Legal
Privacy Policy
Last updated: April 5, 2026 · Effective: April 5, 2026
1. Introduction
Welcome to Grapli (“we”, “our”, or “us”). Grapli is an AI-powered short-form video creation platform accessible at grapli.tech. We are incorporated in India and operate globally.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our platform, and describes the rights you have over your data. It applies to all users worldwide who access or use any Grapli service.
This policy complies with India’s Digital Personal Data Protection Act 2023 (DPDP Act), the EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable international privacy laws.
Definitions
- Personal Data — Any information that relates to an identified or identifiable individual.
- Data Fiduciary / Controller — Grapli; determines the purpose and means of processing your data.
- Data Principal / Data Subject — You, the user providing personal data.
- Data Processor — Third-party services that process data on our behalf (Clerk, Supabase, AWS, etc.).
- User Content — Scripts, videos, preferences, and other creative material you create using Grapli.
- AI-Generated Output — Videos, captions, voiceovers, and scripts produced by Grapli’s AI pipeline.
2. Data We Collect
We collect only the data necessary to provide and improve our services. Here is a complete breakdown:
| Data Category | What We Collect | Purpose |
|---|---|---|
| Account Identity | Email address, first name, last name, profile photo | Account creation, authentication, communications, support |
| Contact Information | Phone number (optional) | Account verification, important service notifications |
| Payment Data | Billing name, last 4 digits of card, billing address, transaction history | Subscription billing via Razorpay (full card numbers never stored by Grapli) |
| Video & Creative Content | Scripts, video metadata, voiceover preferences, template selections, scheduled job configurations | Generating and storing your videos; providing the core service |
| User Preferences | Niche, tone, voice settings, timezone, connected social platforms | Personalizing your experience and pre-filling creation workflows |
| Social Media Tokens | Encrypted OAuth access tokens for TikTok, Instagram, YouTube (never passwords) | Publishing your videos to connected social accounts |
| Usage & Behavior | Pages visited, features used, session duration, clicks, error interactions | Product analytics, improving features, usage tracking (PostHog) |
| Device & Network | IP address, browser type, operating system, device identifiers | Security, fraud prevention, rate limiting, approximate geolocation for pricing |
| Error & Diagnostic Data | Crash logs, error stack traces, session context at time of error | Debugging and improving service reliability (Sentry) |
| Generated Video Files | Rendered .mp4 videos, thumbnail images stored in AWS S3 | Providing access to your generated videos; publishing via CDN |
We do not collect sensitive personal data such as biometric data, health records, financial account credentials, or government identification numbers.
3. How We Use Your Data
We use your personal data only for specific, clearly stated purposes:
Service Delivery
Processing your video creation requests, generating scripts, voiceovers, captions, and rendering final videos. This is the core contractual use of your data.
Account Management
Creating and maintaining your account, verifying your identity, managing your subscription and credits, and providing customer support.
Payment Processing
Charging your subscription fees and managing credits via Razorpay. Payment details are processed directly by Razorpay — we never see your full card number.
Automated Publishing
When you enable scheduled automation, we use your stored OAuth tokens and configurations to generate and publish videos at your chosen times.
Service Communications
Sending transactional emails (video ready, payment receipts, account alerts, scheduled job completions). These cannot be opted out of while you have an active account.
Product Improvement
Analyzing aggregated usage patterns to improve features, prioritize roadmap, and fix bugs. Analytics are collected with your consent and can be opted out of in Settings > Privacy.
Security & Fraud Prevention
Monitoring for unauthorized access, unusual activity, abuse of the platform, and enforcing rate limits.
Legal Compliance
Retaining financial records for tax compliance, responding to lawful requests from courts or government authorities, and complying with applicable laws.
4. Third-Party Services & Data Processors
Grapli uses third-party services to deliver its features. Each service receives only the data strictly necessary for its function and operates under a Data Processing Agreement with us.
