Privacy Policy
Last updated: October 17, 2026
This notice explains what Vidmoat does with your information: what we collect, why, who else touches it, where it goes, how long we keep it, and what you can make us do about it. It is written to be read rather than skimmed past.
Vidmoat is operated by Buzz Innovations Ltd, a company registered in England and Wales, company number 17212684. For data protection law we are the controller of the information described here. You can reach a human at support@s-ticketing.vidmoat.com.
The short version
- Your videos are yours. We do not sell them, we do not use them to train AI models, and we do not use them in our own marketing.
- Your files are stored in the EU. The database and the media store are both in the European Union.
- AI processing goes abroad. To answer an instruction, we send text and sometimes sampled video frames to AI providers in Singapore, China and the United States. Section 6 names every one and says exactly what is sent.
- Some of it never leaves your browser. Visual labelling and silence detection run on your own machine.
- You can get your data out, or have it deleted. Section 10.
1. What we collect
Account and identity
You sign in with Google. We receive and store your email address, display name and profile picture from that sign-in. We never see or store your Google password. Authentication is handled by Firebase Authentication, a Google service.
Your answer to whether you are 18 or older, and when you gave it. We do not ask for your date of birth or any proof of age. Section 14 explains why we ask.
Your content
The video, audio, images and fonts you upload; the projects you build from them, including all text you place on screen; the exports you render; and anything you publish through Vidmoat. We also derive things from your media: speech transcripts, silence regions, shot and motion measurements, visual labels, and (on some plans and requests) a timestamped description of what happens on screen.
What you tell the AI
The instructions you type into the AI console, agent mode, the chat bots or a generation box, and what the AI did in response. We keep the full text of a run, its plan, its commands, its errors and its credit cost. We use this to fix failures, to price features honestly, and to decide what to build.
Billing
Your plan, billing cycle, renewal date, credit balance and a transaction ledger, plus the customer and subscription identifiers our payment providers give us. We do not receive or store your card number: that stays with the payment provider.
Usage and technical
Which features you use and when, which limits you reach, which client you used (web, desktop, mobile) and its version, when you were last seen, plus server logs. Some administrative and security records include an IP address: admin actions, system events, and the last IP used with an API key. Public API calls are logged with the route, status and duration.
Support and community
Support tickets and their attachments, product feedback, expert handoff briefs, and, if you use Vidmoat Social, your profile, posts, comments and reports. Moderators keep private notes on accounts they have actioned.
2. Why we process it, and our legal basis
Under UK and EU data protection law we must have a lawful basis for each purpose, not one basis for everything. Ours are:
| Purpose | Basis |
|---|---|
| Running the editor, storing your projects, rendering exports, and carrying out the AI instructions you give | Performance of our contract with you |
| Taking payment, preventing chargeback fraud, issuing invoices | Contract, and legal obligation for tax records |
| Publishing to a social platform you connected | Contract, on your instruction |
| Keeping the service secure, stopping abuse, enforcing limits | Legitimate interests: running a service that is not overwhelmed by abuse |
| Understanding how features are used so we can fix and improve them | Legitimate interests: making a product that works |
| Producing aggregate, anonymised usage statistics, for us and to share | Legitimate interests: understanding and describing how video is made with Vidmoat. You can opt out. |
| Product and marketing email | Consent, withdrawable at any time from any email or your settings |
| Asking whether you are 18 or older, keeping your answer, and keeping the service to adults | Legitimate interests: meeting the terms of the AI providers Vidmoat is built on, and keeping a service for adults to adults |
| Reporting child sexual abuse material | Legal obligation, and substantial public interest |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time using the contact address above.
Providing your content is not a statutory requirement, but it is necessary to use the product: we cannot edit or render a video you have not given us.
2a. Aggregate statistics
We count how Vidmoat is used, for example how many people in a country made talking-head videos in a week, or how often captions are used. To group videos by type, we may use automated analysis of a project’s content, including a few still frames; this produces only a category, which we keep with the project.
These statistics are aggregates: each one describes at least 20 people, smaller groups are never shown, and they never include your name, email, address, your media, your transcripts, your project titles or anything you typed.
