Privacy Policy

1. Information we collect

Account information

Canviz uses Google, Apple, TikTok or Instagram for sign-in. For Google, Apple and TikTok, we receive the basic profile the provider shares with us: an account identifier, your name, your email address where available, and your avatar. Instagram sign-in supports Business and Creator accounts; we read the account identifiers, account type and profile name. We retain the identifiers needed for login and removal requests and use the profile name to display your name in Canviz. We do not request your Instagram handle or avatar for sign-in, and we discard the sign-in access token after verifying your identity. We never receive or store your password for these providers.

Content you provide

Videos you upload, links you paste, scripts, prompts and instructions you type, and the clips, captions, titles and descriptions the Service generates for you. When you paste a link to a public video, we download a copy of that video in order to process it.

Connected social accounts

If you connect a TikTok, YouTube or Instagram account for publishing, we store the access and refresh tokens those platforms issue, your account handle and avatar, and the publishing options the platform reports (for example the privacy levels your account may post with). Tokens are encrypted at rest with a dedicated AWS KMS key and are only used to publish the content you schedule and to read the status and basic performance of those posts.

Payment information

Paid plans are billed through our payment processor, Razorpay. Razorpay collects and processes your card or UPI details under its own privacy policy; we never see or store card numbers. We receive only a subscription identifier, the plan, its status, the currency and billing dates.

Usage and device information

Standard server logs, product actions and error reports help us operate and secure Canviz. Analytics run automatically and use visitor and session identifiers to connect page visits and product events, so we can understand journeys and fix confusing steps. We use the Meta pixel, the TikTok pixel and OpenAI’s ChatGPT ads pixel, with each one’s conversions API, to measure our ads. When you visit Canviz, sign up, start a checkout or pay, Meta, TikTok and OpenAI receive that event with their own browser identifiers, the ad click identifier from the link you arrived by, your IP address and browser user agent and, once you have an account, a hashed (one-way encoded) copy of your account ID. For sign-ups and payments they also receive a hashed copy of your email address; TikTok and OpenAI also receive it while you are signed in. We keep the ad click identifiers and campaign tags from the link that brought you to Canviz in a cookie and with your account, to see which ads lead to sign-ups and payments. We use PostHog to analyse how the product is used, including session recordings in which everything you type and the contents of your chats and videos are hidden. Checkout pages are never recorded. You can turn this off in Privacy preferences below or in Support. We respect Global Privacy Control and Do Not Track. With tracking off, page counts and limited performance and error measurements are collected without persistent visitor identifiers. Operational records needed to provide, secure and support the Service remain available.

We also use Gravity through Runable to measure ChatGPT ads. Gravity receives page visits, sign-ups, checkouts and payments with ad click and browser identifiers and device information. We include a hashed account ID with server events, and a hashed email address with sign-ups and payments. The same Privacy preferences, Global Privacy Control and Do Not Track choices apply.

Privacy preferences

Support requests

When you contact Support, we store the request type, description, optional context, your Canviz account identifier and contact email. Authorized team members use this information to investigate and manage your request. Please do not include passwords, access tokens or payment details.

2. How we use information

• To provide the Service: transcribe, analyse, cut, caption and render your videos, and publish the posts you schedule.
• To operate your account, enforce plan limits and process payments.
• To communicate with you about your account, your runs and scheduled posts, and changes to the Service.
• To keep the Service secure, prevent abuse and debug problems.
• To improve the product, using aggregated or de-identified information.

We do not sell your personal information and we do not use your videos, transcripts or generated content to train machine-learning models.

3. Google user data

Canviz’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Sign in with Google: we request your basic profile (name, email address, profile picture) solely to create and identify your Canviz account.
• YouTube: if you connect a YouTube channel we read its name, handle and avatar so you can identify the destination, and request permission to upload the videos you approve. We send the title, description, visibility, audience and disclosures you choose. We read the resulting video links and view, like and comment counts for videos published through Canviz, and show them in your calendar. We do not read your other videos, individual comments, subscriptions or private messages. Canviz uses YouTube API Services; by connecting YouTube you also agree to the YouTube Terms of Service and the Google Privacy Policy.

