Privacy Policy

1. Who we are

The controller of your personal data is MEGAFLOW LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA (EIN 98-1935278). You can reach us at support@brollbot.com.

This policy applies to our website, our editor and any other service that links to it (together, the “Service”).

2. Information we collect

Information you provide

• Account data: name, email address and password (stored only as a salted hash).
• Your projects: your video file is processed in your browser and is never uploaded to us. For each project we store the transcript, word timings, the B-roll choices, caption settings and your brand settings (colour, font and an optional small logo). Short audio chunks are sent to our speech-to-text provider to create the transcript; we do not store the audio. These items can contain personal data about you or other people who speak in your video.
• Billing data: handled by Stripe. We receive your purchase status and limited payment details such as card brand and last four digits, not your full card number.
• Communications: support requests, refund requests, feedback and anything else you send us, for example through the contact form.

Information collected automatically

• Log and usage data: IP address, browser type, pages visited, actions in the product, timestamps and error reports.
• Device data: device type, operating system, language and screen size.
• Cookies and similar technologies: described in our Cookie Policy.

Information from others

In our Stripe account we see whether a payment succeeded, the plan bought and the email used at checkout. We use this to activate your plan.

3. How we use your information and our legal bases

• To provide the Service: transcribing your videos, matching B-roll from Pexels, a licensed stock library, rendering and exporting. Legal basis: performance of a contract.
• To process payments, keep billing records and prevent fraud. Contract, legal obligation, legitimate interests.
• To secure, maintain and improve the Service, including debugging and measuring which features are used. Legitimate interests.
• To communicate with you: confirmations, security alerts, support replies and important service notices. Contract, legitimate interests.
• To send product news or marketing, only where you have opted in or where the law allows, and you can unsubscribe at any time. Consent or legitimate interests.
• To comply with the law and to establish, exercise or defend legal claims. Legal obligation, legitimate interests.

Where we rely on legitimate interests, we balance them against your rights and interests. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

4. AI-generated content and model training

The Service uses automated systems to transcribe speech, choose footage and draft captions. Output is generated by AI, can contain mistakes and is a suggestion for you to review. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

We do not use your videos, audio or transcripts to train or fine-tune any model, and the providers we use to run the service process your content only to return a result to you. We will never start using your content for training without first asking for your explicit consent.

5. How we share your information

We do not sell your personal data. We share it only in these situations:

• Service providers (sub-processors) that process data on our behalf, such as hosting, speech-to-text, stock footage search and payments (listed in section 8).
• Authorities and advisers, where required by law, court order or valid legal process, or to protect the rights, safety and property of our users, the public or us.
• A successor, if we are involved in a merger, acquisition, financing or sale of assets. We will tell you if your data becomes subject to a different privacy policy.
• Anyone else, with your consent or at your direction.

6. People who appear in your videos

If your video contains other people, you are responsible for having the right to use it and for telling those people where the law requires it. We process their data only to produce your edit. If you are a data controller for that content and we process it for you, contact us about a data processing agreement.

7. Data retention

• Projects (transcripts, edit decisions, brand settings): deleted automatically 30 days after creation, or sooner when you delete a project. Your video and audio are never stored by us, and exports are created on your device.
• Account data: kept while your account is open and deleted or anonymised after you close it, except where we must keep it.
• Billing and tax records: kept for the period required by accounting and tax law.
• Contact form messages: deleted automatically 12 months after they are sent.
• Logs and support messages: kept only as long as needed to run, secure and support the service, then deleted or anonymised.

8. Sub-processors and international transfers

We may process and store data in countries other than your own, including countries that may not offer the same level of data protection. Where we transfer personal data out of the EEA, UK or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses. The providers below process data on our behalf:

9. Your rights and choices

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA or similar laws), you may have the right to:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate or incomplete data.
• Delete your data (“erasure”), subject to legal exceptions.
• Export your data in a portable format.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of personal data. We do not sell or share it for cross-context advertising.
• Not be discriminated against for using these rights.
• Complain to your local data protection authority.

To use a right, email support@brollbot.com from your account address. We may ask you to verify your identity, and we aim to respond within one month, or sooner where the law requires. You may also use an authorised agent where your local law allows.

10. Cookies and similar technologies

We use one essential cookie to keep you signed in (bb_session, 30 days) and one local-storage entry for your light or dark theme. We do not use analytics or advertising cookies. Details are in our Cookie Policy. We do not currently respond to “Do Not Track” signals because no industry standard exists.

11. Security

We use technical and organisational measures to protect personal data. No system is completely secure, so we cannot guarantee absolute security. Our Security page describes our practices and how to report a vulnerability. If a breach affects your data, we will notify you and the relevant authorities where the law requires.

12. Children

The Service is not directed at anyone under 18 and we do not knowingly collect personal data from children. If you think a child has given us data, email support@brollbot.com and we will delete it.

13. Third-party links

Our site may link to other websites, including Stripe checkout. Their privacy practices are their own and this policy does not cover them.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here and change the “Last updated” date. For material changes we will notify account holders by email or in the product before they take effect.

15. Contact and complaints

MEGAFLOW LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Email: support@brollbot.com. Phone: +1 343 296-9026. If you are not satisfied with our response, you can contact your local data protection authority.