Privacy Policy

Last updated: August 2, 2026 · Effective: August 2, 2026

This Privacy Policy explains how Hireabble Inc. (“Hireabble,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with VidRocket (the “Service”). The Service includes the website at vidrocket.ai and its subdomains, the VidRocket iOS app, and the VidRocket Studio desktop app. By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who we are

VidRocket is operated by Hireabble Inc., a corporation incorporated in the Province of Alberta, Canada. For questions about this policy or your data, contact us at privacy@vidrocket.ai.

2. Information we collect

2.1 Information you provide

• Account information: name, email address, and password (passwords are hashed by our authentication provider, Supabase — we never see them in plaintext).
• Google sign-in: if you sign in with Google, we receive your name, email, and profile image from Google’s OAuth flow.
• Sign in with Apple: if you sign in with Apple, we receive your email address (or Apple’s private relay address, if you chose to hide yours) and, on your first sign-in only, the name you choose to share.
• Billing information: when you purchase a subscription or credit pack on the web, payment is processed by Stripe. We do not store full card numbers or CVV codes; we receive a Stripe customer ID, the last four digits of your card, your billing country, and the status of your subscription. Purchases made inside the iOS app are processed by Apple through In-App Purchase — we never see your payment details, only the purchase and subscription status Apple reports back to us, which we use to unlock features and grant credits.
• Content you submit: URLs of public social-media profiles you scan (YouTube, TikTok, Instagram), videos and photos you upload, record in the app, or import from your photo library, comparison files, prompts you type into the chat and editor, caption and on-screen text you write, board notes, favorites, and other content you generate inside the Service.
• Audio: the audio track of clips you edit (used to generate captions and transcripts), voiceover you record, and any voice recording you submit to create a cloned voice.
• Support and communications: emails and messages you send us.

2.2 Information collected automatically

• Usage data: pages visited, referrer, device type, browser, operating system, country and city derived from your IP, and an anonymous 30-minute session identifier stored in a first-party cookie (va_sid).
• IP address: we receive your IP address with every request. We do not store it in plaintext — we store a salted SHA-256 hash of the IP for abuse prevention and aggregate analytics.
• Cookies: we set a session cookie for authentication (issued by Supabase), a session-id cookie for traffic analytics, and Stripe sets cookies on its checkout pages. We do not use third-party advertising or cross-site tracking cookies.
• Logs and diagnostics: standard server logs (timestamps, request paths, response codes, error stack traces) generated by our hosting provider.
• Product analytics: we use PostHog to record a defined set of in-app events (for example: first launch, an export started, an export finished, a paywall shown) so we can see which features are used and where people get stuck. In the apps these events are associated with your account identifier. We do not use automatic capture of every tap or screen, and we do not use analytics for advertising.
• Crash and error reporting: we use Sentry to receive error and crash reports (error message, stack trace, and the state of the app at the time of failure). Reports are associated with your account identifier so we can reproduce a failure you actually hit.
• Push notification token: if you allow notifications on iOS, Apple issues a device token that we store against your account so we can tell you when a render is finished. It identifies your device installation, not you personally, and is deleted when it stops working or you delete your account.
• Device permissions (iOS): the app asks for camera, microphone, and photo library access only when you use a feature that needs them. Media stays on your device until you choose to add it to a project, at which point it is uploaded as described above.

2.3 Information about third-party creators

When you scan a public profile, we fetch publicly available metadata and video content (titles, view counts, thumbnails, transcripts, frames) from YouTube, TikTok, or Instagram. We do not collect private accounts, private posts, follower lists, or personal contact information of those creators. The fetched material is processed to produce the analysis you requested and is retained per Section 8 (Retention).

3. How we use information

• To provide and operate the Service (authentication, scans, analyses, chat, billing).
• To send AI providers (see Section 5) the inputs needed to generate your analysis.
• To bill you, process refunds, and prevent payment fraud.
• To debug, monitor performance, and detect abuse or attempted account compromise.
• To improve the Service through product analytics and crash reporting (see Section 2.2).
• To deliver notifications you have opted into, such as when a render finishes.
• To send transactional email (sign-up confirmation, password reset, billing receipts). We may also send occasional product announcements; you can opt out at any time.
• To comply with our legal obligations and enforce our Terms of Service.

We do not sell or rent your personal information. We do notuse your private uploads, scan inputs, or chat prompts to train our own AI models.

4. Legal bases (EU/UK users)

If you are in the European Economic Area or United Kingdom, our legal bases are:

• Contract: to deliver the Service you signed up for.
• Legitimate interests: security, fraud prevention, analytics, and product improvement.
• Consent: for optional marketing email; you can withdraw consent any time.
• Legal obligation: tax, accounting, and lawful requests.

5. AI processing and subprocessors

VidRocket sends inputs to third-party AI and infrastructure providers to deliver the Service. By using VidRocket, you agree to the routing of your inputs to these providers under their respective terms.