You can revoke Canviz’s access at any time from the Accounts page in Canviz or from your Google security settings. Disconnecting YouTube revokes access and removes its stored tokens, account details, video links and cached statistics. We check connections daily and remove the same data if Google reports that access was revoked. Your original files and rendered clips are kept; videos already uploaded to YouTube remain there until you delete them in YouTube Studio.

4. TikTok, Instagram and other platforms

When you connect a TikTok or Instagram account we use the permissions you grant only to publish the content you schedule and to read the status of those posts. Content is published under your account, subject to that platform’s terms and community guidelines. Disconnecting an account in Canviz deletes its tokens; you can also revoke access from the platform’s own settings.

Instagram sign-in requests basic account access only. Publishing requires a separate connection from Accounts. Removing Canviz through Instagram, or requesting Instagram data deletion, removes the Instagram login identity and Instagram profile name and ends access through it. Signing in with Instagram again creates a new Canviz identity. Your independently created projects, names entered directly in Canviz and billing records are retained until you request deletion of your whole Canviz account; contact Support about existing work or subscriptions.

5. How we share information

We share information only with service providers that process it on our behalf, and only as needed to run the Service:

• Amazon Web Services (hosting, storage, transcription, and AI models via Amazon Bedrock) in the United States.
• Razorpay for payments (card and UPI processing).
• Google, TikTok and Meta when you sign in with them or publish to them, limited to the data required for that action.
• Meta, TikTok and OpenAI, to measure our ads: page visits, sign-ups, checkouts and payments, with a hashed email address and account ID, ad click and browser identifiers, IP address and user agent, unless you turn tracking off.
• Gravity through Runable, to measure ChatGPT ads using the conversion and browser information described above, unless you turn tracking off.
• PostHog, for product analytics: product events and masked session recordings.

We may also disclose information to protect the rights and safety of Canviz or others, or as part of a merger or acquisition (in which case this policy will continue to apply to your information).

Requests from public authorities. If a government agency, court or regulator asks us for information about you, we check that the request is genuine, legally binding on us and limited in scope before responding; we push back on requests that are unlawful or too broad; we disclose only the minimum the law requires, and never your access tokens; and we keep a record of every request and our response. Unless the law prevents it, we tell you about a request before we respond.

6. Retention and deletion

• Source videos, transcripts and rendered clips are kept while your account is active so you can revisit and re-edit them. You can delete a thread and its media at any time.
• Connected-account tokens are deleted when you disconnect the account or delete your Canviz account.
• Server logs are retained for up to 14 days.
• Unused uploads expire after 30 days. Files consumed by your projects follow the account-content retention described above.
• Raw analytics events and visitor/session identifiers are retained for up to 90 days. Aggregate event totals, support requests and internal access/update audit records are retained for up to 400 days. Our own analytics is processed in our hosting environment. Meta, TikTok, OpenAI, Gravity and PostHog receive the data described above under their own terms. Backup retention is bounded separately.
• Ad click identifiers and campaign tags are kept in a cookie for up to 90 days and with your account while it is active. The browser details kept for a checkout, including the IP address, are deleted after 30 days.
• You can delete your account, including all uploaded media, generated content and tokens, by contacting Support while signed in or emailing kamalojasv2000@gmail.com. For social accounts without an email address, we verify ownership through the signed-in account or another verified support process. YouTube API data requested for deletion is removed within 7 calendar days; other account data is removed within 30 days, except for billing records we must keep for tax and accounting purposes.

7. Security

Data is encrypted in transit (TLS) and at rest. Social-platform tokens are additionally encrypted with a dedicated key and are never exposed to your browser. Access to production systems is limited to the people who operate the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise any of these rights, email kamalojasv2000@gmail.com. We will respond within 30 days.

9. International transfers

The Service is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States by the providers listed above, under contractual safeguards.

10. Children

The Service is not directed to children under 13 (or the age of digital consent where you live) and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.

11. Changes

We may update this policy from time to time. We will post the new version here and update the date above; for material changes we will also notify you by email or in the product.

12. Contact

Canviz, kamalojasv2000@gmail.com.