Privacy Policy

This Policy explains how Prodivant (sole proprietorship, representative: Genki Shirahama) ("we", "us") handles personal data in vem (the "Service"), including vemvideo.com. It is written for users everywhere, including under the EU GDPR, the UK GDPR and Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA").

1. Who we are

• Controller: Prodivant (sole proprietorship, representative: Genki Shirahama), 2-2-12-12 Osaka Ekimae Dai-2 Building, 1 Umeda, Kita-ku, Osaka 530-0001, Japan.
• Contact for privacy questions and requests: [email protected].
• For the data described below, we are the controller (the "data controller" under the PDPA). The providers in section 6 process data on our behalf, except where they act under their own privacy policies as noted there.

2. Data we collect

• Account data: name, email address, password (stored as a one-way hash), organization name, your interface language, and the version of the Terms and of this Policy you agreed to and when.
• Connected network data: access tokens and account identifiers issued when you connect a social network (for example through Instagram Login), and the account username.
• Google sign-in: if you sign in with Google, we receive your email address, name and profile picture. We store your email address, name and Google account identifier, and use them only to identify you when you sign in.
• YouTube data: when you connect a YouTube channel, we store the channel ID and channel name (to show which channel is connected and to prevent the same channel from being connected twice) and a refresh token (encrypted, used only when publishing). We do not currently retrieve views or other statistics from YouTube.
• Content: the information you enter (themes, rules, schedules, brand settings), messages to the setup assistant, material you upload, and the videos, images, narration and captions we generate.
• Performance data: views, reach, likes, comments, saves, shares and follower counts of published posts, retrieved from the connected networks for up to 30 days after each post.
• Usage and security data: logs of generation, publishing and sign-in (including failed attempts), with IP addresses and browser information.
• Free preview data: when you make your free preview, we store the IP address it was requested from, to prevent abuse of the free trial.
• Referral data: if you arrive through a partner link, the partner code.
• Payment data: your plan, payment history and the Stripe customer ID. Payments are processed by Stripe; we do not store card numbers.
• We do not ask for sensitive data (such as health, religion or biometric data). Please do not include sensitive data about yourself or others in your themes or material.

3. Purposes and legal bases

• To provide the Service: creating your account, generating content, publishing it at the times you set, showing results and running the setup assistant (performance of a contract).
• To take payments and issue invoices (performance of a contract), and to keep tax and accounting records (legal obligation).
• To keep the Service secure and prevent abuse, including rate limiting, free-trial abuse prevention and automated checks of input (legitimate interests: protecting our users and the Service).
• To send service emails such as email verification, password resets and failure notices (performance of a contract).
• To troubleshoot and measure the reliability and cost of the Service (legitimate interests). We do not use your content to train AI models.
• Where we ask for your consent for a specific purpose, we rely on that consent (consent). You can withdraw it at any time; this does not affect processing before the withdrawal.
• Under the PDPA, these correspond to the contractual basis, legitimate interests, legal obligation and consent. Providing account data is necessary to use the Service; without it we cannot create an account.

4. AI-generated content and automated processing

• The Service uses AI models to write research notes, scripts and captions, to generate images and narration, and, in the AI video format, to generate the video footage itself. Generated content can contain errors or resemble existing material, so review it before publishing.
• For AI video, the video models (Google Veo or Gemini, or Lightricks LTX depending on the quality you choose) receive only English scene descriptions written by our AI. We do not send your name, photos or account data to them. Scene descriptions must not name real people or brands (we check this automatically), and the Google models are set not to generate children.
• When we upload an AI video to YouTube, we mark it as altered or synthetic content. On other networks, you are responsible for applying the network's AI labels where required.
• We check text you enter automatically (fixed rules and two AI models) to block instructions aimed at the AI, advertising and prohibited content. A check can stop a job, but it has no legal or similarly significant effect on you. You can ask for a human review at [email protected].

5. YouTube and Google data

• The Service uses YouTube API Services. Google's handling of your data is described in the Google Privacy Policy (http://www.google.com/policies/privacy).
• We use YouTube data only to upload videos that you created and approved in the Service to your own channel. We do not use it for advertising, and we do not sell it or share it with third parties.
• vem's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
• When you disconnect the channel, or delete your account (from Account & data in the Service, or by asking us at [email protected]), we delete the channel ID, channel name and refresh token.
• You can revoke access at any time from the Connections page in the Service, or from your Google Account permissions page (https://security.google.com/settings/security/permissions).
• Questions or complaints about our privacy practices: [email protected].

6. Processors and recipients

• We share data only with the following providers, only to the extent necessary for the purposes above. We do not sell personal data or share it for advertising.
• Meta, Google (sign-in and YouTube) and Stripe also process the data you send them under their own privacy policies.
• We may also disclose data where the law requires it, or where it is necessary to protect the rights or safety of our users or others.

