This Privacy Policy explains how Formless Inc., doing business as Vidzap (“Vidzap”, “we”, “us”, “our”), handles personal information when you use vidzap.ai, app.vidzap.ai and our related services (the “Services”).
We built Vidzap to make video ads. That means we necessarily process what you type, what you upload and what we generate for you. This policy sets out exactly what happens to it.
1. Scope
This policy covers personal information we process as a controller in connection with the Services. It does not cover:
- third-party websites, ad platforms or tools you use alongside Vidzap, each of which has its own policy;
- the practices of third-party AI model providers beyond the processing they perform for us (see section 5); or
- content you choose to publish yourself once you have downloaded an Output.
2. Definitions
- Personal information — information that identifies, relates to or could reasonably be linked to an identifiable person.
- Inputs — prompts, briefs, product details, brand assets, reference images, footage and audio you provide.
- Outputs — the video, image, audio and text the Services generate from your Inputs.
- Sub-processor — a vendor that processes personal information on our behalf and under our instructions.
- Model provider — a third party whose AI model generates Outputs from Inputs we transmit on your behalf.
3. What we collect
Account information. Name, email address, password hash, company or agency name if you give one, and your account and plan settings.
Payment information. Billing name, billing address, plan, transaction history and the last four digits and expiry of your card. Full card numbers are handled by our payment processor and never reach our servers.
Inputs you provide. Prompts, briefs, product photographs, brand assets, uploaded footage and audio, and any personal information contained in them — including images or recordings of identifiable people, where you have uploaded them in accordance with our Media Upload Agreement.
Outputs we generate. The videos, images, audio and scripts produced for you, together with the generation metadata (model used, style, parameters, duration, credit cost, timestamps).
Usage and device data. IP address, browser and device type, operating system, pages viewed, features used, referring URL, session timestamps and diagnostic logs.
Communications. Support tickets, emails, bug reports and any attachments you send us.
Identity and verification records. Where we need to verify an account, investigate abuse, respond to a rights complaint or meet a legal obligation, we may collect identity documentation or consent records you provide.
Cookies and similar technologies. See section 13.
4. Why we use it
| Purpose | Examples | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Provide the Services | Running generations, storing your library, delivering downloads | Performance of a contract |
| Billing | Charging your plan, metering credits, refunding failed generations | Performance of a contract |
| Support | Answering tickets, investigating a failed render | Performance of a contract; legitimate interests |
| Safety and abuse prevention | Content moderation, fraud and multi-account detection, rate limiting | Legitimate interests; legal obligation |
| Security | Access controls, logging, incident investigation | Legitimate interests; legal obligation |
| Product improvement | Aggregate usage analysis, reliability and performance work | Legitimate interests |
| Marketing | Product emails and updates you can unsubscribe from at any time | Consent, or legitimate interests where permitted |
| Legal compliance | Tax records, responding to lawful requests, mandatory child-safety reporting | Legal obligation |
Model training. We do not use your Inputs or Outputs to train AI models unless you explicitly opt in through your account settings. That choice is separate from using the Services, and you can withdraw it at any time. Withdrawal stops future use; it cannot recall content already incorporated into a completed training run.
Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You can object — see section 8.
5. Who we share it with
Sub-processors. Cloud hosting and storage, content delivery, payment processing, email delivery, error monitoring, product analytics and customer support tooling. Each is bound by contract to process personal information only on our instructions and to protect it appropriately.
Third-party model providers. To fulfill a generation request, we transmit the relevant Inputs to the model provider you selected or that we route the request to. Those providers process the Inputs to return an Output and are subject to their own terms and retention practices. Do not upload anything to Vidzap that you would not be comfortable transmitting to a third-party AI provider.
Advertising and ad-platform integrations. Only where you connect an integration yourself, and only what that integration needs.
Legal and safety disclosures. We may disclose personal information where we reasonably believe it is required to comply with law, valid legal process or a government request; to enforce our Terms; to detect or address fraud or security issues; to protect the rights, property or safety of Vidzap, our users or the public; or as part of the mandatory reporting described in section 18.
Business transfers. In a merger, acquisition, financing or sale of assets, personal information may be transferred as part of the transaction. We will give notice before your information becomes subject to a materially different policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under California law.
6. International transfers
We are based in the United States and process personal information there and in other countries where our sub-processors operate. For transfers of personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum or Swiss equivalent where applicable), together with supplementary technical and organisational measures. You can request a copy of the relevant transfer mechanism at privacy@vidzap.ai.
7. How long we keep it
| Category | Retention |
|---|---|
| Account information | For the life of the account, then up to 90 days after closure |
| Inputs and Outputs in your library | Until you delete them, or up to 30 days after account closure |
| Deleted content in backups | Purged on the normal backup cycle, up to 90 days |
| Payment and tax records | As required by law, typically 7 years |
| Security and access logs | Up to 12 months |
| Support communications | Up to 3 years |
| Moderation and enforcement records | Up to 3 years, or longer where required for a legal obligation or an ongoing investigation |
| Child-safety reports and related records | As required by law |
| Aggregated or de-identified data | Indefinitely, in a form that cannot reasonably be re-identified |
8. Your rights
Everyone can, from their account settings, view and edit account information, delete generated content, export what they have made, change marketing preferences, adjust the training opt-in, and close the account.
