Privacy Policy

Last updated: 24 September 2026. Draft for review by counsel before launch.

This Privacy Policy explains how Mark-It, Inc. ("Mark-It", "we", "us"), a Florida corporation, collects, uses and shares personal data when you visit vidsfor.me, use the VidsFor.me application at app.vidsfor.me, or contact us. Mark-It is the data controller for this data. Contact: support@vidsfor.me.

1. What we collect

Website (vidsfor.me)

Forms. When you request access or contact us: name, email, company, role, what you make, expected volume, your message, whether you opted in to product emails, the page you were on, any campaign (UTM) parameters, and a one-way hash of your IP address used to limit abuse.
Analytics. Cookieless, aggregated page-view analytics from Vercel (no cookie, no cross-day identifier). If you accept analytics cookies, Google Analytics 4 also collects device, browser, approximate location and page-interaction data, with IP anonymisation.
Cookies. Listed on our cookies page.

Application (app.vidsfor.me)

Account. Email, name, sign-in method (password or Google), workspace and role.
Provider API keys you connect. Encrypted with a per-key data key wrapped by a master key held in a vault; decrypted only on our servers for the specific call that needs them; never shown after entry. Every read of the master key is logged.
Content. Files you upload, prompts, scripts, product information and links, generated outputs, edits and exports. This may include images or recordings of real people you have permission to use, and voice clones you have permission to make.
Consent records. When a real person's face or voice is used, who confirmed consent, for whom and when.
Usage and logs. Jobs, models, costs reported by providers, feature use, errors, security and audit logs, IP address and device information.
Billing. Handled by Stripe; we store your plan, subscription status and Stripe customer id, not full card numbers.
Support. Messages you send us.

We do not knowingly collect data from children under 16.

2. Why we use it and our legal bases

| Purpose | Data | Legal basis (GDPR/UK GDPR) | |---|---|---| | Provide the Service, run your jobs with your provider keys, store your content | Account, keys, content, usage | Contract (Art. 6(1)(b)) | | Respond to access requests and messages; send your invite | Forms | Contract / legitimate interest | | Product-update emails | Email, name | Consent (Art. 6(1)(a)); withdraw any time via the unsubscribe link | | Security, abuse prevention, rate limiting | IP hash, logs | Legitimate interest (Art. 6(1)(f)) | | Keep consent records for real people's likeness and voice | Consent records | Legitimate interest and legal obligation | | Improve the Service and understand how the site is used | Analytics | Consent for GA4; legitimate interest for cookieless analytics | | Billing, tax, accounting | Billing | Contract and legal obligation | | Comply with law and enforce our Terms | Any | Legal obligation / legitimate interest |

3. Sharing

We share personal data only with:

AI providers you connect (for example Higgsfield, OpenAI, Google, fal.ai, ElevenLabs, Anthropic, OpenRouter, Photoroom). Your prompts, uploaded files and scripts are sent to them to generate outputs. Their handling is governed by their own terms and privacy policies; you choose which providers to connect.
Ad platforms you connect (Meta, TikTok), only when you push ads or import performance data, under your own advertiser account.
Processors that run the Service under contract: Vercel (hosting, cookieless analytics), Supabase (database and authentication), Cloudflare (storage and bot protection), Resend (email), Stripe (payments), Google (analytics, only with consent).
Authorities when required by law, and successors in a merger or acquisition, under this policy.

We do not sell personal data and do not share it for cross-context behavioural advertising.

4. International transfers

We are based in the United States and our processors operate globally. Where data of people in the EU, UK or Switzerland is transferred outside those areas, we rely on Standard Contractual Clauses (and the UK Addendum) or the EU-US Data Privacy Framework where a recipient is certified, plus appropriate safeguards. Copies are available on request.

5. Retention

Website form data: until you ask us to delete it or 24 months after your last interaction, whichever is sooner.
Account and content: for as long as your workspace exists. After you delete a workspace or we terminate it, content is deleted within 30 days from live systems and within 90 days from backups.
Provider keys: deleted immediately when you remove them or the workspace.
Consent records and audit logs: 5 years, because they evidence permission and security events.
Billing records: as required by tax law (typically 7 years).

6. Your rights

EU/EEA and UK. You can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time. You may complain to your local supervisory authority (in the UK, the ICO). We do not make decisions with legal effect based solely on automated processing.

California and other US states (including the Florida Digital Bill of Rights). You can ask what personal data we collect and why, request deletion or correction, and opt out of sale or sharing (we do not sell or share). We will not discriminate for exercising these rights. You may use an authorised agent.

To exercise any right, email support@vidsfor.me from the address on your account. We verify requests and respond within 30 days (45 for some US requests), extendable where the law allows.

7. Security

Encryption in transit (TLS) and at rest; envelope encryption for provider keys with a vault-held master key; row-level security in our database so workspaces cannot see each other's data and projects cannot reference each other's files; least-privilege access; audit logging. No system is perfectly secure; tell us at support@vidsfor.me if you find a vulnerability.

8. Cookies and similar technologies

See the cookies page for every cookie, its purpose and duration, and to change your choice. Non-essential cookies load only after consent.

9. AI-generated content and real people

The Service can generate images, video and audio, including of real people when you have their permission. We record your confirmation of consent and apply an AI-disclosure label and Content Credentials to exports where enabled. If you believe your face or voice has been used in the Service without permission, contact support@vidsfor.me and we will investigate and remove infringing content.

10. Changes

We will post changes here with a new "Last updated" date and, for material changes, notify account holders by email or in the Service.

11. Contact

Mark-It, Inc., Florida, United States · support@vidsfor.me. EU/UK residents may also contact us at that address for questions about this policy or their rights.