Privacy Policy

1. Overview

SchemaVid (“we,” “our,” or “us”) provides an AI-powered video analysis API service. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use our website (schemavid.com), our API services, and our dashboard application (collectively, the “Service”).

We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Information We Collect

2.1 Account Information

When you sign up via Clerk, we receive and store your email address and a unique user identifier from Clerk. We do not receive or store your password — authentication is handled entirely by Clerk. If you sign in with Google OAuth, we receive your name and email from Google. You can review Clerk’s privacy policy at clerk.com/legal/privacy.

2.2 API Usage Data

When you use our API, we log: the API key used, the video URL submitted for analysis, timestamps of requests, and the analysis results returned by our AI pipeline. This data is stored in Cloudflare D1 and is associated with your account for billing and usage tracking purposes.

2.3 Video Content

Videos submitted for analysis are temporarily cached in Cloudflare R2 storage for the duration of processing (typically less than 1 hour). We do not permanently store the video files. Video content is passed to Google Gemini AI for multi-modal analysis. See Section 5 for third-party data processing details.

2.4 Payment Information

We use Creem as our payment processor. We do not collect, process, or store your credit card numbers, billing addresses, or other payment details. When you make a purchase, you interact directly with Creem’s hosted checkout. We receive only a customer reference ID and subscription status from Creem. See Creem’s privacy policy at creem.io/privacy.

2.5 Automatically Collected Information

Our website may collect standard server logs including IP address, browser type, referring pages, and timestamps. We do not use third-party analytics, tracking pixels, or advertising cookies on our website. The only cookies used are essential session cookies managed by Clerk for authentication purposes.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To authenticate your identity and manage your account
• To process API requests and return analysis results
• To track API usage for billing and credit management
• To communicate service updates, security alerts, and account notifications
• To comply with legal obligations and enforce our Terms of Service

We do not sell your personal information. We do not use your data to train AI models.

Prohibited Use: You may not use SchemaVid to analyze videos containing pornography, sexually explicit content, adult material, child sexual abuse material (CSAM), content that promotes violence or terrorism, or any other illegal content. Violation of this policy will result in immediate account termination and may be reported to relevant law enforcement authorities.

4. Data Retention

• Account data: Retained until you delete your account
• API usage logs: Retained for 90 days for billing and analytics
• Analysis results: Stored in D1 indefinitely unless you request deletion
• Video files in R2: Automatically expire after 1 hour; a lifecycle rule deletes all objects after 24 hours as a safety net
• API keys: Stored as SHA-256 hashes only. Plaintext keys are never persisted

5. Third-Party Data Processors

We rely on the following sub-processors to deliver the Service:

6. Your Rights

6.1 GDPR (EU/EEA Users)

If you are located in the European Economic Area or the United Kingdom, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data (“right to be forgotten”)
• Restrict or object to the processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent

6.2 CCPA (California Residents)

California residents have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information held by businesses
• Opt-out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising CCPA rights

6.3 Exercising Your Rights

To exercise any of these rights, email us at [email protected]. We will respond within 30 days as required by law. We may need to verify your identity before processing your request.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• API keys are stored as SHA-256 cryptographic hashes — plaintext keys are never persisted to disk
• All API communication is encrypted via HTTPS/TLS
• Database access is restricted to authorized Worker functions via Cloudflare’s binding model
• Video files in R2 are automatically deleted after processing via lifecycle policies
• We do not store plaintext API keys, credit card numbers, or passwords

8. International Data Transfers

Our Service is hosted on Cloudflare’s global infrastructure. Data may be processed in data centers located in the United States and other jurisdictions where Cloudflare operates. We rely on Standard Contractual Clauses (SCCs) and adequacy decisions as legal transfer mechanisms for data originating from the EEA, UK, and Switzerland.

9. Children’s Privacy

Our Service is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our website. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries or to exercise your data rights:

• Email: [email protected]
• Data Protection Officer: DPO can be reached at the same address