Privacy Policy

1. Controller

Eventarena AB is the controller for account, customer support, product, security and billing data described here. Payment providers and certain AI providers may also act as independent controllers for processing they determine themselves.

2. Data we process

• Account data such as email address, authentication identifiers and sign-in events.
• Where you came from when you created your account: the name of the site or the campaign tags of the link that brought you to Ginvid, and the page you first opened. It is held for at most a day without cookies or anything stored on your device, keyed to a one-way hash of your network address and browser with a salt that changes daily and is never stored, and kept with your account only if you create one that day, so we understand how people find Ginvid.
• If a friend's invite link brought you: its invite code, which your browser keeps for that visit (session storage) and your sign-up carries to your new account, so that you and your friend can receive the invitation credits. Your account also keeps a code of its own for the invite link you share; the code does not reveal who you are.
• Billing data such as Stripe customer, subscription, invoice and payment status. Ginvid does not receive your full card number.
• Content you submit, including links, prompts, scripts, voice recordings, images, video clips, generated media and editing instructions.
• Technical and security data such as IP address, browser/device information, request logs, error diagnostics and anti-abuse signals.
• Support communications and your choices, such as voice, format and creative direction.
• The steps your account takes on its way in, so we can see where people stop: opening the Video page, choosing a video type, typing an idea, pressing Make, a script written, the price or plans shown, a checkout, a payment, and a video started, finished or published. Each step is one line with your account's ID and the time, never your words. The lines are kept for 180 days, and all of your account's go when you delete it.
• What Ask Ginvid remembers about your channel from your chats (what it is about, for whom, the language, the kinds of videos, style, voice, music, goals, how often you publish and short notes), so it does not ask again. You can see, correct or clear it on My account, under What Ask Ginvid remembers.
• Before you have an account, you can get five video ideas for a channel subject. The subject is sent to our AI provider to write them, and your IP address is used in server memory only, to limit free ideas per day; it is not stored with the ideas or kept once the day has passed.

3. Purposes and legal bases

• Contract: create your account, process payment, provide credits, generate and deliver videos, save your choices and handle requested support.
• Legitimate interests: secure Ginvid, prevent fraud and abuse, diagnose failures, operate the queue, improve reliability, count visits in aggregate and, while your account has not made a video yet, send you at most two emails with tips for getting started, and a day after your first video one email with ideas for your next, and a few days before your videos are deleted one email listing them with links to download or keep them; each can be turned off from the email or on My account. We balance these interests against your rights.
• Legal obligation: keep accounting, tax, transaction and compliance records and respond to valid legal requests.
• Consent: only where a feature specifically asks for it. You may withdraw consent without affecting earlier lawful processing.

4. Service providers and recipients

Data is shared only as needed with categories including Supabase for authentication and database services; Stripe for checkout, subscriptions, receipts and fraud prevention; hosting and infrastructure providers; transactional email providers; Plausible Analytics, an EU-hosted service that counts page visits without cookies and without storing IP addresses or building profiles (the admin pages are never counted, and an approval or share page is counted without the key in its address); AI/media providers such as OpenAI, Google Gemini, Anthropic (which plans the graphic details of the Motion look from your script and small previews of your pictures), Replicate and ElevenLabs (background music and premium voices, when you choose them), and Higgsfield (only if you restyle a finished video with it, which sends that video to Higgsfield), when the selected feature needs them; Google (YouTube API Services), when you connect a channel, publish a video to it, connect analytics or have the assistant read YouTube, as described in section 9; TikTok, only when you connect an account and send a video to it, as described in section 10; and Meta (Facebook and Instagram), only when you connect and post to a Page or an Instagram account, as described in section 11. Pictures of you are made by Google (Gemini) or, when Google cannot be reached and for pictures in swimwear, by ByteDance's Seedream 4.5 through Replicate, clips by Kling through Replicate, and a talking host's clips by VEED's Fabric through Replicate, as described in section 12. Professional advisers and authorities may receive data where legally required. We do not sell personal data or use it for third-party behavioural advertising.

5. International transfers

Some providers may process data outside the EU/EEA. Where GDPR requires safeguards, we rely on an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism and apply supplementary safeguards where appropriate.

