Privacy Policy

Data controller

The data controller is Tab2Vid.

For any matter regarding your personal data you can write to support@tab2vid.com.

Data we collect

We only collect the data needed to provide the Service:

• Registration data: email address and name. The password is stored only in encrypted form (bcrypt hash) and is not readable by us.
• Sign in with Google (optional): if you choose to sign in with Google, we receive your email address, name and profile image from Google.
• Usage data: the minutes of video generated in the month and your generation history, limited to metadata only (song title, track, instrument, duration, format and chosen colors). We do not keep the videos produced.
• Music files uploaded by the user: any file the user holds is their property and responsibility. On the platform they are processed temporarily to generate the video and deleted immediately afterwards. We do not store them.
• Styles and favorites: the video styles you save on the generation page (name, view, format, animation, size, colors, musical markings), which one to open with, how many videos you generated with each, and your favorite colors. They are only used to offer them back to you: you can edit or delete them at any time from the same page.
• Logo (Pro plans only): the image you upload as your logo, in its original and cropped versions, with the crop measurements. It is used only to place it in your videos, where and how you choose. We keep it until you delete it from the generation page or delete your account: in both cases we erase it.
• Payment data: payments are handled by Stripe. We only keep the customer identifier and the subscription status. We do not process or store your card details.
• Technical and security data: the IP address used at registration, a random device identifier (technical cookie, 1 year) and a technical browser fingerprint computed from its characteristics (version, language, time zone, screen, graphics rendering). They serve to prevent the free trial from being renewed by creating multiple accounts: they do not profile you and do not track you across other sites. We also collect your preferred language and essential technical logs. The IP address is also used to work out your country, only in aggregate form, so we know where our users come from.
• Ambassador code: if you register through a promotional code, we store it to correctly attribute the sign-up.

Purposes and legal bases

We process data for the following purposes:

• Providing the Service, managing your account and authentication (performance of the contract, art. 6.1.b GDPR).
• Managing payments, subscriptions and tax obligations (performance of the contract and legal obligation, art. 6.1.b and 6.1.c).
• Ensuring security and preventing abuse of the free trial, by means of the device identifier and the technical browser fingerprint, and by comparing the email, name, language and sign-up network with those of other accounts in order to flag possible duplicate accounts to the administrator: the comparison does not block anyone (legitimate interest, art. 6.1.f).
• Knowing, in aggregate form, which countries our users come from: the country is worked out from the IP address used at sign-up, with a database queried on our own servers, without sending the address to third parties (legitimate interest, art. 6.1.f).
• Sending you the necessary service communications (email verification, password reset, subscription status, quota alerts): performance of the contract.
• Sending you informational or promotional communications about the Service (newsletter): at registration you are subscribed to the newsletter, in addition to service emails. You can turn off the newsletter at any time from your account area; service emails, needed for the account to work, cannot be turned off. The legal basis is consent or legitimate interest for existing customers.
• Measuring site usage and advertising performance through Google Analytics and Meta Pixel: the legal basis is consent (art. 6.1.a GDPR). These tools only start after you accept them in the banner, and you can withdraw your consent at any time. The events sent are page views, completed sign-ups and subscription purchases with amount and currency; we do not transmit your email, your name or any other identifying data.

How long we keep data

• Account data is kept as long as the account is active. On deletion, data is removed within a reasonable time, except what must be kept by law.
• Uploaded music files are deleted immediately after processing.
• The Pro plan logo is kept until you delete it or delete your account.
• The generation history (metadata only) remains as long as the account is active.
• Payment and billing data is kept for the time required by tax and civil-law obligations (usually 10 years).
• Accounts registered by email and never confirmed are deleted, with their data, 7 days after registration. After 48 hours we send a reminder with a new confirmation link.

Who we share data with

To run the Service we rely on external providers that process data on our behalf, as data processors:

• Railway: hosting of the application and the database.
• Stripe: handling of payments and subscriptions.
• Resend: sending of service emails and newsletters.
• Google: only if you use sign in with Google.
• Google: statistical analysis of site usage (Google Analytics), only if you consent to statistics cookies.
• Meta: advertising measurement and retargeting (Meta Pixel), only if you consent to marketing cookies. For the collection and transmission of this data, Meta and we act as joint controllers.

We do not sell your data to third parties.

Transfers outside the European Union

Some providers may process data also outside the European Union, for example in the United States. In such cases the transfer takes place with the safeguards required by the GDPR, such as the standard contractual clauses approved by the European Commission.

Your rights

At any time you can exercise the rights provided by the GDPR:

• Access to your data and its rectification.
• Erasure ("right to be forgotten"): you can delete your account directly from your account area, which cancels the subscription and removes the related data.
• Restriction of and objection to processing.
• Data portability.
• Withdrawal of consent, where processing is based on consent.
• For statistics and marketing cookies you can withdraw your consent at any time from the “Cookie preferences” link at the bottom of every page.

Security

We adopt appropriate technical and organizational measures to protect data. Passwords are stored only in encrypted form, connections are secured and access to data is restricted.

Minors

The Service is intended for users aged at least 16. Minors may use the paid features only with the consent and under the responsibility of a parent or guardian. We do not knowingly collect data of minors under 16; if you believe this has happened, contact us and we will remove it.

Changes to this policy

We may update this policy over time. The updated version will always be available on this page, with the date of the last update.

Contact

For any question about data processing: support@tab2vid.com.

Free trial, invites and abuse prevention

The free trial provides a one-off number of minutes. To prevent it from being renewed indefinitely, and to run the “Invite a friend” programme, we process some additional data:

• Record of minutes used, linked to the email address only: if you delete your account we keep your email address in this separate record, without the other profile data, for the sole purpose of preventing the free trial from starting over by signing up again with the same address (legitimate interest, art. 6.1.f GDPR).
• Invite a friend: we generate a personal code linked to your account and, if you sign up through another user's link, we store the code of whoever invited you so the bonus minutes can be awarded to both of you.
• Visits to the invite link: we count how many times your link is opened, with the date only. We do not record who opens it, and we never show the inviter the name or email of the people who signed up: only the number.
• Self-invite check: we verify that inviter and invitee are not the same device or the same browser. If they are, the minutes are not awarded.