Privacy Policy

The controller is RED BLOC, entrepreneur individuel, 86 rue aux Arènes, 57000 Metz, France (SIREN 751 518 143), publisher of VIOM — see the legal notice. Privacy contact: contact@red-bloc.com. No data protection officer has been appointed at this stage.

• Account data: email address, authentication identifiers, sign-in method (email or Google), account role
• Content you upload: source video files and the audio extracted from them
• Derived content: transcripts with timestamps, detected moments and scores, generated clips, captions, hooks, descriptions and hashtags
• Usage data: projects, jobs, processing status, credit reservations and transactions, AI usage records
• Billing data: Stripe customer and subscription identifiers, invoices, payment status. VIOM never receives full card numbers
• Technical and security data: IP address, browser and device information, logs, error reports

Your video may contain personal data about you and about other people (faces, voices, statements). You are responsible for having a lawful basis to upload it; see the content policy.

• Providing the service you request — performance of the contract
• Managing your account and authentication — performance of the contract
• Payments, subscriptions, invoicing and accounting — contract and legal obligation
• Security, fraud prevention, abuse detection and evidence preservation — legitimate interest and legal obligation
• Service quality, debugging, technical monitoring and capacity planning — legitimate interest
• Responding to your requests and to rights-holder reports — legitimate interest and legal obligation

VIOM does not carry out automated decision-making producing legal effects about you. The Viral Score is applied to content, not to persons, and is informational only.

Personal data is shared only with the providers needed to run the service:

• Lovable (application hosting, edge runtime) — Hosts the VIOM website and application server. Data: Requests, technical and security logs. Location: Global edge network.
• Supabase (managed through Lovable Cloud) — Database, authentication and private file storage. Data: Account data, project data, transcripts, source videos, generated clips, credit ledger. Location: European Union (AWS eu-central-1, Frankfurt).
• Google Cloud Run and Cloud Tasks (VIOM Media Worker) — Audio extraction, segmentation and video rendering with FFmpeg. Data: Source video and audio segments during processing. Location: European Union (europe-west1) in the current deployment.
• OpenAI — Speech-to-text transcription (Whisper). Data: Audio extracted from the uploaded video. Location: United States — transfer outside the EU.
• Lovable AI Gateway — Routes viral analysis, caption emphasis and publishing metadata requests to the AI model. Data: Transcript text and clip text, not the video file. Location: Routing may involve providers outside the EU.
• Stripe — Payment processing, subscriptions, invoices and the customer billing portal. Data: Billing identifiers, payment status, invoices. Card details are handled by Stripe, never by VIOM. Location: Ireland / United States (Stripe group).
• Google Sign-In (OAuth) — Optional authentication method. Data: Email address and basic profile fields provided by Google at sign-in. Location: United States.

Data is not sold and is not shared for advertising purposes.

To transcribe your video, the audio extracted from it is sent to OpenAI. To analyse it, to choose caption emphasis and to generate publishing metadata, the text of the transcript is sent to an AI model through the Lovable AI Gateway. The video file itself is not sent to the text model.

VIOM applies data minimisation and sends only what the feature requires. VIOM does not claim that this data is never used for provider model training: this depends on each provider's terms and configuration and has not been contractually verified for every production provider. It is listed as a compliance point to complete before commercial launch.

The database, storage and media processing used today are located in the European Union. Transcription (OpenAI), AI model routing, payments (Stripe) and Google Sign-In may involve transfers to the United States, framed by the providers' own transfer mechanisms (standard contractual clauses and, where applicable, the EU-US Data Privacy Framework). The formal verification of each transfer mechanism is part of the pre-launch compliance work.

Honest statement: VIOM does not yet apply an automatic retention schedule. Source videos, audio extracts, transcripts, clips and project data are kept until you delete them or ask us to delete your account, and are then removed from the active systems. Defining and implementing fixed retention periods is an identified compliance action and is not yet in place; we do not state periods we do not enforce.

Billing and accounting records are kept for the periods required by law. Security logs and records needed as evidence in a dispute are kept for as long as necessary for that purpose. Backups are overwritten in the ordinary backup cycle.

Under the GDPR you may request access, rectification, erasure, restriction of processing, objection, portability where applicable, and withdraw consent where processing is based on consent — without affecting processing already carried out.

Access to the database is restricted by row-level security policies, uploaded files and generated clips are stored in private buckets accessible only through short-lived signed links, communications with providers are authenticated and signed, and payment data never transits through VIOM. No system can be described as completely secure, and VIOM makes no absolute security promise. For security reasons, detailed architecture is not published.

See the cookie policy.