7. International transfers

• Our servers and our encrypted backups are located in the United Kingdom. The operator is based in Japan and accesses the servers from there. Some providers process data in the United States and other countries (see section 6).
• The EU recognizes the United Kingdom and Japan as providing an adequate level of protection, and the UK recognizes Japan. For transfers to other countries, we rely on the safeguards offered in our providers' data processing terms, such as the EU standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or the EU-U.S. Data Privacy Framework (and its UK extension) where the provider participates, or on other grounds permitted by law.
• For users in Thailand, we transfer data abroad as permitted by the PDPA, including where the transfer is necessary to perform our contract with you, and with appropriate safeguards.
• You can ask us for more information about these safeguards at [email protected].

8. Retention and deletion

• Account data, settings, content, generated media and performance data: kept while your account exists, and deleted without undue delay when you delete your account.
• Connected network tokens: kept until you disconnect the network or delete your account. We also ask the network to revoke them where it allows this.
• Free preview IP addresses: deleted after 30 days.
• Setup assistant conversations: deleted 30 days after the conversation expires (a conversation expires 24 hours after it starts).
• Temporary copies of media made available to social networks for publishing: deleted after publishing.
• Billing records (Stripe customer ID, amounts and invoices): kept for as long as tax and accounting laws require, even after you delete your account.
• Security logs (such as sign-in records with IP addresses): kept only as long as needed to protect the Service and investigate incidents.
• Backups: encrypted and stored on a second server in the United Kingdom. Daily backups are kept for 35 days and monthly backups for about 13 months. Deleted data disappears from backups when they expire; we do not restore it for any other purpose.
• If you remove vem from your Instagram settings, Meta notifies us and we disconnect the account. We keep only a confirmation code and our internal ID of the removed connection.

9. Your rights

• Depending on where you live, you have the right to: be informed about how we use your data; access your data and get a copy; have inaccurate data corrected; have your data deleted; restrict processing; object to processing based on legitimate interests; receive your data in a machine-readable format and have it transmitted to another controller (portability); and withdraw consent at any time.
• Under the PDPA you may also ask us to disclose how we obtained data that you did not consent to us collecting, and to anonymize data.
• You can complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU/EEA, your local data protection authority; in Thailand, the Office of the Personal Data Protection Committee (PDPC, www.pdpc.or.th); in Japan, the Personal Information Protection Commission. We would appreciate the chance to address your concern first.

10. How to exercise your rights

• In the Service, open Account & data. There you can download your data as a JSON file (your user, organization and brand settings and rules, your jobs and publishing records, and short-lived links to your generated files), and delete your account.
• Deleting your account deletes the organizations in which you are the only member, with their brands, jobs, generated files and social network connections (we delete the tokens and, where the network supports it, ask it to revoke them). Any active paid plan is cancelled at once; fees already paid are not refunded. Posts already published stay on the social networks. From organizations shared with others, only your membership is removed. Billing records are kept as described in section 8.
• You can also email us at [email protected] from the email address of your account. We reply within one month (and within 30 days for requests under the PDPA). We may ask you to confirm your identity. Requests are free unless they are clearly unfounded or excessive.
• You can disconnect a social network at any time from the Connections page or from the network's own settings.

11. Children

The Service is not intended for anyone under 18, and you must be at least 18 to use it. We do not knowingly collect data from children. If we learn that we have, we delete it.

12. Security

• Communication is protected by TLS. Passwords are stored as one-way hashes. Access tokens are encrypted at rest and can only be decrypted by the publishing process. Backups are encrypted before they leave the server.
• API keys for AI providers are held by a separate gateway process. The AI that reads your text has no access to tools, keys or other customers' data.
• Access to production systems is limited to the operator. We limit sign-in attempts and request rates, and our servers are monitored daily.

13. Personal data breaches

• If a personal data breach is likely to result in a risk to you, we will notify the competent authority (such as the UK ICO, the relevant EU authority, the Thai PDPC or the Japanese Personal Information Protection Commission) within 72 hours of becoming aware of it where the law requires.
• If the breach is likely to result in a high risk to you, we will also tell you without undue delay what happened, what data was involved and what you can do.

14. Cookies and local storage

• We use only the cookies needed to keep you signed in and to protect forms (session and CSRF cookies). We do not use advertising or analytics cookies.
• We store a few settings in your browser's local storage, such as your chosen language and a partner code from a referral link.

15. Changes to this Policy

• This is version 2026-10-08. We record which version you agreed to and when.
• We will announce changes on this page. For material changes, we will tell you in advance and ask you to agree again when you next use the Service.

16. Language

This Policy is written in English. Translations (currently Thai) are provided for convenience only. If a translation differs from the English text, the English text prevails.

17. Contact

Prodivant (sole proprietorship, representative: Genki Shirahama), 2-2-12-12 Osaka Ekimae Dai-2 Building, 1 Umeda, Kita-ku, Osaka 530-0001, Japan / [email protected]