Last updated: 12 August 2026 Version: 1.3
This policy explains what we do with personal data when you use Novaku Captions at novaku.app (the "Service").
Controller: Yinchao Chen, Bansinerstraße 29, 12619 Berlin, Germany. Contact for privacy matters: [email protected].
We have written this to be read, not to be survived. If anything here is unclear, write to us and we will explain it.
provider, and use the result to build captions.
you upload, we remove the audio, limit analysis to 30 seconds, and send that reference to Google Gemini for visual style analysis.
you delete the project.
Account data. Your email address, the timestamp of account creation, and — if you choose to set a password — a salted hash of that password, never the password itself. We use email as the account identifier and for transactional messages (sign-in links, export-ready notifications, receipts, and notices about changes to the Service).
Email addresses are normalised before being used as an identifier: for providers that treat them as equivalent, name+tag@ and na.me@ resolve to the same account as name@.
Content you upload. The video file, the audio extracted from it, the generated transcript, any edits you make to that transcript, your chosen styles, and the exported output file. Speech in a video is personal data about the people speaking; see clause 7 on your responsibilities as the uploader.
Reference-video analysis. The public Instagram, YouTube, or TikTok URL or reference clip you submit, your accompanying instruction, a temporary 30-second video-only copy, and the resulting caption-style analysis. A dedicated service account may be used to retrieve an otherwise accessible public reference. Its session cookie is stored as a deployment secret, exposed only to the isolated reference worker, written only to a private temporary file, never logged, and deleted after each attempt. Do not submit a reference unless you are entitled to have its content processed; see clause 7.
Usage and billing records. Which products you bought, the versions of legal documents and immediate-supply notice you accepted at checkout, credits granted and consumed, promotional codes redeemed, export timestamps, video durations, and job outcomes (success, failure, error reason). We keep an append-only ledger of credit movements so that any billing question can be traced to a specific entry.
Waitlist data. If you ask us to tell you when the Service can do what you need, we store the email address you give us, the time you gave it, and which page you gave it on. Nothing else — a waitlist entry is not an account, and we do not link it to one. We use it for a single purpose: to email you about Novaku. Every such email carries an unsubscribe link, and unsubscribing deletes the entry.
Technical data. IP address, user agent, and request timestamps in server logs, retained for 30 days for security, abuse prevention, and debugging.
We do not use advertising cookies, third-party analytics trackers, or cross-site tracking of any kind. The only cookie we set is the one that keeps you signed in.
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the Service you asked for: transcription, editing, rendering, delivery | Contract — Art. 6(1)(b) |
| Taking payment, issuing receipts, keeping accounting records | Contract and legal obligation — Art. 6(1)(b), 6(1)(c) |
| Enforcing usage limits, detecting account sharing and abuse | Legitimate interests — Art. 6(1)(f) |
| Security logging and incident investigation | Legitimate interests — Art. 6(1)(f) |
| Improving the Service using aggregated, non-identifying statistics | Legitimate interests — Art. 6(1)(f) |
| Emailing you about Novaku because you joined the waitlist | Consent — Art. 6(1)(a), withdrawable at any time |
Where we rely on legitimate interests, we have considered your rights and concluded that the processing is limited to what is necessary and would be expected by a reasonable user of a service of this kind. You may object at any time (clause 8).
We do not rely on consent for the core Service, so you cannot lose access by withdrawing consent. We do not send marketing email without separate opt-in consent, which you may withdraw at any time.
| Data | Retention |
|---|---|
| Uploaded video and extracted audio | 7 days from upload, then deleted automatically |
| Exported output file | 7 days from export, then deleted automatically |
| Temporary reference-video copy | Deleted immediately after the analysis attempt finishes |
| Reference URL, instruction and style-analysis result | 7 days after completion or failure |
| Transcript, edits, style settings | Until you delete the project, or 90 days after account closure |
| Credit ledger, payment records | 10 years, as required by accounting and tax law |
| Server logs (IP, user agent) | 30 days |
| Email address and account record | Until closure, then 90 days, except where retention is required by law |
| Waitlist entry | Until you unsubscribe, or 24 months after you joined, whichever comes first |
Deletion is automatic. You do not need to ask. If you want something gone sooner, delete the project in the app or email us.