We use them to improve Vidmoat, and we may share or publish them, including with partners under a written agreement that forbids any attempt to identify individuals.
You can opt out in your account settings, or with a Global Privacy Control signal, and your activity is then left out of every statistic from the next day.
3. We do not train AI models on your content
We do not use your videos, audio, images, transcripts or projects to train generative AI models, and we do not permit anyone else to do so with content we send them on your behalf. We do not sell your personal data, and we do not use your content in our own advertising or marketing.
One thing we do that is adjacent, and that we would rather state plainly than bury. When an agent run succeeds, we may keep the sequence of editing commands it produced, with the instruction that prompted it, as an internal example that helps the agent plan better next time. This is a record of which editor operations were combined in which order. It is not your media, and your footage, transcripts and rendered frames are never part of it. Email us if you would rather your runs were excluded and we will exclude them.
4. What never leaves your browser
Some analysis runs entirely on your own machine, and the media involved is never uploaded for it:
- Visual labelling.A small image model runs in your browser to work out what your footage shows, so the agent can find “the coffee b-roll” without you naming the file. Only the resulting words are saved.
- Silence and dead-air detection. Plain signal processing on the audio in the page.
- Media held only on your device. Anything the server cannot reach is transcribed in the browser instead.
- Location on Vidmoat Social. If you add a place to a post, your device turns the coordinates into a place name. We store the name. We never receive the coordinates.
The model files for the in-browser work are downloaded from the jsDelivr CDN, which will see your IP address as it would for any other file your browser fetches.
5. Your media, specifically
Uploads are stored on our own server in Helsinki, Finland, and mirrored to an object store in Stockholm, Sweden. Both are in the European Union. Exports are stored alongside them. A further copy of uploads and exports is kept in Cloudflare R2 (Western Europe) so that videos play quickly from Cloudflare’s network wherever you are; deleting a file deletes that copy too.
Files you upload are private to your account unless you publish them. Sharing a render creates a link that anyone holding it can view; you can revoke it. Posting to Vidmoat Social makes that video public.
Exports carry an invisible identifier.Every MP4 we render has a short code woven into the pixels, and a signed tag in the file’s metadata. They survive re-encoding. We use them to tell where a file came from: to answer a copyright complaint, to investigate abuse, and to prove provenance if you ever need to show a video is yours. They identify the export, not you personally, and we do not scan the internet looking for them.
6. AI features and the providers behind them
Vidmoat’s AI features are built on models run by other companies. To answer your instruction we have to send them something. This is what goes where.
| Provider | Where | What we send |
|---|---|---|
| OpenAI | United States | Your instruction, a description of your timeline, and sampled video frames when a request needs to see the picture. While you use live voice, the sound from your microphone, streamed from your browser for that session. Text you ask to have spoken, and sticker prompts. When Qwen is unavailable, the same still frames and transcript words Qwen receives for aggregate statistics (section 2a) |
| Alibaba Cloud (Qwen) | Singapore | Your instruction, a description of your timeline, and sampled video frames when a request needs to know what is on screen. To group projects by type for aggregate statistics (section 2a), we may also send four small still frames of a project’s main video and up to 300 words of its transcript, never who made it |
| Anthropic (Claude) | United States | Your instruction and a description of your timeline, for agent runs on paid plans |
| DeepSeek | China | Your instruction and a description of your timeline, when it is next in line |
| xAI (Grok) | United States | Your instruction; and for image, video or voice generation, your prompt |
| OpenRouter | United States | Your instruction and a description of your timeline, when it is next in line. OpenRouter passes the request to the model it routes to |
| Google (Gemini) | United States | The video you upload, or the part of it being asked about, picture and soundtrack together, so the agent knows what your footage shows and what it sounds like. A short audio extract when the agent checks how a clip sounds. YouTube links you give as a style reference, and prompts for music generation |
| Cloudflare (Workers AI) | United States company; processed in its own network, normally its Helsinki data centre | The sound only of a recording you have transcribed, extracted from the file in pieces of about two minutes, so captions and transcripts can be made from it. Never the picture, the file name or who you are |
A “description of your timeline” means clip names, durations, settings and any text you placed on screen. It can also include your speech transcript where the request depends on what was said. Sampled frames are still images taken from your video, tiled into one picture with timestamps.
