Privacy Policy

Account. Your email address, and if you sign in with Google, the name and profile picture Google provides. Sign-in codes are stored for five minutes and then discarded.

Your content. The media you upload, the prompts and messages you write to the assistant, your projects and their edit history, your story elements, and the video, images, captions and text generated for you.

Billing. If you subscribe or are given credits, we keep a record of your credits and how they were used, and a mirror of your subscription status from Stripe, including the brand and last four digits of your card. Stripe holds your full payment details; we never see them.

Usage and technical data. Which features you use, how many assistant messages and generations you run, and the requests your browser makes, including your IP address and browser type, which appear in our server logs. Page views are measured with Vercel Web Analytics, which does not use cookies and does not identify you across sites.

Cookies and local storage. One cookie keeps you signed in. Your browser also stores editor preferences, such as the theme and a local draft of the project you are editing, on your own device.

• to provide the Service: sign you in, store and render your projects, generate output, charge credits and run your subscription;
• to send you sign-in codes and messages about your account, and, if you choose to receive them, product news;
• to keep the Service safe: enforce limits, detect abuse, and investigate breaches of our Terms;
• to understand how the Service is used and improve it;
• to meet legal and accounting obligations.

Where data-protection law requires a legal basis, we rely on the contract with you for the first point, our legitimate interests for safety and improvement, and our legal obligations for records. We do not sell your data, and we do not use your content or output to train our own models.

Generation is carried out by models run by other companies. When you ask for a generation, the prompt and any media you attach are sent to the provider of that model through Vercel’s AI Gateway. At the time of writing these providers are Anthropic (the assistant), Google (reference video analysis), Alibaba Cloud (video), ByteDance (images) and OpenAI (caption transcription); the editor shows which model handles a given generation. Each provider processes that data under its own terms and retains it only as those terms allow. We do not send your name or email address with a generation request.

We use the following service providers, which process data on our behalf under their own agreements with us:

• Vercel: hosting, file storage for your media, video rendering, the AI Gateway, and analytics;
• Neon: our database;
• Stripe: subscriptions and payments;
• Resend: email delivery;
• Google: “Sign in with Google”, and Google Fonts, which the editor loads from Google’s servers when a design uses one of its typefaces (Google receives your IP address for that request);
• the AI model providers described in section 3.

When you publish a project, its preview, name, description and your display name and profile picture are shown publicly on Explore, and other users can copy the project into their own account. We will also disclose data if the law requires it, to protect people from harm, or as part of a merger or sale of the business, in which case this policy continues to apply.

• Projects, media and generated output: until you delete them or your account. Deleting a project removes it and its edit history; media files may take up to 30 days to be removed from storage.
• Assistant messages: as part of the project they belong to.
• Credit and billing records: for as long as we must keep accounting records, typically seven years.
• Server logs: up to 30 days.
• Sign-in codes: five minutes.

You can edit or delete your projects and media in the app at any time, and unpublish a project to remove it from Explore. To access a copy of your data, correct it, or delete your account, write to support@shapen.com; we will act on a request within 30 days. Depending on where you live you may also have the right to object to or restrict processing, to data portability, and to complain to a supervisory authority.

Data travels over encrypted connections and is stored with providers that maintain their own security programmes; sign-in codes are encrypted at rest. No system is perfectly secure, so keep your email account safe and tell us about any concern. Our providers operate in the United States and other countries; where your data is transferred out of the region you live in, we rely on the providers’ standard contractual protections. The Service is not intended for anyone under 18, and we do not knowingly collect data from them.

We will post any change to this policy here and update the date at the top; if a change is material we will tell you in the app or by email. Questions and requests go to support@shapen.com.