Clerk
Authentication & User Management
Data shared: Email, name, phone number, authentication tokens
Supabase (PostgreSQL)
Database & Storage
Data shared: User profiles, video metadata, scripts, preferences, encrypted OAuth tokens
Amazon AWS (S3 + CloudFront + SQS + Bedrock)
File Storage, CDN, Job Queue, AI (Claude)
Data shared: Video files, thumbnail images, queue messages, AI script prompts
Razorpay
Payment Processing
Data shared: Payment method details, transaction amounts, billing address
ElevenLabs
AI Text-to-Speech Voiceover
Data shared: Script text sent for voiceover generation
OpenAI (Whisper API)
Automatic Caption Generation
Data shared: Audio portions of videos for transcription
PostHog
Product Analytics
Data shared: Anonymized usage events, page views, feature interactions, session ID
Sentry
Error Monitoring
Data shared: Error logs, stack traces, session context at time of errors
Pexels & Pixabay
Stock Footage APIs
Data shared: Anonymized API requests (no personal data shared)
We do not share your personal data with any other third parties except as required by law or with your explicit consent.
6. Data Security
We implement industry-standard technical and organizational measures to protect your personal data:
Encryption at Rest
All data in Supabase is encrypted using AES-256. OAuth tokens receive an additional layer of application-level encryption before database storage.
Encryption in Transit
All data transmitted between your browser, our servers, and third-party services is protected using TLS 1.2 or higher (HTTPS everywhere).
Row-Level Security
Our Supabase database enforces row-level security policies ensuring each user can only query and modify their own data, even within the same database.
Access Controls
Staff access to production systems is role-based, logged, and requires multi-factor authentication. No staff member has unrestricted access to all user data.
Rate Limiting
All public APIs are rate-limited to prevent brute-force attacks, credential stuffing, and abuse.
Dependency Monitoring
We continuously monitor our codebase for known vulnerabilities using automated scanning tools and patch critical issues within 48 hours.
Security Incident Response
In the event of a personal data breach that risks your rights and freedoms, we will notify you and relevant authorities within 72 hours of discovery (as required by GDPR) or within 30 days (as required by India’s DPDP Act). Notifications will be sent to your registered email address.
To report a security vulnerability, email security@grapli.tech. We commit to acknowledging all reports within 48 hours.
7. Data Retention
We retain your data only as long as necessary for the stated purposes or as required by law:
| Data Category | What We Collect | Purpose |
|---|---|---|
| Account & Profile Data | Active account duration | Deleted within 90 days of account deletion, subject to legal holds |
| Video Files (S3) | Until you delete them or 365 days after account deactivation | Giving you access to your generated content |
| Payment Records & Invoices | 10 years from transaction date | Tax compliance, Indian accounting standards, financial audits |
| Usage & Analytics Logs | 90 days | Product improvement and debugging |
| Error Logs (Sentry) | 90 days | Technical debugging |
| Device / IP Logs | 90 days | Security and fraud prevention |
| OAuth Tokens | Until you disconnect the account or token expires | Publishing videos to social platforms |
| Automated DB Backups | 30 days rolling | Disaster recovery |
When an account is deleted, we initiate an automated deletion workflow. Most personal data is purged within 30 days; payment records are retained for 10 years as required by Indian law. You can request a complete data deletion status report by emailing privacy@grapli.tech.
8. Your Rights
Depending on your location, you have the following rights over your personal data. All rights can be exercised by contacting privacy@grapli.tech or through your account settings where available. We respond within 30 days.
Right to Access
All usersRequest a copy of all personal data we hold about you in a portable, machine-readable format (JSON/CSV). Available via Settings → Privacy → Download My Data.
Right to Correction
All usersRequest correction of inaccurate or incomplete personal data. Most data can be updated directly in Settings → Profile.
Right to Erasure
All usersRequest deletion of your account and personal data. Initiated via Settings → Account → Delete Account. Some data may be retained for legal compliance (see Section 7).
Right to Withdraw Consent
All usersWithdraw consent for non-essential processing (analytics, AI training opt-in) at any time via Settings → Privacy. Withdrawal does not affect prior lawful processing.