Depending on where you live, you may also have the right to: access the personal information we hold; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; and not be discriminated against for exercising these rights.
To make a request, email privacy@vidzap.ai. We will verify your identity — usually by confirming control of the account email — and respond within the period the applicable law requires (30 days under GDPR, 45 days under CCPA, each extendable where permitted). An authorized agent may submit a request on your behalf with proof of authorization.
If you are in the EEA, UK or Switzerland you may also complain to your local supervisory authority. We would appreciate the chance to address it first.
9. Security
We use TLS in transit and encryption at rest, role-based access controls with least-privilege defaults, logging and monitoring of administrative access, vendor security review, and internal policies restricting who can view user content and under what circumstances.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant regulators where the law requires, and within the timeframes it sets.
10. Children
The Services are not directed to children. You must be 18 or older to hold a Vidzap account. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, email privacy@vidzap.ai and we will delete it.
Separately, and without exception, no Vidzap feature may be used to upload, depict or generate a minor. See our Acceptable Use Policy.
11. Faces, voices and biometric data
Some Vidzap features work from images or recordings of a person’s face or voice. Depending on the feature and the jurisdiction, the underlying data may be treated as a biometric identifier or as special-category personal data.
- Certain likeness and voice features are not available to residents of Illinois or Texas, in light of those states’ biometric privacy statutes.
- We do not use face or voice data to identify, verify or authenticate anyone, and you may not use the Services to do so.
- We do not sell or lease biometric data, and we do not disclose it except to the sub-processors and model providers needed to run the feature you requested, or where the law compels it.
- Biometric data associated with a feature is retained only as long as needed to deliver it and is deleted on the schedule in section 7 or when the purpose is satisfied, whichever comes first.
Uploading media of a real person also requires the rights and consents set out in the Media Upload Agreement.
12. Other sensitive information
Please do not upload material we have no need for and cannot appropriately protect — protected health information subject to HIPAA, genetic data, government identification numbers, financial account credentials, or precise geolocation. Vidzap is not designed or certified for that data, and we are not a HIPAA business associate.
13. Cookies and similar technologies
We use:
- Essential cookies — authentication, session integrity and security. These cannot be switched off without breaking the Services.
- Analytics cookies — aggregate understanding of how the Services are used, so we know what to fix and build.
- Marketing cookies — measuring the effectiveness of our own campaigns.
Where required by law, we ask for consent to non-essential cookies before setting them, and you can change your choice at any time through the cookie controls on the site. You can also block cookies in your browser, though essential ones are needed for the Services to work. We honour Global Privacy Control signals as an opt-out where applicable law requires.
14. United States state privacy rights
If you are a California resident, the CCPA/CPRA gives you the right to know what we collect and why, to access and delete it, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. In the preceding 12 months we collected the categories described in section 3, for the purposes in section 4, and disclosed them to the recipients in section 5 for business purposes. We have not sold personal information or shared it for cross-context behavioral advertising.
Residents of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana — have comparable rights. Use the same route: privacy@vidzap.ai.
15. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Automated systems do screen content for policy violations and flag accounts for review, but enforcement actions with significant consequences — such as account termination — involve human review, and you can appeal them under our Trust & Safety Policy.
16. EU AI Act disclosures
Vidzap generates synthetic video, image and audio content. Where the EU AI Act applies:
- Outputs are marked as artificially generated using machine-readable provenance signals where technically feasible, and you must not remove or falsify those markings.
- If you publish an Output that constitutes a deepfake, the deployer-side disclosure obligation is yours.
- Prohibited practices — including biometric categorization of sensitive attributes, emotion inference in workplace or education settings, social scoring and untargeted facial-image scraping — are not permitted on Vidzap.
17. EU Digital Services Act
You can report illegal content through the routes in our Trust & Safety Policy. Where we restrict your content or account, we will provide a statement of reasons and an appeal route, and we will handle notices from trusted flaggers with priority.
18. Trust and safety: mandatory reporting
Where we identify apparent child sexual abuse material, we are required by US law to report it to the National Center for Missing & Exploited Children (NCMEC), and to preserve the associated content and account records. We participate in industry hash-sharing programs to prevent known illegal imagery from re-entering the Services, and we act on verified reports of non-consensual intimate imagery within 48 hours. These obligations override the deletion rights in section 8 for the specific records involved.
19. Changes to this policy
We may update this policy. For material changes we will give at least 14 days’ notice by email or in-product before they take effect, and we will update the “Last updated” date above. Continuing to use the Services after a change means you accept the updated policy.
20. Contact us
Formless Inc. (DBA Vidzap)
Privacy: privacy@vidzap.ai
Legal: legal@vidzap.ai
Mailing address: 18117 Biscayne Blvd, Suite #2339, Miami, FL 33160
If you are in the EEA or UK and we are required to appoint a representative or data protection officer, their details will be published here.
Appendix A — Sub-processors and model providers
A current list of our sub-processors and the third-party AI model providers we route generations to is available on request from privacy@vidzap.ai. We will give notice of material additions so you have an opportunity to object.