Privacy policy

This policy applies to DubQik (the “Service”), operated by [your company's legal name and address go here]. If you have questions about this policy or your data, contact [your privacy contact email]. That bracketed information is not filled in because I don't know your legal entity — filling it in with a placeholder company name would be worse than leaving it visibly blank.

Account data: email address, authentication tokens (via Supabase Auth — we don't store your password, Supabase handles that).

Content you upload: video and audio files, generated transcripts, translated text, and the dubbed/lip-synced output. This is the most sensitive category this product handles, because it includes a voice — see Section 5.

Payment data: handled entirely by Stripe. We store a Stripe customer ID and subscription status, never your card number, expiry, or CVC.

Usage data: job status, timestamps, credit balance and ledger entries, and support ticket submissions if you contact us.

Cookies: see the Cookie Policy — currently limited to the session cookie Supabase Auth sets to keep you signed in.

Analytics: aggregate, cookieless traffic data via Vercel Analytics — which pages get visited and roughly how much traffic, not tied to your identity or tracked across visits the way cookie-based analytics would.

Processing your video requires sending parts of it to these providers, each under their own terms:

• OpenAI (Whisper transcription, GPT-4.1 translation)
• ElevenLabs (voice cloning and dubbed audio generation)
• Replicate (lip-sync rendering, Pro/Business plans only)
• Supabase (database, file storage, authentication)
• Stripe (payment processing)
• Resend (transactional email, if configured)
• Upstash (rate limiting infrastructure, if configured — does not receive your content)

Link to each provider's data processing terms here once you've reviewed them — several (notably OpenAI and ElevenLabs) have specific terms about whether your content is used for model training, which you should confirm directly rather than assume.

Account and job data: processing necessary to perform the contract with you (providing the dubbing service you signed up for). Payment data: contract necessity plus legal obligation (tax/accounting records). Marketing communications, if you add any: consent, which must be freely given and separately revocable from the essential service.

This product clones a speaker's voice from uploaded audio. That is meaningfully different from most data this policy would otherwise describe — a cloned voice is a biometric identifier in several jurisdictions (Illinois' BIPA and Texas' CUBI both regulate voiceprints explicitly), and cloning someone's voice without their consent is both a legal and product-trust problem, not just a policy line to write around.

Before this goes live: require explicit confirmation from the uploader that they have the right to clone the voice in the video — a checkbox at upload time, logged with a timestamp, is a minimum, not a formality.

Not yet defined in this codebase. Decide how long source videos, dubbed outputs, and transcripts are kept after a job completes or an account closes, document it here, and build the deletion job to actually match what this section says — a retention policy that isn't enforced in code is worse than none, because it's a stated commitment you're not keeping.

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to object to or restrict certain processing. To exercise any of these, contact [your privacy contact email]. You can delete your own account and all associated data directly from the account page — deletion is immediate and cannot be undone.

This Service is not directed to, and not intended for use by, anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact [your privacy contact email] and it will be deleted.

Your data may be processed in the United States and other countries where our providers (listed in Section 3) operate, which may have different data protection laws than your own country. If you're in the EU/UK/EEA, this requires an appropriate transfer mechanism (Standard Contractual Clauses in most cases) — confirm each provider has one in place.

We use industry-standard measures (encrypted connections, access controls, Row Level Security on the database) but no method of transmission or storage is 100% secure, and we can't guarantee absolute security.

If this policy changes materially, we'll update the date at the top of this page and, for significant changes, notify account holders by email.

[Your privacy contact email/address goes here.]