Privacy Policy

1.1 Glyphcast is a sole proprietorship of Harsh Baldaniya registered in India, with its registered address in Gujarat 395012, India (“we”, “us”). We are the Data Fiduciary, under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), for the personal data this policy describes.

1.2 This policy covers the website at www.glyphcast.app, the application, the API at api.glyphcast.app, the connection for AI assistants, and public Brand pages. Words defined in the Terms of Service, such as “Account”, “Content” and “Output”, have the same meaning here. “Personal data”, “processing” and “Data Principal” have the meanings given in the DPDP Act.

1.3 This policy is also published under the Information Technology Act, 2000 and the rules made under it.

• Account details. Your first and last name and email address. If you sign in with a password, we store it only as a scrypt hash. If you sign in with or connect Google, we receive from Google your name, email address, profile picture and Google account identifier; we never receive your Google password.
• Profile photo. A photo you upload. After you remove or replace it, the previous one is kept so that you can restore it, until your next upload.
• Content and Output. The videos you upload, and the transcripts, analysis, moments, clips, captions, titles and post text made from them. Content can contain personal data of you and of others, such as faces, voices and names spoken aloud.
• Workspace and Playbook details.A brand's name, mark or logo, description, website, email address and social links, the files you add to its Playbook, and what is suggested when you ask us to read the brand's website.
• Payment details. The Plans and packs you buy, amounts, dates, status and payment references, and the mobile number that Cashfree requires for a payment. We do not receive card numbers, CVVs, UPI PINs or bank credentials.
• Credit records. The Credits your Account received and spent, on what and when.
• Sign-in and security records. For each signed-in session: the IP address, an approximate location (city, region and country) derived from it, the browser and operating system, and the times it was created and last used. At sign-up, a keyed hash of your network address (not the address itself).
• AI assistant connections. For each assistant you connect: its name and return address, the permissions you granted, and when it was last used.
• Correspondence. What you send us by email.
• Technical logs. Records kept by our servers and hosting providers of requests to the Service, which can include IP addresses, browser details and times.

• We use no advertising or analytics trackers, and set no advertising cookies.
• We do not sell personal data, or share it for anyone else's marketing.
• We do not use your Content or Output to train AI models.
• We do not post or publish anything on your behalf to any social platform.

4.1 We process personal data only for these purposes, and only as much as each needs:

1. to create and run your Account and sign you in;
2. to provide the Service: to process your Content, produce Output, store it and serve it back to you;
3. to take payments, keep Credit and billing records, and handle refunds and payment disputes;
4. to keep the Service secure and fair: rate limits, protecting the Free plan's Credits from repeat claims, and investigating misuse;
5. to answer support requests and give you notices about the Service; and
6. to comply with the law, enforce our Terms, and respond to lawful requests.

4.2 We rely on the consent you give when you create an Account and accept this policy, and, where they apply, on the legitimate uses in section 7 of the DPDP Act, including where you have voluntarily provided data for a specified purpose and where processing is needed to comply with the law.

4.3 You may withdraw your consent at any time by writing to privacy@glyphcast.app. Withdrawal does not affect processing already done. Because the Service cannot be provided without this data, withdrawing consent means closing your Account; we then stop processing and erase the data, except what the law requires us to keep.

5.1 On our servers. Your upload, its playback copies, scene and motion detection, audio analysis, cutting, caption rendering and editor exports are processed on our own servers. Where a layout you choose needs it, the software locates faces in the picture to frame the clip; it does not recognise who anyone is.

5.2 Sent to Google.To transcribe your video and to judge which moments are worth cutting, we send Google's Gemini models: the audio of your video, in pieces; still frames from candidate moments, with the transcript of what is said in them; and, for titles and post text, a clip's thumbnail and transcript. Caption text is sent to Gemini when you ask for captions to be translated. We do not send your account details with any of it.

5.3 If Gemini does not answer, the missing part of the transcript is made by a speech-recognition model running on our own servers.

5.4We use Gemini through Google's paid services (Vertex AI on Google Cloud, and the Gemini API on paid billing). Google's published terms for these paid services state that Google does not use the data submitted to them to train its models. Google may keep that data for a limited time under its own terms, for example to detect abuse.

6.1 Our processors. These providers process personal data on our behalf and on our instructions, not for their own purposes:

• Google Cloud: hosts our servers, database and stored files.
• Google (Gemini models): receives the audio, frames and text described in section 5.
• Cloudflare: domain name and network services for the API, which see your IP address and request details.
• Vercel: hosts the website, and sees your IP address and request details.
• Cashfree Payments India Private Limited: processes payments. It receives your name, email address, mobile number, the amount and our order reference, and you enter your payment details directly with it.
• ip-api.com: receives the IP address of a sign-in and returns its approximate location for your session record.
• KLIPY and Freesound: when you search the editor's meme and sound library, our server sends them your search words without your account details; the previews are then loaded by your browser from their servers, which see your IP address.
• Cloudflare Turnstile: when a bot check is shown at sign-up, it receives technical details of your browser to tell people from automated sign-ups.

