Privacy Policy

This Privacy Policy is issued by PENGUIN ARTS STUDIO SRL ("SimpleVids," "we," "us," or "our"), the controller of personal data processed through the website and web application at https://simplevids.ai (the "Services"). We are established in Romania, in the European Union.

The Services let you create short-form videos from a script and, if you choose, publish those videos to connected social accounts such as YouTube and TikTok. This policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romania's Law No. 190/2018. If you connect a Google or YouTube account, we also comply with the Google API Services User Data Policy, including the Limited Use requirements, and the YouTube API Services Developer Policies. Google's own privacy practices are described in the Google Privacy Policy.

Contact for privacy requests: contact@simplevids.ai.

You can sign in or create a SimpleVids account with Google. For that, we request your name, email address, and profile picture, and we store them on your account. Connecting YouTube is separate and optional. If you click Connect YouTube, Google will ask you to authorize SimpleVids. We then access YouTube data only through the YouTube Data API using the publishing scopes listed below.

3.1 Scopes we request

• youtube.upload — upload a video you generated in SimpleVids to a YouTube channel you own, with the title, description, and visibility you select.
• youtube.readonly — read basic channel information (channel ID, channel title, and channel thumbnail) so we can show which channel is connected and confirm the upload target.

3.2 Data we access, collect, and store

After you authorize, we receive from Google and store: OAuth access token, refresh token, granted scopes, token expiry, YouTube channel ID, channel display name, and channel avatar URL. Channel ID, display name, and avatar come from Google when you connect. They are not typed into a SimpleVids form. When you publish, we send the video file and the metadata you chose (title, description, privacy status) to YouTube and may store the resulting YouTube video URL or video ID on your SimpleVids project so you can open the published video.

We do not access your YouTube watch history, comments, private videos you did not upload through SimpleVids, Google account email (via YouTube scopes), Gmail, Drive, or contacts.

3.3 How we use this data

We use Google/YouTube user data solely to provide user-facing publishing features that are visible in the product: connecting a channel, showing the connected channel name and avatar, uploading a video you generated, and showing publish success or error status. We do not use this data for advertising, credit decisions, or unrelated product features.

3.4 Limited Use

SimpleVids's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve prominent user-facing features in SimpleVids.
• We do not sell Google user data to third parties, data brokers, or information resellers.
• We do not use Google user data for serving advertisements, including personalized, retargeting, or interest-based ads.
• We do not allow humans to read Google user data unless you give us affirmative consent for a specific support case, it is necessary for security or legal compliance, or the data is aggregated and no longer identifiable.
• We do not transfer Google user data to others except to YouTube itself in order to complete an upload you requested, to service providers who process it only on our instructions to operate that feature, or as required by law.

3.5 Sharing of Google/YouTube data

Tokens and channel identifiers are stored in our application database and used by our servers to call the YouTube API. Video files are stored in cloud file storage and sent to YouTube when you publish. We do not share your YouTube tokens with TikTok, advertising networks, or other customers.

3.6 Retention and deletion of Google/YouTube data

We keep YouTube tokens and channel metadata for as long as the channel stays connected to your account. You can disconnect YouTube at any time in Dashboard → Integrations. Disconnecting deletes the stored tokens and channel profile fields from our database. Published videos already on YouTube remain on YouTube under your YouTube account; delete those in YouTube Studio if you want them removed from YouTube.

In addition to disconnecting inside SimpleVids, you can revoke SimpleVids's access to your Google account at https://security.google.com/settings/security/permissions (also available at Google account permissions). When you revoke access, our tokens stop working. Disconnecting in Dashboard → Integrations deletes the stored YouTube tokens and channel fields from our database immediately (and we also ask Google to revoke the token). If you revoked access only on Google's side, email contact@simplevids.ai or disconnect in the app so we can remove any remaining stored API data.

3.7 Cookies related to Google/YouTube

During YouTube OAuth we set a short-lived first-party cookie to protect the login state (CSRF). Google may also set cookies on Google's domains during the Google consent screen. Those Google cookies are governed by the Google Privacy Policy. Details of cookies we set ourselves are in our Cookie Policy.