6. Retention

Project media is normally deleted 30 days after project creation; edits do not extend that deadline. A few days before, Ginvid emails you a list of the videos about to go, with a link to download each and one to keep it 30 more days, unless you turned these reminders off; deleted videos cannot be restored. A video you upload for Ginvid to cut is deleted as soon as the cut is ready, or with the project if it is never finished; the cut itself follows the same 30 days. If you explicitly save a finished project, its media and editable versions are kept for 30 days from the first save, up to 25 saved projects per account. Photos of a person that you add in Photos are deleted 30 days after you add them, or when you remove them, and the pictures and clips made from them 30 days after they were made; a record of each upload is kept for up to 13 months, as section 12 describes. Characters Ginvid draws for you are kept until you delete them. Songs you make in the Music studio are kept on your account for 30 days, or until you delete them; a video that uses a song keeps its own copy only as long as the video. Account and wallet records remain while your account is active. A channel's cover, its host's picture and its logo are kept with the channel, and are deleted when you delete the channel or your account. Your chats with the assistant are kept while your account is active; the working notes behind each answer (what the assistant was told and what its tools returned) are deleted after 30 days, and anything quoting YouTube's numbers is removed as section 9 describes. Authentication, security and support records are kept only as long as needed for their purpose. When you delete your account, on My account or by asking us, your sign-in, profile, credits, history, channels, Autopilot settings, photos, host pictures and logos, what Ask Ginvid remembers, your chats, your connections and your funnel steps are deleted at once, every share page and every link to your videos in our emails stops working, and the videos' own files are removed with their 30 days; a short record that the account was deleted (its address and the time) is kept to show the request was carried out. Billing, invoice and accounting records are retained for the period required by Swedish law. Backups and provider logs may disappear on a delayed rotation. When data is no longer needed, it is deleted or anonymised.

7. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, objection or data portability, and withdraw consent. You may object at any time to direct marketing. You can delete your account yourself on My account (Change email or delete account), change your email address there, and see, correct or clear what Ask Ginvid remembers about you. For anything else, send a request from the email address connected to your account; we may verify identity before releasing data. We normally respond within one month. You may complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

8. Automated systems

Ginvid uses automated systems to create media, estimate costs, detect unsafe requests and protect the service. These systems do not make decisions with legal or similarly significant effects about you. Provider safety systems can refuse a generation.

9. YouTube

Ginvid uses YouTube API Services to publish videos to your channel, to show your channel's results and to let the assistant advise you. Their use is governed by the YouTube Terms of Service, and Google processes data under the Google Privacy Policy.

• A channel's public numbers: if you give Ginvid's assistant the address of a YouTube channel, or save your channel on your account page, Ginvid reads that channel's public information through YouTube API Services with its own key, without asking you to sign in: its name, its subscriber, video and view counts, and its latest videos' titles, dates, lengths, views, likes and comments. The assistant can also look up what is popular on YouTube. These numbers are used only to advise you and for the results reports the assistant writes to you in the chat, and by email if you turn that on. Between readings Ginvid uses them for at most six hours: held in memory, and for a channel's Autopilot, which learns from its videos' titles and view counts, in a small file on Ginvid's server that is deleted within an hour after those six hours, when you disconnect YouTube, and when you delete the channel or your account. An answer or report that quotes them stays in your chat for at most 30 days, and is then replaced by a short note. Your channel's address stays with your account until you remove it on your account page or ask the assistant to forget it.
• What we ask for when you connect: permission to upload videos to your channel (youtube.upload) and the email address of the Google account you connect (openid and email). Only if you also press Connect analytics, read-only access to your channel's YouTube Analytics reports (yt-analytics.readonly). When you choose to connect a verified channel destination, Ginvid also asks for read-only YouTube access (youtube.readonly) to identify its channel name and ID. Ginvid does not use this access to change or delete existing videos.
• Publishing by itself: only if you switch on Publish to YouTube by itself in a channel's settings and confirm it, that channel's Autopilot uploads each new video it makes to the YouTube channel you connected, with the same permission, the title and description Ginvid writes and the choices you made there (who can see it, made for kids, the AI label and when it goes public). We keep the time you confirmed it with the channel's settings. Switch it off there at any time. Disconnecting YouTube switches it off for every channel that used the connection, so it never carries over to the next Google account you connect: you turn it on again, and confirm it again, after connecting. Videos already uploaded stay on YouTube until you remove them in YouTube Studio.
• How analytics is used: your videos' views, watch time, average view duration and percentage, subscribers gained and audience retention are read from YouTube when you open Production & results or ask the assistant about your results, and are shown only to you. To answer you, the assistant's AI provider (OpenAI) processes them. They are never sold, used for advertising or used to train AI models. Ginvid does not keep the reports: the Production & results page reads them each time, a channel's Autopilot keeps only its videos' titles and view counts, for at most seven hours as described above, and what the assistant read stays only with the answers in that chat, for at most 30 days, and is removed at once when you disconnect YouTube.
• What we keep: the connected Google account's email address, the channel name and ID for verified destinations, and a token from Google, encrypted, so you do not have to connect again for every video, and the identifiers and titles of videos published through Ginvid, so their results remain available after temporary media expires. All of these are kept while the connection remains active. Behind each assistant answer, the chat keeps the assistant's working notes (what it was told and what its tools returned) for 30 days; they can include the connected account's email and your uploads' links.
• What we send to Google: only the video you choose to publish, its cover, and the title, description, visibility, audience (made for kids) and AI-content answers you enter.
• How to stop it: press Disconnect for that channel in the studio or on your account page. Other saved destinations remain separate, although Google may revoke shared permissions together. Ginvid then revokes its access at Google and at once deletes the token, the published videos' identifiers and titles, the answers built on your analytics, the working notes and the Autopilot's six-hour files described above, and switches off publishing by itself. You can also remove Ginvid at Google's security settings: Ginvid checks its connections every day and deletes the same data as soon as it finds the access gone, within 7 days at most. Deleting your Ginvid account deletes all of it too.

