Privacy Policy

The data controller is [LEGAL COMPANY NAME], [address], [country]. Privacy contact: [privacy@your-domain.com]. If we appoint a Data Protection Officer, their contact details will be published here.

• Account data: name, email, password hash, role, plan, login timestamps, 2FA status.
• Billing data: Stripe customer ID, subscription ID, plan, payment status, invoice events, cancellation dates.
• Uploaded content: videos, audio, thumbnails, transcripts, captions, hooks, exports, project settings, brand assets.
• Usage data: uploads, renders, AI token usage, storage usage, queue status, errors, device and browser metadata.
• Security logs: IP address, user agent, login events, failed login attempts, session revocations, admin actions.
• Support/legal data: messages you send us, copyright complaints, abuse reports, and verification data.

• To create accounts, authenticate users, manage sessions, and secure the Service.
• To process videos, generate transcripts, hooks, highlights, captions, covers, and exports.
• To provide subscriptions, invoices, cancellation, and plan limits through Stripe.
• To prevent fraud, abuse, excessive costs, attacks, and unauthorized use.
• To provide customer support, legal compliance, tax/accounting records, and service notices.
• To improve reliability, performance, product quality, and error recovery.

• Contract: account creation, login, billing, video processing, exports, and support.
• Legitimate interests: security, abuse prevention, service analytics, debugging, fraud prevention, and business operations.
• Legal obligation: tax, accounting, consumer, court, law enforcement, and regulatory obligations.
• Consent: optional marketing, non-essential cookies, or optional features where consent is required.

We may use processors for hosting, database, storage, email, payments, AI processing, analytics, monitoring, and support. Current categories include Supabase/PostgreSQL, Cloudflare R2, Stripe, OpenAI or compatible AI providers, Upstash/Redis, email providers, and deployment infrastructure. Some providers may process data outside the EEA. Where required, we rely on appropriate safeguards such as Data Processing Agreements, Standard Contractual Clauses, adequacy decisions, or equivalent transfer mechanisms.

Uploaded videos may be converted into audio, frames, transcripts, captions, highlight candidates, and rendered clips. These assets may be sent to AI providers only as needed to provide requested features. Do not upload sensitive personal data, confidential third-party data, children data, health data, biometric data, or content you are not authorized to process.

• Account data is kept while your account exists and for a reasonable period after deletion when required for legal, tax, security, or dispute purposes.
• Raw uploaded videos are scheduled for deletion after 48 hours from upload to reduce storage cost and privacy risk.
• Processed videos, highlights, exports, and generated assets are kept while projects remain active, unless deleted by you or expired by lifecycle rules.
• Billing records are kept as required by tax, accounting, fraud, and payment rules.
• Security logs and audit logs are kept for abuse prevention, investigation, and legal defense.

Depending on your location, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about processing. You may also lodge a complaint with your supervisory authority. For Romania, the authority is ANSPDCP. Contact us at [privacy@your-domain.com].

We use technical and organizational measures such as password hashing, secure cookies, origin checks, rate limits, admin-only controls, audit logs, storage limits, signed URLs, and restricted service credentials. No online service can guarantee absolute security.

MegaX is not intended for children under 16. Do not upload videos of minors unless you have all required legal authority, consent, and platform rights.