If you connect TikTok, we request scopes needed to identify your TikTok creator account and to upload or publish a video you created (user.info.basic, video.upload, video.publish). We receive the display name and avatar from TikTok when you connect, and we store access and refresh tokens, TikTok user identifiers, display name, and avatar. We send the video file and captions you chose. You can disconnect TikTok in Dashboard → Integrations. TikTok is an independent controller of its own platform. TikTok's processing is described in TikTok's own privacy policy.

Instagram publishing is not currently offered as a user-facing connect flow in the product. We do not collect Instagram tokens unless that feature is enabled for your account in a later release, in which case we will update this policy first.

We use personal data to create and operate your account, generate and store videos, provide voiceover and captions, publish to platforms you connect, process subscriptions, send transactional email (login, billing, project status), provide support, secure the Services, and comply with law.

GDPR legal bases:

• Contract (Art. 6(1)(b)) — account, video generation, storage, publishing you request, and paid plans.
• Consent (Art. 6(1)(a)) — connecting YouTube or TikTok, and non-essential cookies.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, aggregated product improvement that does not use Google user data for ads.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and responding to lawful requests.

You can object to processing based on legitimate interests. That objection is separate from withdrawing cookie consent.

We do not make solely automated decisions that produce legal effects or similarly significant effects for you. Generating a video and measuring site usage are not that kind of decision.

We do not sell, rent, or trade personal information. We share data only as needed for the purposes above. Categories of recipients:

• Cloud hosting, database, and file storage providers, acting as processors.
• An email delivery provider, acting as a processor, for account and billing messages.
• Providers that generate scripts, voiceover, captions, and stock footage from content you submit, acting as processors.
• An analytics provider, only if you consent to analytics cookies. Details are in the Cookie Policy.
• Stripe, for subscriptions and invoices. Stripe processes subscription data for us and also processes some payment data as its own controller, including for fraud prevention.
• Google / YouTube and TikTok, when you choose to connect and publish. They are independent controllers of their own platforms. What we access is described in sections 3 and 4.

Email contact@simplevids.ai if you want the names of the companies that received your personal data.

We may also disclose data if required by law, to protect the Services, or as part of a merger or sale of assets, in which case we will require the recipient to honor this policy or notify you.

• Account data and stored media: deleted from the live service when you delete the account or the project, or when we complete a deletion request.
• Projects, scripts, and generated media: until you delete the project or the account.
• YouTube/TikTok tokens: until you disconnect the integration or delete the account.
• Billing records: as required by Romanian accounting rules (typically up to 10 years).
• Security logs: typically up to 12 months.
• Analytics cookies: according to the Cookie Policy, and only if you consented.

We use HTTPS in transit, hashed passwords, restricted access to production systems, and encrypted cloud storage. OAuth tokens are stored in our database and used only by our servers. No method of storage is perfectly secure; we cannot guarantee absolute security.

PENGUIN ARTS STUDIO SRL is established in Romania (EU). Some providers, including the payment processor and the social platforms you connect, may process data in the United States or other countries. Where required, we rely on an adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses (GDPR Art. 46). Email contact@simplevids.ai to request a copy of those safeguards.

Because we are established in the European Union, GDPR applies to this processing, including if you are in the United States. You may request access, correction, deletion, restriction, and portability of your personal data, and you may withdraw consent at any time without affecting processing that already occurred. You may object to processing based on legitimate interests, and you may object to direct marketing at any time. You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro. If you live in another EU or EEA country, you may also complain to the authority in that country.

Email contact@simplevids.ai to exercise these rights. We will respond within one month (extendable by two months for complex requests). You can also download a copy of your data or delete your account while signed in, from Dashboard → Account. To delete YouTube access specifically, disconnect the integration and/or revoke it at Google security settings (permissions). To delete your SimpleVids account and associated personal data, use Dashboard → Account or email contact@simplevids.ai from the email you registered with.

We use essential cookies for authentication and OAuth security. Analytics and marketing cookies load only after you opt in through our cookie banner. You can change or withdraw that choice at any time via Cookie settings in the footer. See the Cookie Policy for the full list.

The Services are for people who are 18 or older. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, contact us and we will delete it.

We may update this policy when our product or the law changes. The "Last updated" date at the top will change. For material changes we will provide a notice in the product or by email. The current version is always at https://simplevids.ai/privacy-policy.