Right to Data Portability
EU/UK/India usersReceive your data in a structured, commonly used, machine-readable format and transfer it to another service.
Right to Object
EU/UK usersObject to processing based on legitimate interests (such as analytics). We will cease unless we demonstrate compelling legitimate grounds.
Right to Restrict Processing
EU/UK usersRequest restriction of processing while a complaint or correction request is pending.
Right to Non-Discrimination
California (CCPA) usersWe will not discriminate against you (e.g., deny service or charge different prices) for exercising your CCPA rights.
Grievance Redressal
India (DPDP) usersFile a complaint with our Grievance Officer (see Section 14). If unsatisfied, escalate to India's Data Protection Board.
10. International Data Transfers
Grapli is operated from India, but our infrastructure providers are primarily based in the United States. When you use Grapli, your personal data is transferred to and processed in the United States.
Legal basis for transfers
- EU / EEA / UK users: Data transfers are protected by Standard Contractual Clauses (SCCs) per GDPR Article 46 and supplementary technical measures (encryption, access controls) per the Schrems II requirements.
- Indian users: Transfers comply with India’s DPDP Act 2023. We ensure adequate safeguards are in place for all cross-border transfers.
- Other jurisdictions: Transfers comply with applicable local privacy laws. By using Grapli, you consent to the transfer of data to the United States.
To request a copy of the Standard Contractual Clauses applicable to your data transfers, email privacy@grapli.tech.
11. Children's Privacy
Grapli is designed for content creators who are at least 18 years old. We do not knowingly collect personal data from children under 13 (or under 16 for users in the EU/UK, per GDPR).
If we discover that a child under 13 has created an account, we will immediately delete the account and all associated personal data. If you believe a child has registered on Grapli, please contact privacy@grapli.tech immediately.
12. AI Processing & Data Usage
Grapli uses AI services to generate scripts, voiceovers, and captions. Here is exactly how your data flows through our AI pipeline:
Anthropic Claude (via AWS Bedrock)
Data sent: Your script topic/prompt and generation parameters
AI training: Anthropic does not use API data to train models by default. No opt-in required.
ElevenLabs (Text-to-Speech)
Data sent: The generated script text for voiceover production
AI training: ElevenLabs does not use API data to train models by default. You can verify this in your ElevenLabs account settings.
OpenAI Whisper (Captions)
Data sent: Audio portions of generated videos for transcription
AI training: OpenAI does not use API data to train models by default. They maintain a signed DPA for API customers.
13. Policy Changes
We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Send an email notification to your registered email address at least 30 days before the changes take effect.
- Display a prominent banner on the Grapli dashboard.
- Update the “Last Updated” date at the top of this page.
Your continued use of Grapli after the effective date of the updated policy constitutes your acceptance. If you disagree with the changes, you may delete your account before the effective date.
Previous versions of this Privacy Policy are available on request at privacy@grapli.tech.
14. Contact & Grievances
For any privacy-related questions, requests, or complaints, please contact us:
Privacy & Data Protection
Response within 48 hours acknowledgment, resolution within 30 days.
Grievance Officer (DPDP Act — India)
As required by India’s Digital Personal Data Protection Act 2023, we have appointed a Grievance Officer for data protection matters. Indian residents may submit formal complaints to:
Email: privacy@grapli.tech
Subject line: “DPDP Grievance — [Your Name]”
Address: Grapli, India
If your complaint is not resolved within 30 days, you may escalate to India’s Data Protection Board once it is operational.
EU / UK Supervisory Authority
If you are based in the EU or UK and believe we have not handled your data in accordance with GDPR or UK-GDPR, you have the right to lodge a complaint with your local data protection supervisory authority.
© 2026 Grapli. All rights reserved.
5. Social Media Integrations
When you connect TikTok, Instagram, or YouTube to Grapli, you grant us OAuth 2.0 access to publish videos on your behalf. Here is exactly what happens and how we protect you:
What access we request
How we store and protect your tokens
How to revoke access