We use a small number of processors, each under a data processing agreement. The current list is:
| Processor | What it does | Where |
|---|---|---|
| Stripe Payments Europe, Limited | Hosted card payment, receipts and automated tax calculation | Ireland / global infrastructure |
| OpenAI, L.L.C. — speech-to-text | Converts the extracted audio to a timed transcript | United States |
| Google LLC — Gemini API | Temporarily analyzes a user-selected reference video to infer reproducible caption styling | United States / global infrastructure |
| Railway Corp. — hosting, compute and storage | Runs the website and the rendering worker; holds uploads, transcripts and finished videos on a persistent volume | US company; deployment region EU (Amsterdam) |
| Resend, Inc. — transactional email | Sends sign-in links | US company; delivery infrastructure in the EU (Ireland) |
We prefer EU regions where the provider offers them. Stripe processes payment information under its own privacy notice and may act as an independent controller for parts of fraud prevention and regulatory compliance.
For normal transcription, only the extracted audio is sent to the speech-to-text provider — not your video. If you explicitly use reference-video analysis, the separate reference video is uploaded to the Gemini Files API and we request deletion immediately after the analysis; if that deletion request fails, Google automatically expires Files API uploads within 48 hours. We use Gemini Paid Services, under which Google states that submitted files, prompts, and responses are not used to improve its products, and we do not opt in to sharing API logs or datasets for model improvement. If we change provider, we will update this list before the change takes effect.
Where a processor is located outside the European Economic Area, the transfer is made under one of: an adequacy decision of the European Commission, the European Commission's Standard Contractual Clauses, or another lawful mechanism under Chapter V GDPR. You may request a copy of the relevant safeguards from [email protected].
This matters, and most services bury it.
When you upload a video, or submit a reference-video link, containing other people's voices or faces, you are the controller of that personal data and we act as your processor for it. You must have a lawful basis for processing it — usually the consent of the people recorded, or another basis you can demonstrate. You must not upload recordings of people who have not agreed to be recorded, or special-category data (such as health or biometric information) without a valid basis.
By uploading or submitting the link, you instruct us to process that content only as described in this policy and in the Terms. We will not use it for anything else.
Under the GDPR you have the right to: access your data; have inaccurate data corrected; have data erased; restrict processing; object to processing based on legitimate interests; and receive your data in a portable, machine-readable form. Where processing is based on consent, you may withdraw it at any time.
Email [email protected]. We will respond within one month. We do not charge for this, and exercising these rights will never result in worse service.
If you are unhappy with how we have handled your data you may complain to your national supervisory authority. Germany has no single federal authority for the private sector: competence follows the state in which the controller is established, so for us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin). You may also complain to the authority in the country where you live or work.
Transport is encrypted with TLS. Files are stored in access-controlled object storage with time-limited, signed URLs; upload and download links expire. We never store your password itself. If you choose to set one, we store only a salted scrypt hash of it — a deliberately slow, memory-hard function, so that even someone who obtained the database could not read your password back out of it in any practical time. Setting a password is optional; sign-in by emailed link always works, and it is the only way to reset a forgotten password.
Access to production data is limited to the operator and used only to investigate a fault or a report of abuse.
We keep the surface small on purpose: fewer processors, shorter retention, no tracking. That is a security decision as much as a privacy one.
If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform affected users without undue delay.
Transcription and caption rendering are automated, but they do not make decisions about you that have legal or similarly significant effects. We do not profile you and we do not use your data to make automated decisions about pricing, access, or eligibility. Usage limits are fixed thresholds published in the Terms, not individual assessments.
The Service is not directed at children and is not available to anyone under 18, or under the age of digital consent in their country where that is higher. We do not knowingly collect data from children. If you believe a child has used the Service, write to us and we will delete the account and its content.
If we make a material change to this policy we will notify you by email or in-product notice at least 30 days before it takes effect, and keep the previous version available on request. The version number and date at the top of this page always identify the current text.