The short answer

Your data is encrypted at rest, scoped to your account, never sold, and deletable on demand. We use a small set of named vendors for video gen and storage, all under enterprise data-protection contracts.

What we store

  • Account: email, phone, name, billing.
  • Brand Kit: your logo, colors, font choices.
  • Brand Brain: vector embeddings of your voice, style, hooks, audience signal.
  • Sources: OAuth tokens (encrypted) plus clip metadata (NOT the clips themselves; those stay on your source).
  • Twin Mode: enrollment recording, training artifacts, render history.
  • Renders: each video we produce for you (output URL + thumbnail).
  • Analytics: per-post performance data fetched from channel APIs.

Encryption

  • At rest: AES-256.
  • In transit: TLS 1.3.
  • Twin Mode data: separate encryption keys per user, isolated infrastructure.

Retention

  • Active accounts: data retained until cancellation.
  • Cancelled accounts: 30-day grace period, then hard deletion.
  • Twin Mode: separate 7-day soft-delete window (see Export or delete your twin).
  • Analytics: 36 months max (compliance requirement on some channel APIs).

Sub-processors

Named in our DPA: Hedra, HeyGen, ElevenLabs, Suno, Replicate, Cloudflare R2 (storage), Anthropic (LLM), Postgres (managed). Each operates under enterprise GDPR + CCPA + SOC2 contracts.

What we never do

  • Sell your data
  • Use your data to train any general-purpose model
  • Share your data with advertisers
  • Use your twin in any marketing without explicit per-render consent

Your rights

  • Access: Settings > Account > See My Data.
  • Export: Settings > Account > Export My Data.
  • Deletion: Settings > Account > Delete Account.
  • Restriction: Settings > Privacy > Pause Brand Brain Training.

Compliance

  • GDPR (EU)
  • CCPA / CPRA (California)
  • LGPD (Brazil)
  • PIPEDA (Canada)
  • SOC2 Type II (in progress, expected Q3 2026)

Related