Ginvid's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Sending videos to TikTok

If you choose to connect a TikTok account, Ginvid uses TikTok's Login Kit and Content Posting API. Your use of TikTok is governed by TikTok's Terms of Service and Privacy Policy.

• What we ask for: your TikTok display name and ID (user.info.basic) and permission to send videos to your TikTok drafts (video.upload). Ginvid cannot post for you, and cannot see, change or delete anything on your TikTok account.
• What we keep: your display name, your TikTok ID and an access token from TikTok, encrypted, so you do not have to connect again for every video. Whether a video was sent is kept with the project and deleted with it at the displayed storage deadline.
• What we send to TikTok: only the video you choose to send. It waits in your TikTok inbox until you post it yourself in the TikTok app.
• How to stop it: press Disconnect in the studio, which revokes Ginvid's access at TikTok and deletes the token at once. You can also remove Ginvid in the TikTok app under Settings and privacy → Security → Manage app permissions. Deleting your Ginvid account deletes the connection too.

11. Posting to Facebook and Instagram

If you choose to connect, Ginvid uses Facebook Login for Business and Meta's Pages API and Instagram API, provided by Meta. You choose, when Facebook asks, which Pages Ginvid may post to; a professional Instagram account (Business or Creator) linked to one of those Pages can be posted to as well. Your use of Facebook and Instagram is governed by Facebook's Terms of Service, Instagram's Terms of Use and Meta's Privacy Policy.

• What we ask for: your name and an ID for you that only Ginvid uses; the Pages you choose and permission to publish on them (pages_show_list, pages_read_engagement, pages_manage_posts); and, for each Page, the ID and username of the Instagram account linked to it and permission to publish on it (instagram_basic, instagram_content_publish). Ginvid uses these only to show where you can post and to publish the posts you choose. It does not read your messages, and it does not change or delete anything already on your Pages or accounts.
• What we keep: your name and that ID; each Page's ID and name and its linked Instagram account's ID and username; and the access tokens Facebook gives, encrypted: one for each Page, which Facebook ends when you change your password, lose your role on the Page or remove Ginvid, and one for you, which runs out after 60 days. For each post you make or schedule: what it shows, where it goes, its caption, its time and whether it went out, kept for 30 days.
• What we send to Meta: only the picture, clip or video you choose to post, with your caption, to the Pages and accounts you choose, at the time you choose. Meta fetches the file from a link that works for two hours. Each file says in its data that it was made with AI. You choose whether Instagram shows its “AI info” label on a post; Facebook and Instagram may add a label by themselves.
• How to stop it: press Disconnect in the studio or on your account page: Ginvid asks Facebook to remove its permissions and deletes every token at once, and posts still waiting are not published. You can also remove Ginvid in Facebook under Settings, Business integrations, or in Instagram under Settings, Apps and websites, or ask Meta to have Ginvid delete your data: Ginvid then deletes the connection and the posts waiting at once. Deleting your Ginvid account deletes all of it too.
• Instagram's own login: where Ginvid offers it, you can instead connect an Instagram account without a Page. Ginvid then asks for its ID, username and account type (instagram_business_basic) and permission to publish (instagram_business_content_publish), keeps an encrypted token that it renews before it runs out, and everything above applies in the same way.