Where your audio goes.Transcription is done by Cloudflare Workers AI: when you ask for captions or a transcript, we extract the sound from the recording and send it, and only it, to a speech model Cloudflare runs for us. If Cloudflare cannot be reached, the same sound is transcribed on Vidmoat’s own server by our own speech model instead, and media our server cannot reach is transcribed in your browser. Audio also reaches two providers for other features. Google (Gemini) hears a video’s soundtrack along with its picture when it describes your footage, and a short extract when the agent checks how a clip sounds. OpenAI hears your microphone while you talk to the agent in live voice, and turns what you say into the instruction it acts on.
The code can also send audio to OpenAI’s transcription service, but only if the server’s configuration names it, and it does not. An error at Cloudflare or on our own server never sends your audio to OpenAI instead. The Subprocessors page lists that path as built but not switched on.
How long providers keep it.We delete a video from Google as soon as its description comes back, and Google deletes any uploaded file it still holds after 48 hours. Live voice sessions are opened with storage turned off. Cloudflare does not store the audio we send it for transcription and does not use it to train models, under its Workers AI data terms; we do not route it through Cloudflare’s logging gateway. We use every provider above through its paid API, whose terms do not let it train models on what we send; a provider may keep requests for a limited time to detect abuse (OpenAI says up to 30 days) and then deletes them.
If you connect your own AI provider key, your content goes to that provider under your account and their terms, and we store the key encrypted.
7. Connecting an AI assistant to Vidmoat
You can connect an outside AI assistant — ChatGPT, Claude, or any other client that speaks the Model Context Protocol — to your Vidmoat account, and let it edit on your behalf. This section is about that specific arrangement, because it is the one case where a company we have no contract with can read your work, and you are the one who decides that.
Who receives your data. The operator of the assistant you connect. If you connect ChatGPT, that is OpenAI; if you connect Claude, that is Anthropic. They receive whatever the tools return, they are a controller of it in their own right, and what they then do with it is governed by their privacy policy and not by ours. We do not choose the assistant, we cannot see inside it, and we cannot delete data on your behalf once it has been handed over. Connecting one is a decision to share, and it is worth reading their policy before you make it.
What the tools send and return. Nothing is sent until the assistant calls a tool, and every call is made under permissions you granted. The categories, in full:
| Permission | What the assistant can send in | What comes back to it |
|---|---|---|
| See your plan and credits | Nothing | Your plan name, remaining AI credits and export allowance |
| Read your projects | A project id | The edit document: clip names, timings, settings, every word of text you placed on screen, and the speech transcript where one has been made |
| Create, edit and delete projects | Editing commands, and any text or styling they carry | The updated document, and what each command did |
| List your media | Nothing | File names, sizes, durations and the URLs your media is served from |
| Upload and import media | A file, or a URL to fetch one from | The stored file’s URL and its measured dimensions, duration and codec |
| Check renders and fetch frames | A project id and a timecode | Render progress, and still images of your video at the times it asks for |
| Start renders | Output settings | A job id, and the finished file’s URL. This spends your monthly export allowance. |
| Transcribe, generate speech, images or video | Your prompt, and the media to work from | The words that were said, or the generated file’s URL. These spend your credits and run through the providers named in section 6. |
| Analyse footage | A project or media id | Scenes, faces, motion, speech activity and on-screen text found in your footage |
| Run the AI editing agent | Your instruction | The edits it made. The instruction and a description of your timeline also go to the AI providers in section 6. |
| Search stock media | Search terms | Stock results from our library provider |
| Manage webhook endpoints | A webhook URL and the events it requests | This permission is reserved in the connection vocabulary. The public MCP server does not currently expose webhook management; no endpoint or event is created unless that feature is enabled. |
| Call third-party plugins | Arguments for the plugin tool you chose | Whatever the plugin returns. Calling third-party plugins sends data to the plugin’s own server; the plugin operator receives the arguments there, and Vidmoat does not give it your credentials. |
| See the people using your Telegram bot | Optionally a search term or a Telegram user id or @username | For a developer’s own Telegram bot only: each person’s Telegram id, username and display name, when they were first and last seen, and how many messages and credits they used. Never their footage or messages. |
| Manage the people using your Telegram bot | A Telegram user id or @username, and whether to allow or block them or the daily limit to give them | That person’s updated standing on the developer’s bot. It changes nothing on anybody’s Vidmoat account. |
The public MCP documentation lists the endpoint, connection flow, current tool groups and the data categories returned by each permission.
