Privacy Policy
This policy explains what personal data VINC collects, why, who it's shared with, how long we keep it, and the rights you have — written in plain language to satisfy India's IT Act 2000 (s.43A) and SPDI Rules 2011 and the Digital Personal Data Protection Act, 2023 (DPDP, whose substantive obligations we adopt ahead of their 2027 commencement), the EU/UK GDPR, and US state privacy laws including the CCPA/CPRA and CalOPPA.
1. What we collect
| Data | When | Why (purpose) |
|---|---|---|
| Email address, password (hashed), or Google account ID and profile email | Sign-up / sign-in | Creating and securing your account |
| Consent receipt (timestamp + terms version + 18+ attestation) | Sign-up | Evidence of your agreement (DPDP s.6, GDPR Art 7) |
| Waitlist status | Early access | Managing gradual rollout; emailing you when your seat opens |
| Prompts, scripts, uploads, projects, and rendered output | Using the studio | Operating the service you asked for — generating your films |
| Credit balance, usage metering, and (when payments launch) payment records via a payment processor | Paid use | Billing, fraud prevention, tax compliance |
| Redacted error reports and limited performance traces (Sentry) | When the app breaks | Fixing crashes — redacted client-side, no session replay, opt-out on the cookie page |
| Server logs (IP address, request metadata) | All requests | Security, abuse prevention, rate limiting |
| Aggregate usage statistics (Google Analytics) | Only if you opt in on the cookie notice | Understanding visit counts and which parts of the site get used — opt-in and withdrawable on the cookie page |
We do not use ad trackers, do not buy data about you, and do not build advertising profiles. The only third-party analytics is Google Analytics, which runs solely with your opt-in consent. See exactly which cookies exist on the Cookie Policy.
2. Legal bases (GDPR) and consent (DPDP)
- Contract — account, studio, rendering, billing: processing needed to provide the service you signed up for.
- Legitimate interests — security logging, abuse prevention, redacted error monitoring (balanced against your rights; you can object, and error monitoring is opt-out-able directly).
- Consent — Google Analytics, and anything else beyond the above: requested separately, never pre-ticked, withdrawable as easily as it was given. For users in India, all processing described here rests on the express consent you give at sign-up (the DPDP Act has no separate "contract" basis); your consent is recorded with a timestamp and document version, and you may withdraw at any time by closing your account or writing to us — withdrawal doesn't affect prior lawful processing.
- Legal obligation — tax records, responding to lawful orders.
3. Who your data goes to
Your data is shared only with processors that operate the service on our instructions:
- Supabase — database, authentication, and file storage (primary region: Mumbai, India).
- Vercel — application hosting and delivery (global edge; compute primarily US/EU).
- AI model providers — your prompts and reference media are sent to the model services that perform each render (including fal.ai, Anthropic, Google, and similar providers, primarily US-based). We send what the render needs — not your account identity.
- Sentry — redacted error reports (US), unless you opt out.
- Google Analytics — aggregate usage statistics (US), only if you opted in on the cookie notice; withdrawable any time on the cookie page.
- Cloudflare Turnstile — bot/abuse protection on our sign-in, sign-up, and password-reset forms. It runs a silent ("invisible") verification and may process device and network signals to tell humans from bots; it does not identify you to us. Cloudflare's handling of that data is governed by the Cloudflare Turnstile Privacy Addendum.
- Payment processors — when payments launch, your card details go to the processor, never to our servers.
We do not sell or share personal information for money or cross-context behavioral advertising (CCPA definitions), and haven't in the preceding 12 months. We disclose data to authorities only under a legally valid demand.
4. International transfers
We operate from India with infrastructure in India, the US, and the EU. Where GDPR-protected data leaves the EU/UK, transfers rest on the European Commission's Standard Contractual Clauses (or an adequacy decision) with each processor listed above, plus each provider's security measures. India permits cross-border transfer under DPDP s.16 except to restricted countries; we honor that list.
5. How long we keep it
- Account, projects, and renders — for as long as your account is active, then deleted or anonymized within 90 days of account closure (backups purge within a further 90 days).
- Waitlist rows — until launch completes or you ask us to remove you.
- Error reports — 90 days at Sentry by default.
- Billing and tax records — as long as tax law requires.
- Server security logs — up to 12 months.
6. Your rights
Everyone, everywhere: email support@vinc.ai to access, correct, delete, or export your data, or to object to or restrict processing. We verify the request against your account email and respond within 30 days (sooner where law requires; never longer than the 45 days US state laws allow). If we refuse a request, we say why, and you can appeal by replying to our decision — appeals are answered by a person within 45 days. We never discriminate against you for exercising rights.
- India (DPDP) — rights of access, correction and erasure, grievance redressal, and nomination. Complaints go first to our Grievance Officer; if unresolved, to the Data Protection Board of India.
- EU/UK (GDPR) — access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to your local supervisory authority.
- California (CCPA/CPRA) and other US states — know, delete, correct, portability, and opt-out of sale/sharing. We don't sell or share, so there is nothing to opt out of — but the request channels above work regardless, and we honor Global Privacy Control signals by never selling in the first place. Authorized agents may submit requests with proof of authorization.
7. Children
VINC is for adults. We do not knowingly process data of anyone under 18 (DPDP s.9) — sign-up requires an 18+ attestation, and accounts found to belong to minors are closed and their data deleted. We do not serve targeted advertising to anyone, child or adult.
8. Security and breach notification
Data is encrypted in transit, access is role-restricted (row-level security on every user table), secrets are vaulted, and error reports are redacted before leaving your browser. No system is perfect: if a breach affects your personal data we will notify the Data Protection Board of India and affected users as the DPDP Act requires, and EU/UK authorities within 72 hours where GDPR applies.
9. Do Not Track and tracking disclosures (CalOPPA)
VINC does not track users across third-party websites or over time for advertising. Because we do not engage in such tracking, we do not alter our behavior in response to Do Not Track (DNT) browser signals — there is nothing to turn off. We also do not permit third parties to collect personally identifiable information about your online activities over time and across third-party websites through our service. Because we do not sell or share personal information, Global Privacy Control and other opt-out preference signals do not change how we process your data — we honor them by default.
10. No AI training on your content
We do not use your prompts, uploads, projects, or rendered films to train or fine-tune AI models, and our contracts with the model providers that render your work restrict them to processing it to deliver the render. If that ever changes, it will be opt-in, and this policy's version will change first. See AI Transparency.
11. Changes and contact
Material changes to this policy are announced by email or in-product at least 15 days before they take effect; the version at the top changes every time. Questions, requests, complaints: support@vinc.ai · Grievance Officer: support@vinc.ai (details and timelines).