Privacy Policy

Last updated

This policy explains what personal data Voodle Studio collects when you use voodle.studio, why we use it, who we share it with, how long we keep it and the choices you have.

Who we are

Voodle Studio ("Voodle", "we", "us") runs voodle.studio, a service that turns ideas, scripts and PDFs into narrated whiteboard animation videos. Voodle Studio decides how the personal data described here is used. You can reach us at [email protected].

What we collect

  • Account details: your name, email address, a hash of your password, and when you signed up and verified your email.
  • Content you provide: the ideas, scripts, PDFs, images, audio and other files you upload, and the projects, scripts, drawings, voice-overs and videos made from them.
  • Billing records: your plan, credit balance and credit history, orders and payment references. Card and bank details go straight to our payment provider and never reach our servers.
  • Usage and device data: pages you view, actions you take in the app, errors you see, your browser type, a random identifier for your browser, and IP addresses in our server logs.
  • Operational records: request and job logs, error reports, and the prompts and responses exchanged with AI providers, which we use to fix problems, keep the service secure and show your generation history.

Why we use it

  • To provide the service you ask for: storing your projects, generating scripts, images, voice-overs and videos, and delivering your exports.
  • To run your account and billing: signing you in, keeping track of credits and subscriptions, and processing payments and refunds.
  • To keep the service secure and working: preventing abuse and fraud, enforcing plan limits, and monitoring and debugging.
  • To contact you: verification codes, security notices (for example when a new app connects to your account), receipts and replies to support requests.
  • To improve the product, using usage analytics.

We do not sell your personal data, and we do not use your content to train AI models of our own.

Who else processes it

We use service providers to run Voodle. Each one processes data only to provide its service to us.

  • AI model providers: text, vision and image models (for example through OpenRouter, OpenAI, Google and Runware) that write scripts, read PDFs and draw scenes. Your prompt and the content needed for that step are sent to the provider that produces it.
  • Text-to-speech providers: services such as xAI, Google, OpenAI, Sarvam and ElevenLabs that record the voice-over from your script.
  • Speech-to-text providers: Groq transcribes the recorded voice-over to time each word, so the drawing keeps pace with the narration.
  • Image processing providers: services such as fal and Replicate that may be used to split a scene image into the parts that are drawn.
  • Payments: Razorpay processes payments and holds card and bank details.
  • Hosting, storage and delivery: Cloudflare delivers the website and stores and serves files and videos; our hosting provider runs our servers.
  • Database: Supabase hosts our database, in Japan.
  • Email: our email provider delivers verification codes, receipts and security notices.
  • Analytics: Amplitude records product usage (page views, actions and errors) with a random browser identifier. Form values and file contents are excluded, and session recordings, where enabled, mask text and block inputs.
  • Error monitoring and logs: Better Stack stores application logs and error reports, including reports sent through the Sentry SDK.
  • Bot protection: Cloudflare Turnstile checks sign-ups for automated abuse.

Connected AI assistants

You can connect your Voodle account to ChatGPT (OpenAI), Claude (Anthropic), Codex or another app that supports the Model Context Protocol, either by approving it on our consent screen or by creating a personal API key. Nothing is shared until you do.

  • What the assistant sends us: the requests it makes on your behalf: your idea, script and settings, and any PDF you attach or link in the chat.
  • What we send back: project titles, scripts, video progress, links to your videos and projects, and the account details its permissions allow, such as your plan and credit balance. That information then becomes part of your conversation, which OpenAI, Anthropic or the app’s provider handle under their own privacy terms.
  • Unlisted video links: videos made from a chat get an unlisted link so you can watch them from the conversation. Anyone with the link can watch the video until you delete the project.
  • Records we keep: which apps you have connected and what they may do, which API keys you have created (only a hash of each key is stored), when each was last used, and operational logs of the requests made with them. We email you when a new app connects or a new key is created.

You can see and revoke connected apps and API keys at any time from Account → Connected apps; access stops immediately. Signing out your other sessions or changing your password disconnects all of them.

How long we keep it

  • Account data and projects are kept until you delete them or ask us to close your account.
  • Sign-in sessions expire after 30 days, or earlier when you log out or sign out your other sessions.
  • Operational logs, including stored AI prompts and responses, are kept to run, debug and secure the service. Stored prompts and responses are not yet deleted on a fixed schedule; ask us to delete yours at any time.
  • Connection records for AI assistants are deleted about a week after they expire or are revoked. Revoked API keys stay listed (as a hash and a short prefix) so you can see past access.
  • Payment and invoice records are kept as long as tax and accounting law requires.

Your rights and choices

You can change your name and password, delete projects, and disconnect apps and API keys from your account at any time. You can also write to [email protected] to ask for a copy of your data, to correct it, to delete it or to close your account, or to object to how we use it. Depending on where you live, data protection laws may give you further rights, including the right to complain to your local data protection authority. We will answer within the time the law requires.

Cookies and local storage

We use your browser’s local storage to keep you signed in and to remember choices such as your currency and generation preferences. Our API may set a session cookie for pages the editor loads from it. Amplitude stores a random identifier in your browser for analytics. Razorpay and Cloudflare Turnstile may set their own cookies when you pay or sign up. We do not use advertising cookies.

Children

Voodle is not directed at children under 13, and we do not knowingly collect their personal data. If you are under the age of majority where you live, use Voodle only with a parent’s or guardian’s permission. If you believe a child has given us personal data, contact [email protected] and we will delete it.

International transfers

Our service providers process data in several countries, including the United States, the European Union, India and Japan (our database). When your data is transferred outside your country, we rely on our providers’ contractual commitments and safeguards to protect it.

Security

Traffic is encrypted in transit, passwords are stored as hashes, and access tokens and API keys are stored only as hashes. Access to production data is limited to the people who run the service. No system is perfectly secure: tell us straight away at [email protected] if you believe your account has been compromised.

Changes to this policy

We will update the date at the top when this policy changes, and tell you by email or in the app before a significant change takes effect.

Contact

Questions about privacy or this policy: [email protected].