6.2 Others who receive data. These recipients act under their own terms and privacy policies, not ours:

• Google Sign-In, when you sign in with or connect Google. Google's sign-in button is loaded from Google on the sign-in, sign-up and Account pages.
• AI assistants you connect. Whatever your assistant reads from your Account is received by its provider.
• The public, for anything you publish on a Brand page. Visitors to a Brand page also load its fonts from Google Fonts.
• Authorities, where the law requires us to disclose data; and a successor to the business, on notice to you.

7.1Our servers, database and stored files are in India, in Google Cloud's Mumbai region.

7.2Some of the providers in section 6 process data outside India, including Google's Gemini models, Cloudflare, Vercel, ip-api.com, KLIPY and Freesound. Section 16 of the DPDP Act permits such transfers except to a country the Central Government restricts by notification, and we will comply with any such restriction.

8.1 Cookies. We set three first-party cookies, all needed to keep you signed in, on .glyphcast.app:

• access_token: signs your requests in. HTTP-only, Secure and SameSite=Lax; lasts 15 minutes.
• refresh_token: renews the access token. HTTP-only, Secure and SameSite=Lax; lasts 30 days.
• session_until: holds only the time the access token runs out, so the page can renew it first. Readable by the page; lasts 30 days.

8.2 Browser storage.The app keeps some settings in your browser's local storage: your theme, your last cut settings, unsaved editor drafts, progress of an upload in flight, your playback quality and the Workspace you last used. They stay on your device and you can clear them at any time.

8.3 Third-party cookies.Google's sign-in button, and Cloudflare Turnstile where a bot check is shown, may set their own cookies under their own policies. We use no analytics or advertising cookies.

9.1 We keep personal data only while it serves the purpose it was collected for, and then erase it, unless the law requires us to keep it:

• Account details: until the Account is deleted.
• Source videos, transcripts and analysis: until you delete the video or the Account is deleted.
• Clips: until you delete them or the Account is deleted. Clips are not deleted on a schedule.
• Deleted Playbook files: 30 days after deletion. Website reads: 30 days.
• Session records: the IP address, location and browser details are erased 30 days after the session ends, and the record itself after 180 days.
• Messages from the payment provider, stored with personal details masked: 365 days.
• Uploads that never finished: removed after a period of inactivity.
• Payment records: for as long as tax and accounting law requires. Cashfree keeps its own record of each transaction.

9.2 After an Account is deleted, its Content, Output, Workspaces, Playbook, Credits, sessions and assistant connections are deleted with it. We keep only a keyed hash of its email address and of the network it signed up from, with the date it last received Free credits, so that deleting an Account cannot be used to claim the Free plan's Credits again. These hashes are kept for that purpose only.

• In transit. Connections to the website and the API use HTTPS, and the website tells browsers to keep using HTTPS for it.
• Sessions. Sign-in cookies are HTTP-only, Secure and SameSite=Lax. Access tokens last 15 minutes and are renewed rather than left valid, and signing out or removing an assistant ends that session on the server at once.
• Passwords. Stored only as scrypt hashes, never in a readable form.
• Media. Videos, clips and thumbnails are reached through signed links that expire, and are served only to a video, audio or image player in a browser. Downloads require your signed-in session.
• Payments. Card, UPI and bank details are entered with Cashfree and never reach our systems. Messages from it are accepted only when their signature verifies, and are stored with personal details masked.
• Servers. The database accepts connections only from the server itself, and the server has no public remote-login access.

No system is perfectly secure. We will never ask you for a password, card number, CVV or one-time code; anyone who does is not us.

11.1 Under the DPDP Act you have the right to:

1. obtain a summary of the personal data we process about you, the processing, and the identities of those we have shared it with;
2. have your personal data corrected, completed, updated or erased;
3. withdraw your consent, as section 4.3 describes;
4. have a grievance addressed, as section 12 describes; and
5. nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

11.2 Some of this you can do yourself: change your name and photo on the Account page, delete videos from the Library, and remove AI assistants. For anything else, including closing your Account, write to privacy@glyphcast.app from the email address on your Account. We may ask you to confirm your identity, and we respond within 30 days. There is no charge.

11.3 The DPDP Act also places duties on you, including to provide authentic information, not to impersonate another person, and not to register a false or frivolous grievance.

12.1 Our Grievance Officer is Harsh Baldaniya, Founder & CEO, reachable at legal@glyphcast.app. We acknowledge a grievance within 24 hours and resolve it within 15 days of receipt.

12.2 If you are not satisfied with our response, you may complain to the Data Protection Board of India once you have used this route.

The Service is for people aged 18 or over, and a child (anyone under 18) may not create an Account. We do not verify age. If we learn that an Account belongs to a child, we delete it and its data; if you believe one does, write to privacy@glyphcast.app. We do not track, monitor the behaviour of, or target advertising at children.

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected Data Principal, and report it to CERT-In, as the law requires, and we will say what happened and what we are doing about it.

15.1 We may revise this policy. The date at the top of this page shows when it last changed. Before a material change takes effect, we will give notice of it on this page and in the Service or by email.

15.2 Privacy questions and requests: privacy@glyphcast.app. Glyphcast, Gujarat 395012, India.