting list: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Notices about your account and your videos (for example, that a video is ready or about to expire): performance of the contract; you can switch off the non-essential ones in Account.
• We do not sell your data, we do not advertise with it, we do not make automated decisions that produce legal effects on you, and we do not use your scripts or videos to train AI models.

4. Who it is shared with (processors)

To provide the service we use providers that process data on our behalf, under their data processing agreements (DPAs). Each receives only what its task needs; AI providers receive the text of the script or of a scene and the candidate images, not your email or your account data.

• Anthropic (USA): text AI provider. It receives the script text.
• Z.ai, by Zhipu AI (China): vision AI provider. It receives excerpts of the script text and images.
• Google (USA): text AI provider. It receives excerpts of the script.
• Text-to-speech provider (depending on voice and language: ElevenLabs, Inworld, MiniMax or Algrow; inside and outside the EEA): turns the narration into audio. It receives only the narrated text.
• Supabase (servers in the EU, in France; US company): database of accounts, credits and settings.
• Cloudflare (USA, global network): storage of videos for download, network and email for our domain.
• Vercel (USA): website hosting.
• Stripe (USA and Ireland): payments and invoicing. It also processes payment data as an independent controller, under its own policy.
• Resend (USA): sending sign-in and notification emails. It receives your email address and the content of the notice.
• To find images we query licensed image libraries and archives with words taken from your script, never with your account data.
• Network and video-footage retrieval providers (for the excerpts from publicly available third-party videos described in the Terms, section 9). They receive only short search queries derived from your script, public video identifiers, the time ranges being cut and the IP address of our servers. They never receive your script, your name, your email or any data from your account. The queries may contain names of people, places or organisations mentioned in your script; if you do not want them sent, switch off third-party footage in the order.
• Webshare (USA): network provider (outbound addresses, "proxies") through which those queries and downloads travel.
• Oxylabs (Lithuania, EU): video download service. It receives the public video identifier and the time range.

5. Transfers outside the European Economic Area

• Several providers are in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider participates and, otherwise, on the European Commission's standard contractual clauses included in its processing agreement.
• Z.ai is in China, a country without an adequacy decision from the European Commission. To reduce the risk, it only receives the text of each scene and the candidate images, never your account data. The transfer relies on the provider's contractual safeguards where offered and, failing that, on it being necessary to provide the service you request (Art. 49(1)(b) GDPR). That is why we ask you not to write personal data about third parties in your scripts.
• Some voice providers may process the narrated text outside the EEA with the same safeguards.
• You can ask us for more information about these safeguards at the contact address.

6. How long we keep it

• Your account and its data: as long as you have it. When you delete it, your data, channels and videos are deleted; database backups roll over within at most 30 days.
• Finished videos: 30 days from delivery, then deleted automatically (the video page shows the date).
• The script, media and technical report of each video: deleted with the video and at the latest after 90 days.
• The record of which third-party works were used (to credit them and handle takedowns): kept, without your script.
• The waiting list: until you join or ask to leave.
• Technical access and error logs: up to 30 days, unless needed to investigate an incident.
• Payment and invoicing data: for as long as tax and accounting law requires.
• The record of which terms you accepted: while your account exists and, afterwards, for as long as needed to handle claims.

7. Your rights

You can access, rectify and erase your data, restrict or object to its processing, take it with you (portability) and withdraw your consent at any time, without affecting what was done before.

From Account you can download all your data in a file and delete your account. For everything else, write to soporte@vexels.app; we reply within one month at the latest. We may ask you to confirm that it is you.

If you think we are not handling your data properly, you can complain to the data protection authority of your country (in Spain, the Agencia Española de Protección de Datos, aepd.es). We would appreciate it if you wrote to us first so we can try to fix it.

8. Security

Everything travels encrypted (HTTPS). Sign-in links and sessions are stored only as a fingerprint (hash), not in clear; database access is restricted to the server; and videos are served only to their owner. No system is infallible: if there is a breach that affects you, we will tell you as the law requires.

9. Minors

Vexels is not intended for anyone under 18 and we do not knowingly process their data. If you believe a minor has given us data, write to us and we will delete it.

10. Changes

If we change this policy in an important way (for example, a new processor that receives your script), we will say so here with the new date and tell you before it applies.