Privacy Policy

Data controller

The data controller is Tab2Vid.

For any matter regarding your personal data you can write to support@tab2vid.com.

Data we collect

We only collect the data needed to provide the Service:

• Registration data: email address and name. The password is stored only in encrypted form (bcrypt hash) and is not readable by us.
• Sign in with Google (optional): if you choose to sign in with Google, we receive your email address, name and profile image from Google.
• Usage data: the minutes of video generated in the month and your generation history, limited to metadata only (song title, track, instrument, duration, format and chosen colors). We do not keep the videos produced.
• Files uploaded by the user: any file the user holds is their property and responsibility. On the platform they are processed temporarily to generate the video and deleted immediately afterwards. We do not store them.
• Payment data: payments are handled by Stripe. We only keep the customer identifier and the subscription status. We do not process or store your card details.
• Technical and security data: the IP address used at registration, a random device identifier (technical cookie, 1 year) and a technical browser fingerprint computed from its characteristics (version, language, time zone, screen, graphics rendering). They serve to prevent the free trial from being renewed by creating multiple accounts: they do not profile you and do not track you across other sites. We also collect your preferred language and essential technical logs.
• Ambassador code: if you register through a promotional code, we store it to correctly attribute the sign-up.

Purposes and legal bases

We process data for the following purposes:

• Providing the Service, managing your account and authentication (performance of the contract, art. 6.1.b GDPR).
• Managing payments, subscriptions and tax obligations (performance of the contract and legal obligation, art. 6.1.b and 6.1.c).
• Ensuring security and preventing abuse of the free trial, by means of the device identifier and the technical browser fingerprint (legitimate interest, art. 6.1.f).
• Sending you the necessary service communications (email verification, password reset, subscription status, quota alerts): performance of the contract.
• Sending you informational or promotional communications about the Service (newsletter): at registration you are subscribed to the newsletter, in addition to service emails. You can turn off the newsletter at any time from your account area; service emails, needed for the account to work, cannot be turned off. The legal basis is consent or legitimate interest for existing customers.

How long we keep data

• Account data is kept as long as the account is active. On deletion, data is removed within a reasonable time, except what must be kept by law.
• Uploaded files are deleted immediately after processing.
• The generation history (metadata only) remains as long as the account is active.
• Payment and billing data is kept for the time required by tax and civil-law obligations (usually 10 years).

Who we share data with

To run the Service we rely on external providers that process data on our behalf, as data processors:

• Railway: hosting of the application and the database.
• Stripe: handling of payments and subscriptions.
• Resend: sending of service emails and newsletters.
• Google: only if you use sign in with Google.

We do not sell your data to third parties.

Transfers outside the European Union

Some providers may process data also outside the European Union, for example in the United States. In such cases the transfer takes place with the safeguards required by the GDPR, such as the standard contractual clauses approved by the European Commission.

Your rights

At any time you can exercise the rights provided by the GDPR:

• Access to your data and its rectification.
• Erasure ("right to be forgotten"): you can delete your account directly from your account area, which cancels the subscription and removes the related data.
• Restriction of and objection to processing.
• Data portability.
• Withdrawal of consent, where processing is based on consent.

Security

We adopt appropriate technical and organizational measures to protect data. Passwords are stored only in encrypted form, connections are secured and access to data is restricted.

Minors

The Service is intended for users aged at least 16. Minors may use the paid features only with the consent and under the responsibility of a parent or guardian. We do not knowingly collect data of minors under 16; if you believe this has happened, contact us and we will remove it.

Changes to this policy

We may update this policy over time. The updated version will always be available on this page, with the date of the last update.

Contact

For any question about data processing: support@tab2vid.com.

Free trial, invites and abuse prevention

The free trial provides a one-off number of minutes. To prevent it from being renewed indefinitely, and to run the “Invite a friend” programme, we process some additional data:

• Record of minutes used, linked to the email address only: if you delete your account we keep your email address in this separate record, without the other profile data, for the sole purpose of preventing the free trial from starting over by signing up again with the same address (legitimate interest, art. 6.1.f GDPR).
• Invite a friend: we generate a personal code linked to your account and, if you sign up through another user's link, we store the code of whoever invited you so the bonus minutes can be awarded to both of you.
• Visits to the invite link: we count how many times your link is opened, with the date only. We do not record who opens it, and we never show the inviter the name or email of the people who signed up: only the number.
• Self-invite check: we verify that inviter and invitee are not the same device or the same browser. If they are, the minutes are not awarded.