Privacy Policy

1. Information we collect

Account information: your email address and sign-in identifiers, collected through our authentication provider when you create or use an account.

Your content: videos you upload for captioning, the job settings you choose, and the rendered results, stored temporarily so we can provide the Service.

Billing information: payments are processed by Stripe. We do not receive or store full card numbers. We store a Stripe customer identifier, your purchases, and your credit balance.

API credentials and usage: API keys you create are stored only as hashes. We keep records of API usage, such as jobs submitted, minutes processed, and balance changes.

Usage and device information: IP address, browser and device type, and request and error logs, used to operate, secure, and improve the Service. We use Cloudflare Web Analytics, which is cookieless and reports traffic in aggregate.

Communications: messages you send us, such as support emails.

2. How we use information

We use personal information to: provide, maintain, and improve the Service; create and authenticate your account; transcribe and render your videos; process payments and manage your credit balance; send service messages such as receipts, account notices, and replies to your requests; prevent fraud, abuse, and security incidents; understand how the Service is used in aggregate; and comply with legal obligations and enforce our Terms.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your videos to train AI models. Our transcription provider processes audio under a contractual no-training arrangement.

3. Legal bases (EEA, UK, and Switzerland)

Where these laws apply, we rely on: performance of our contract with you (to provide the Service and process payments); our legitimate interests (to secure, understand, and improve the Service, balanced against your rights); compliance with legal obligations (such as tax and accounting records); and your consent where required, which you can withdraw at any time.

4. Cookies and similar technologies

We use cookies that are necessary for the Service to work, such as keeping you signed in (set by our authentication provider) and protecting against fraud during checkout (set by Stripe). We do not use advertising cookies or third-party advertising trackers, and our analytics are cookieless. You can control cookies through your browser settings, but blocking necessary cookies may stop sign-in or checkout from working.

5. How we share information

We share personal information only with service providers that process it on our behalf under contracts that limit their use of it: Clerk (authentication), Neon (database hosting), Stripe (payments), Cloudflare (hosting, storage, queues, and video rendering), Deepgram (speech-to-text, with model training on customer audio disabled), and our transactional email provider.

We may also share information to comply with law or valid legal process, to protect the rights, safety, and property of our users, us, or others, or as part of a merger, acquisition, financing, or sale of assets, in which case this policy will continue to apply to your information or you will be notified.

6. International transfers

We are based in the United States, and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or our providers' certifications to protect information transferred from the EEA, UK, or Switzerland.

7. Data retention and deletion

Rendered results are deleted 24 hours after a job finishes, and uploaded source videos are deleted automatically within 30 days. Account and billing records are kept while your account is active and afterwards as required for tax, accounting, and legal purposes. When you delete your account, we delete or anonymize your personal information within a reasonable time, except for information we must keep by law and routine backups, which expire on their own schedule.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to opt out of the sale or sharing of personal information (we do not sell or share it for advertising). To exercise any of these rights, email support@caption.sh. We may need to verify your identity before acting. You may also complain to your local data protection authority.

9. Security

We use encryption in transit, hashed API key storage, and access controls to protect personal information, and we limit retention as described above. No system is perfectly secure; if we learn of a breach that affects you, we will notify you as the law requires.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email support@caption.sh and we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version here and update the "Last updated" date, and for material changes we will give reasonable notice, such as by email or in the dashboard.

12. Contact

Canna Holdings LLC, North Carolina, United States. Questions about this policy or your information: support@caption.sh.