Privacy Policy

1. Controller and contact

OTOZOE operates this service and determines how service data is processed. Privacy and data-rights requests may be sent to support@otozoe.com. Legally required operator details are provided by email without undue delay when requested before purchase.

2. Data we process

• Email address, account and authentication identifiers, session status, plan, entitlement, and usage balance
• Basic properties of a video selected on your device, such as format, size, and duration
• Representative still frames and extracted, compressed audio created in your browser for analysis
• A temporary transcript, scene and motion signals, speech intervals, candidate tracks, arrangement settings, and other derived analysis results
• Music events such as shown, previewed, selected, exported, and rejected, including track ID, track version, candidate rank, arrangement mode, and time
• Billing identifiers and subscription status received from Paddle, but not full payment-card details
• IP address, request metadata, browser/device information, security events, errors, and service logs that may be processed by OTOZOE or its infrastructure providers

3. Purposes

• Authenticate users and deliver sign-in links
• Analyze whether and how BGM should be added while keeping speech intelligible
• Provide previews and exports, manage plan limits, prevent duplicate consumption, and diversify recommendations
• Manage subscriptions, customer support, refunds, security, abuse prevention, troubleshooting, and service improvement
• Comply with legal obligations and establish, exercise, or defend legal claims

4. Video processing

The original video remains on your device for playback, editing, and export. OTOZOE does not upload the complete original video to its analysis server or external AI provider and does not store it in the OTOZOE database. The browser creates representative frames and an extracted, compressed audio file and sends only those analysis inputs to the server and OpenAI.

The compressed audio is sent for transcription. The temporary transcript and representative frames are then used for visual and story understanding; audio may also be classified when the existing signals require it. OTOZOE does not store the representative frames, extracted audio, or transcript text in its database. The database may retain the analysis request status and derived result without transcript text. A cached derived result may remain in your browser until site data is cleared.

5. Providers

• Cloudflare: application hosting, content delivery, security, and operational request logs
• Supabase: authentication, account, entitlement, usage, analysis status, and music-selection history
• Resend: delivery and operational records for authentication email
• OpenAI: transcription and analysis of representative frames, extracted compressed audio, and the temporary transcript
• Paddle: Merchant of Record for checkout, payment, tax, subscription, refund, and customer-portal processing

These providers may process information in countries other than yours under their contracts, policies, and applicable safeguards. OTOZOE does not sell personal data.

6. Payment data

Paddle is the Merchant of Record for Creator purchases. Paddle collects and controls payment-card and checkout information under its own buyer terms and privacy notice. OTOZOE receives only the customer, subscription, transaction, price, status, billing-period, and adjustment identifiers needed to provide and manage Creator access.

7. Retention and deletion

Original videos and AI input media are not retained in the OTOZOE database. Account, entitlement, usage, derived analysis, selection-event, support, billing, security, and operational records are kept only as needed to provide the service, enforce limits, prevent abuse, resolve disputes, and meet legal obligations.

Current limitation: fixed production retention periods for each record category have not yet been finalized in code or policy. They will be documented before public paid launch rather than estimated here. Provider-side logs and transaction records follow the provider’s applicable retention obligations. You may request account or personal-data deletion at support@otozoe.com; some records may need to be retained where law or legitimate dispute-prevention needs require it.

8. Legal bases and disclosure

Depending on your location, processing is based on performance of the service contract, legitimate interests in secure operation and improvement, consent where required, and compliance with law. Information is disclosed only to the providers above, when you direct us, in a business succession subject to appropriate safeguards, or when law requires it.

9. Security

OTOZOE uses encrypted transport, access controls, row-level database rules, server-only secrets, webhook signature validation, and usage idempotency as reasonable safeguards. No online service can guarantee absolute security.

10. Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, or portability and may withdraw consent where processing relies on consent. Requests should be sent to support@otozoe.com. We may verify your identity before responding. Browser-cached data can be removed by clearing this site’s data.

11. Children

People who cannot legally consent must use OTOZOE only with consent from a parent or legal guardian. Do not submit sensitive content about a child without all authority and permissions required in your location.

12. Changes

We may update this policy as the product, providers, or law changes. We will identify the effective version and give prominent notice of material changes when required.