ShowDrop · legal

Privacy Policy

Effective date: 2026-08-08

This Privacy Policy explains how Stoneclad Media ("ShowDrop," "we," "us"), operator of showdrop.ai (the "Service"), collects, uses, shares, and protects your information. It applies to the Service, our website, and related communications. By using the Service you agree to this Policy.

Contact: [PRIVACY EMAIL, e.g., privacy@showdrop.ai] · [MAILING ADDRESS]

1. Information We Collect

Account information. Email address, name (if provided), password credentials (handled by our authentication provider; we never store plaintext passwords), and plan/subscription status.

Uploaded media and produced content. The raw video/audio footage, artwork, and other files you upload, and the finished episodes, clips, thumbnails, captions, and text the Service produces from them.

Transcripts. Machine-generated transcripts of your uploaded media, created as part of processing.

Usage events. Product telemetry such as jobs submitted, processing status, token consumption, feature usage, log data, IP address, browser/device information, and approximate location derived from IP.

Payment information. Payments are processed by Stripe. We do not store full card numbers; we receive and store payment status, plan, invoice history, and the last four digits/brand of your card as provided by Stripe. Stripe's handling of your data is governed by Stripe's privacy policy.

YouTube/Google data. If you connect YouTube, we receive OAuth tokens and limited channel metadata (channel name, ID, upload permissions status) needed to publish on your behalf. See Section 5 (Limited Use).

Support communications. Emails and messages you send us.

We do not knowingly collect data from children under 13 (or under 16 where a higher age applies), and the Service is not directed at them.

2. How We Use Information

  • Provide the Service: store and process your media, generate transcripts and finished content, publish to platforms you direct.
  • Operate billing, token accounting, and the free-episode allowance.
  • Secure the Service: fraud and abuse prevention, content-safety screening, bot protection (Cloudflare Turnstile).
  • Improve the Service: aggregate, de-identified analytics on usage and processing performance.
  • Communicate with you: transactional emails (job status, billing, security) and, with your consent where required, product updates. You can opt out of marketing at any time.
  • Comply with law and enforce our Terms.

No training on customer content. We do not use your uploaded media, transcripts, or produced content to train generalized AI/ML models, and our AI subprocessors are used under terms (API/zero-retention or no-training commitments) that prohibit them from training their models on your content.

3. Legal Bases (GDPR)

Where the EU/UK GDPR applies, we process personal data on these bases: contract (providing the Service you signed up for), legitimate interests (security, fraud prevention, product analytics, service communications), consent (marketing emails, optional cookies), and legal obligation (tax, accounting, lawful requests).

4. Processors and Subprocessors

We share personal data only with service providers who process it on our behalf under contractual safeguards, with platforms at your direction, or as required by law. We do not sell personal information and do not share it for cross-context behavioral advertising.

| Provider | Role | Data involved | |---|---|---| | Supabase | Database, authentication, application storage | Account data, usage events, job metadata, transcripts | | Cloudflare R2 | Object storage for media | Uploaded media, produced content | | Fly.io | Compute for media processing pipeline | Media and transcripts during processing | | Anthropic | AI language models (editorial decisions, titles, show notes) | Transcripts and job context sent via API | | ElevenLabs | Speech/audio AI processing | Audio and transcript data sent via API | | Stripe | Payment processing and billing | Payment and subscription data | | Google / YouTube API | Publishing to your YouTube channel at your direction | OAuth tokens, channel metadata, uploaded videos and metadata | | Vercel | Web application hosting | Web request data, account session data | | Cloudflare Turnstile | Bot protection on forms | Browser/device signals, IP address |

We will update this table as subprocessors change; material changes will be reflected in an updated Policy.

5. Google API Services — Limited Use Disclosure

ShowDrop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for data obtained through Google/YouTube API scopes:

  • We only use Google user data to provide and improve the user-facing features you request — publishing videos, setting titles, descriptions, thumbnails, and scheduling on your own channel.
  • We do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger/acquisition with notice to you.
  • We do not use Google user data for serving advertisements.
  • We do not allow humans to read Google user data unless (a) you give explicit permission, (b) it is necessary for security purposes (such as investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations.
  • We do not use Google user data, including YouTube data, to train generalized AI/ML models.

You can revoke ShowDrop's access to your Google account at any time at https://myaccount.google.com/permissions or in your ShowDrop account settings. Upon revocation we delete stored OAuth tokens promptly.

6. Cookies

We use strictly necessary cookies (authentication, session, security/Turnstile) and limited analytics. We do not use third-party advertising cookies. Where required, we request consent for non-essential cookies.

7. Media Retention and Deletion

  • Uploaded raw footage: retained while your account is active to enable re-processing, or [N days — confirm implementation, e.g., 30 days after processing], whichever policy is displayed in-product at upload time.
  • Produced content: retained while your account is active; available for download for at least 30 days after cancellation, then scheduled for deletion.
  • Transcripts and job metadata: retained while your account is active.
  • Account deletion: you may delete your account in settings or by emailing us. We delete or de-identify your personal data, media, and transcripts within 30 days of a verified deletion request, except data we must retain for legal, billing/tax, or security purposes (retained no longer than required). Backup copies purge on a rolling basis within [N, e.g., 35] days.
  • AI subprocessors: content sent to AI providers is processed via API under zero-data-retention or short-lived retention terms and is not retained by them for training.

8. Security

We use industry-standard safeguards: encryption in transit (TLS) and at rest, scoped access controls, secrets management, isolated processing environments, and least-privilege OAuth scopes. No system is perfectly secure; we will notify you and regulators of a personal-data breach as required by law.

9. International Transfers

We are based in the United States and process data there and in the regions our providers operate. Where GDPR applies, transfers rely on adequacy decisions or Standard Contractual Clauses with our providers.

10. Your Rights

Everyone: access, correct, download, or delete your data via account settings or by contacting us; opt out of marketing.

GDPR (EEA/UK): rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent; you may lodge a complaint with your supervisory authority.

CCPA/CPRA (California): rights to know, delete, correct, and to non-discrimination. We do not sell or share personal information as defined by the CCPA, and we do not use sensitive personal information beyond permitted service purposes. Submit requests to [PRIVACY EMAIL]; we will verify your identity before acting. Authorized agents may submit requests with proof of authorization.

We respond to verified requests within the timelines required by applicable law (generally 30–45 days).

11. Changes

We may update this Policy. Material changes will be announced by email or in-product at least 14 days before taking effect. The current version always lives at showdrop.ai/privacy.

---

Questions or requests: [PRIVACY EMAIL, e.g., privacy@showdrop.ai]