Our AI providers commit in their API terms not to use inputs submitted through those APIs to train their public models, and we do not enable any “training opt-in” flag. In the apps, AI features are gated behind an explicit consent prompt before anything of yours is sent for processing, and you can withdraw that consent at any time in your account settings.

Some generation providers route your request to an underlying model operated by a different company. In particular, fal.ai and Higgsfield offer models built by ByteDance (including the Seedance family) and Kuaishou (the Kling family). Where you choose one of those models, the media and prompt for that request are processed by that model’s operator, which may be located outside your country, including in China. If you would rather not have your media processed by a particular model operator, do not select that model.

6. Photos of people, faces, and voices

Several features accept a photo or recording and produce new media from it — animating a still image, generating a talking avatar, placing a subject into a new scene, or cloning a voice. When the image or recording you supply contains an identifiable person, that upload is personal information about that person, and in some places it is treated as a special or sensitive category.

• What we do with it. We store the file you upload so the feature can run and so you can re-use it in your projects, and we transmit it to the provider that performs the generation (see the table above). We do not run face recognition, we do not attempt to identify who is in an image, and we do not build or store a faceprint, face template, or other biometric identifier from your uploads.
• What we do not do with it. We do not sell it, we do not use it to train our own models, and we do not enable training on it at our providers.
• Your responsibility. You may only upload a photo, video, or voice recording of a person if that person is you, or if you have that person’s permission. Uploading someone else’s face or voice without permission is prohibited by our Terms, and may also break the law where you or that person live. Never upload an image of a child.
• Deletion. Delete an uploaded photo or recording, and any media generated from it, from your library at any time; deletion removes it from our storage on the schedule in the Retention section. Generation providers hold a short-lived copy for the duration of the request under their own terms. Deleting your account removes your uploads entirely — see Data deletion.
• Legal basis (EU/UK). Where this processing involves special-category data, we rely on your explicit consent, given through the in-app prompt before the feature runs. You can withdraw it at any time in your account settings, which stops future processing.

Model operators run their own safety checks and may refuse a request that appears to depict a real person, a public figure, or a minor — including when the person is you. Those refusals come from the provider and are outside our control.

7. Sharing and disclosure

We share information only as follows:

• With subprocessors listed in Section 5, under their data-protection terms.
• Public analyses: if you (or an administrator) explicitly mark an analysis or board as public, the analysis content and the public-creator metadata become viewable by anyone with the link or via our public library. Your email address is never shown on public pages.
• Compelled disclosure: in response to valid legal process, with notice to you where lawfully possible.
• Corporate transactions: if Hireabble is acquired or merges with another company, your data may be transferred under equivalent protections.

8. Retention

• Account data: kept for the life of your account, plus up to 30 days after deletion to complete backups and reverse mistaken deletions.
• Uploaded videos and extracted frames: kept until you delete them or your account is deleted, whichever is earlier. Inactive accounts may have storage purged after 12 months with prior email notice.
• Scan results and chat history: retained as long as your account is active so you can revisit past scans.
• Billing records: retained for 7 years to satisfy tax and accounting obligations.
• Server logs: 30 days.
• Hashed-IP analytics: 13 months in aggregate form.
• Product analytics and crash reports: retained by PostHog and Sentry for up to 12 months.
• Push notification tokens: until the token stops working, you turn notifications off, or you delete your account.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for marketing email.
• Lodge a complaint with your local data-protection authority.

Canadian residents have the rights described under PIPEDA and any applicable provincial privacy laws (including Alberta’s PIPA and Quebec’s Law 25). California residents have the rights described under the CCPA/CPRA. We do not sell or “share” personal information for cross-context behavioral advertising.

To exercise any of these rights, email privacy@vidrocket.aifrom the address on your account, or use your account settings. You can delete your account and its associated data directly in the iOS app (Profile → Delete account) and on the web, without contacting us. We will respond to emailed requests within 30 days.

10. Security

We use TLS in transit, encryption at rest for stored uploads and database backups, hashed passwords, scoped access controls, and least-privilege service credentials. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

11. International transfers

VidRocket is operated from Canada. Several of our subprocessors (notably Anthropic, Stripe, and Vercel) are located in the United States, so your information will be transferred to and processed there as well as in any other jurisdiction where our subprocessors operate. Where required for transfers out of the EEA or UK, we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

12. Children

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 16. The iOS app is rated for users 17 and older. If you believe a child has provided us data, contact us and we will delete it.

13. Third-party content and links

The Service displays content fetched from YouTube, TikTok, and Instagram. We are not responsible for those platforms’ privacy practices. Embedded videos play under the respective platform’s terms and may set their own cookies.

14. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the latest revision. Material changes will be communicated via email or an in-app notice at least 14 days before they take effect.

15. Contact

Hireabble Inc.
Email: privacy@vidrocket.ai