12. Pictures of people

In Photos you can add photos of a person, or have Ginvid draw a character, and have pictures and short clips made of them in scenes you describe.

• Whose photos: add photos of yourself, or of someone who has agreed to it; you are responsible for having their permission. Before a photo is kept, it is checked automatically: it must show one adult, with the face visible, not nude, and not a well-known person. A character Ginvid draws is an invented person who does not resemble anyone real. Before a person from your photos, or a channel's host from a picture you uploaded, talks on camera in a video, you confirm once for that picture that it is you, or that they agreed to it.
• How the photos are used: only to make the pictures you ask for, which is the service you ask Ginvid for (GDPR Article 6(1)(b)). Each request sends the photos and your description to Google (Gemini), or, if Google cannot be reached or the picture is in swimwear, to Replicate, which runs ByteDance's Seedream 4.5; a clip sends its picture to Replicate, which runs Kling. When a video's main character talks on camera, their picture goes to Replicate, which runs Seedream 4.5 to show them as the video's host, and that picture, with the words of each scene they speak, to Replicate for VEED's Fabric model, which makes them say those words; a channel's host is handled the same way. Before a photo is kept, and before a picture or clip is shown, OpenAI checks it for safety. The photos are never used to train AI, to recognise anyone or to identify anyone. Google keeps requests for up to 55 days to detect abuse; Replicate deletes them within an hour.
• What we keep: the photos, without location or other metadata, for 30 days from when they were added or until you remove them; the pictures and clips for 30 days from when they are made; a talking host's picture and clips with their video, which is deleted 30 days after it was started; a character Ginvid drew until you delete it. A record of each upload (your account, the time and a fingerprint of the photo, never the photo itself) is kept for up to 13 months, so that if someone reports a picture of them we can find the account that made it and act under our terms.
• A channel's host: if you make a person or a character a channel's host, their first photo and their description are copied to the channel and kept with it until you change the host, delete the channel or delete your account. Your confirmation that they may talk on camera goes with them, and a new picture needs it again.
• Marked as made with AI: every picture and clip says in its file that it was made with AI, and Google's pictures also carry Google's invisible SynthID watermark. If you publish a realistic picture of a real person, the law may require you to say that it was made with AI.

13. Connecting an assistant

You can connect an assistant to your Ginvid account, such as ChatGPT, Claude, Claude Code, Grok or Gemini, by signing in to Ginvid from it and choosing Allow, or with a personal token from your account page. It can then use Ginvid's tools for you: see your videos, write scripts, and make videos and edits with your credits.

• What we keep: for each connected app, the name it gives itself, when you connected it and last used it, and a hashed key that lets it stay signed in; for each personal token, its name, its last four characters and a hash. Never the assistant's password or a copy of a token.
• What we receive: only the requests the assistant sends to Ginvid's tools, such as a video's topic or script, handled like requests from the studio. We never see your conversation with the assistant.
• What the assistant receives: the answers to those requests, such as your videos' status, scripts and download links, which its provider then handles under its own privacy policy.
• How to stop it: choose Disconnect or Revoke on your account page; the app or token is refused within a minute. Deleting your Ginvid account removes every connection.

14. Security and age

We use access controls, limited retention, encrypted transport and operational monitoring appropriate to the service. No internet service is completely secure. Ginvid is for adults: you must be 18 or older to use it, and it is not directed to children.

Contact

Eventarena AB, company registration number 559200-7214, VAT number SE559200721401. Friluftsvägen 29, 172 40 Sundbyberg, Sweden. Email: support@ginvid.ai.