Why.Only to carry out the instruction you gave the assistant. We do not use anything an assistant reads or writes to train models — section 3 applies here without exception — and we do not profile you from it or sell it to anybody.
What you control, and how. When a client asks to connect, we show you exactly which of the permissions above it wants and you approve or refuse the whole request; nothing is granted silently, and an app can never be given more than the ceiling set for it. A grant that already exists cannot widen itself: a client asking for more comes back to you as a fresh decision. You can see every connection, and revoke any of them, at vidmoat.com/oauth/connected. That page lists both kinds: apps built on Vidmoat by a developer, and AI assistants such as Claude or ChatGPT that registered themselves to connect over MCP. Revoking is immediate: every access and refresh token for that connection is deleted, so its next call is refused, and connecting again asks for your approval again. Deleting your account deletes them all.
How long we keep it.The connection itself — which app, which permissions, when you approved it — lasts until you revoke it or close your account. Access tokens issued now are stored only as a one-way hash; a small number of older ones, from before we made that change, are still stored directly and are replaced by hashes as those connections refresh. We keep two separate logs of calls, with different retention. Each call an assistant makes through our MCP server is recorded in the MCP call log: which tool it used, the name of the assistant app, the project it worked on, the kind of edits it made, whether it succeeded, how long it took, the credits it used and a country derived from the connection. The log never holds your prompts, captions, text, media links or access tokens, and it is kept for 90 days. The public API request log is a different log: it records calls to our REST API (api.vidmoat.com/api/v1), usually made with a personal API key, and is kept for 30 days. An assistant connected over MCP does not appear in it. Both kinds of call can also appear in the agent run records described in section 10. Anything the assistant did to your projects is simply part of your projects, and follows the same retention as the rest of your work.
One thing we cannot promise. An assistant acts on instructions you give it in a conversation we cannot see. If you ask it to delete a project or start a render, it will, and that spends your allowance or removes your work exactly as if you had done it yourself. Grant only the permissions you want used, and revoke a connection you are no longer using.
8. Everyone else who processes your data
Beyond the AI providers above, these companies process personal data for us. The current list is kept at vidmoat.com/subprocessors.
- Hosting and storage. Hetzner (Finland), Amazon Web Services (Sweden), Vercel (front end).
- Sign-in. Google Firebase Authentication.
- Payments. Dodo Payments, Paystack, PayPal, and Apple with RevenueCat for in-app purchases.
- Affiliate payouts.Wise (Wise Payments Limited) receives an affiliate’s payout email, name, currency and payout amount. See section 11a.
- Email. Customer.io sends our transactional and marketing email and receives your email address and product events.
- Website analytics. PostHog and Vercel Analytics, when you enable usage analytics.
- Error monitoring. Sentry receives application error messages, stack traces, release details and a small sample of performance reports. Browser reporting requires usage analytics consent. We exclude request bodies, cookies, user profiles and session recordings, and filter common credentials and email addresses from error messages.
- Support chat. Tawk.to, which receives your name, email, plan and user ID after you enable live chat. When you ask to talk to a person, we also share your support question, what you have already tried, and the page you are on; never your access tokens.
- Push notifications. Expo and Apple.
- Stock media. Pexels, Pixabay and Freesound receive your search words when you search their libraries.
- Chat channels. Telegram, Discord and WhatsApp, if you link one.
- Social platforms. See section 9.
- Plugins. If you install a third-party plugin, the arguments the agent sends it may contain your content. A plugin never receives your Vidmoat credentials.
9. Sending data outside the UK and EU
Your account records and your media stay in the European Union. AI processing does not: as section 6 sets out, instructions and sampled frames go to providers in Singapore, China and the United States, and the sound of recordings you transcribe goes to Cloudflare, a United States company, normally processed in its Helsinki data centre. Support, email, analytics and payment providers are variously in the United States and the EU.
Neither Singapore nor China has a UK or EU adequacy decision. Where we transfer personal data to a country without one, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the risk in that country. You can ask us for details of the mechanism used for a particular provider.
If you would rather your content were not sent abroad for AI processing at all, do not use the AI features. Everything else in the editor works without them.
10. How long we keep things
| What | How long |
|---|---|
| Your account, projects and media | Until you delete them or close your account |
| Uploaded files no project references any more | 72 hours, then deleted |
| Deleted media in the backup store | Up to 30 days, because the store keeps versions |
| Interface usage events | 90 days |
| Server events | 400 days |
| Public REST API request logs (/api/v1) | 30 days |
| Assistant (MCP) call logs, a separate log | 90 days |
| Notifications you have read | 60 days |
| Billing records and invoices | 7 years, to meet UK tax law |
| Affiliate commissions and payouts | 7 years, to meet UK tax law |
| Referral link clicks | 13 months; their network hashes become unlinkable after about 90 days |
| The referral token in your browser | 60 days, or until it is used at signup |
| Evidence in a child-safety report | 1 year, and it cannot be deleted on request |
Speech transcripts and video descriptions are cached against the file they came from so we do not redo the work, and are removed when the file is. Agent run records are kept while the account exists, because they are how a disputed charge gets settled.
11a. The affiliate program
Vidmoat runs an affiliate program at affiliate.vidmoat.com: affiliates share links and earn a commission when the people they refer pay us. It involves two kinds of people, and we hold different things about each.
If you open somebody’s referral link
When a page opened from a referral link loads in your browser (or the app), we record the click: which link, when, the page it landed on, the host name of the site you came from, a country worked out from your network address, and a one-way hash of that address made with a secret that changes every month and is deleted after about 90 days, after which the hash cannot be linked to an address by anyone. We do not keep the address itself. Your browser keeps a referral token (the vm_ref cookie and local storage entry) for up to 60 days; it contains no personal data and is used only to credit the right affiliate if you create an account. Nothing is recorded from a link that is only displayed, prefetched or opened in a hidden frame. The token is set whatever you choose in the cookie banner: crediting the person who sent you is part of the service they and we agreed, it holds nothing that identifies you, and we rely on legitimate interests for it. Clearing your browser’s storage removes it.
If you then create an account, we record which affiliate referred you, the first letter of your name, and your country. When you pay for a plan we calculate the affiliate’s commission from what you paid. The affiliate never sees your name, email, network address or payment details: only a masked label (for example “J*** from Ghana, signed up 3 Oct, Creator monthly, month 2 of 6”), the commission each payment earned, and totals. We compare a new referral with the affiliate’s own account (email, linked Telegram account, device, payment customer and network hash) to stop people referring themselves; that comparison never reaches the affiliate. Our legal basis is our legitimate interest in running the program honestly and preventing fraud.
If you are an affiliate
We keep your application (where and how you will promote Vidmoat, your audience size and country), a risk review of your account for the person who decides on it, your links and their numbers, your commission ledger and payouts, a hash of the network addresses you sign in from (for the self-referral check above), and your payout details: the email address Wise should pay (stored encrypted), your name, country and currency, and your tax acknowledgement. We never ask for or hold your bank details. To pay you, we send Wiseyour payout email, name, currency and the amount; Wise’s own privacy notice covers what it then holds. Our legal basis is the contract in the Affiliate Terms, and our legal obligation to keep payment records. If you delete your Vidmoat account, your payout details, application and network hashes are deleted; the commission and payout records stay, without your details, as accounting records.
12. Your rights
You can ask us to:
- give you a copy of what we hold about you;
- correct anything wrong;
- delete your data, subject to records we must keep by law;
- restrict or object to processing, including profiling;
- give you your data in a portable form;
- stop sending marketing, at any time and with no reason needed.
You can delete your account yourself from your dashboard, which removes your projects, your uploaded files and your exports. Or email support@s-ticketing.vidmoat.com and we will action any of the above within one month.
If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your own country’s supervisory authority. We would rather you told us first.
California residents. We do not sell personal information and we do not share it for cross-context behavioural advertising. You have the right to know, delete and correct, and we will not treat you differently for exercising it. We honour Global Privacy Control signals.
13. Security
Access tokens for social platforms and plugins, connected AI provider keys and any credentials you store for browser automation are encrypted at rest with AES-256-GCM, and the encryption fails closed: if the key is missing, nothing is stored rather than something being stored in the clear. API keys are held only as hashes and shown once. Support diagnostics are built from an allowlist that explicitly excludes secrets.
No service is perfectly secure. If we discover a breach affecting your rights we will tell you and the ICO as the law requires.
14. Age
Vidmoat is for adults. You must be at least 18 to use it, or older if your country sets a higher age for agreeing to terms like these. Many Vidmoat features run on generative AI services whose providers do not allow them to be offered to anyone under 18.
We ask every account to confirm it: when the account is created, or once, at the next sign-in, for an account created before the minimum age became 18. We keep your answer and the time you gave it. AI features stay off until you answer.
We do not knowingly collect data from anyone under 18. If someone tells us they are under 18, the account is closed to use straight away (they can still download or delete their data), a person at Vidmoat reviews it, and unless the answer was a mistake we delete the account and its data. If you believe someone under 18 is using Vidmoat, tell us at support@s-ticketing.vidmoat.com.
16. Changes
When this notice changes materially we will say so in the product and update the date at the top. If a change means we would be doing something with your content that this version does not allow, we will ask first.
Changed on 17 October 2026: the minimum age is now 18 (it was 16), every account is asked to confirm it, and section 1 now lists the answer we keep. Section 14 explains. A new section 2a says how we produce aggregate usage statistics, that we may share them, and how to opt out, including with a Global Privacy Control signal; section 2 lists its legal basis, and section 6 says which providers may receive still frames for it.
17. Contact
Buzz Innovations Ltd, registered in England and Wales, company number 17212684.
Email: support@s-ticketing.vidmoat.com
See also our Terms of Service, our list of subprocessors, and, if you use the public feed, the Vidmoat Social privacy notice.
11. Publishing to social platforms
If you connect YouTube, TikTok, Instagram, Facebook, Threads, LinkedIn, X or Pinterest, we store an encrypted access token, the account name and its avatar so you can tell your channels apart. We use them only to do what you asked: post the video you chose, and read back that post’s public statistics.
YouTube, Instagram, Facebook and LinkedIn may instead be connected through Composio (Composio, Inc., United States), which connects social accounts and holds their access tokens for us. When a platform is connected that way, Composio, not Vidmoat, stores the access token, and we store only Composio’s reference to the connection, the account name and its avatar. To post, we ask Composio to send the platform the video you chose (by a link to the exported file, or for YouTube a copy of the file), with its caption. Composio acts on our instructions and only for that purpose.
Where it is switched on for your account, you can also connect other apps (for example Google Drive, Gmail or Notion) for the editing agent to use through Composio, when nothing built into Vidmoat can do what you asked. Composio, not Vidmoat, stores those apps’ access tokens; we store only its reference to the connection and which app it is. When the agent uses a connected app, we send Composio the request it needs (for example the name of a file to fetch, or the text of a message you approved), and receive the app’s answer, which the agent reads to do your request; files it brings back are saved to your media library like an upload. Anything that sends, changes or deletes something in an app runs only after you approve that exact action. We keep a record of each action (which app, which action, when, what was decided, and the names of any files it brought into your media library), not its content. The agent never uses apps for payments, money transfers, cryptocurrency, passwords or account security. Disconnecting an app on your account page, or deleting your account, deletes the connection at Composio and the tokens it holds.
Vidmoat’s use of information received from Google APIs, including YouTube, follows the Google API Services User Data Policy, including its Limited Use requirements. Data we obtain from YouTube is used only to provide the features you asked for and is not sold, transferred for advertising, or used for any other purpose. You can revoke our access at any time in your Google account permissions, and Google’s own Privacy Policy applies to what they hold.
Disconnecting a platform in Vidmoat deletes the token we hold for it, and for an account connected through Composio, deletes that connection at Composio and the tokens it holds. It does not delete anything already posted to that platform: only the platform can do that. You can also remove Vidmoat’s access in the platform’s own settings at any time.