Privacy Policy

Last updated October 15, 2026

Vidora (https://vidora.rcinc.app) is an AI video studio operated by Radiant Crest Inc. (“RC Inc”, “we”, “us”), based in Toronto, Ontario, Canada. We are the controller of the personal information described here. This policy explains what we collect, why, the legal basis we rely on, who we share it with, where it is processed, how long we keep it, and the rights you have, including under the EU and UK General Data Protection Regulation (GDPR) and Canada's PIPEDA.

Google API Services disclosure. Vidora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1. Information we collect

Google sign-in

When you sign in with Google we receive your name, email address, profile photo and Google account ID (scopes openid, email, profile). We use these to create and secure your Vidora account.

YouTube channel analysis (optional)

Connecting a channel for analysis is a separate, optional step. If you choose to connect, you grant read-only access through these Google scopes:

youtube.readonly — to identify the channels you own (channel ID, title and thumbnail) and read the public metadata of your uploads (titles, descriptions, publish dates, durations and view, like and comment counts).
yt-analytics.readonly — to read your own channel's YouTube Analytics reports for the most recent 90 days: views, estimated minutes watched, average view duration and percentage per video, traffic-source types, and the top YouTube search terms and suggested-video sources that brought viewers to your channel.
youtube.force-ssl — only if you separately choose to let Vidora read the caption tracks of your own videos, to use their words when you turn one of your videos into a new film. Vidora uses this access only to download those captions.

Using the same access, Vidora also reads public video metadata for up to three peer channels that you name or that match your film topic in YouTube search.

Publishing connections (optional)

If you connect an account in Publish, Vidora can post the videos you choose, with the titles and captions you approve, at the time you schedule: YouTube (youtube.upload and youtube.readonly, to upload to and identify your channel), TikTok (user.info.basic, video.publish), Instagram (business publishing) and Facebook Pages you manage. Vidora posts only what you schedule, never edits or deletes your existing posts or videos, never changes account settings, and never reads your private messages, followers' or subscribers' identities or payout data.

Content you create or upload

Film topics, scripts, beat maps, storyboards and generated images, clips, narration, music and finished videos; recordings you upload to the Clip Room or Re-Make, and their transcripts; product details and media for launch videos; publishing packages (titles, thumbnails, descriptions, chapters, hashtags); and, if you create a digital creator, the photos, voice and recorded consent you provide for it.

Vidora Capture (desktop app)

Vidora Capture records on your computer and keeps recordings in a folder there; nothing leaves your computer unless you connect a Vidora account and upload. An uploaded recording (its video, thumbnail, title, length and size) is stored in your Vidora Capture space. Its link is viewable by anyone who has it, unless you set it to private at vidora.rcinc.app/capture. Connecting the app gives it a token that can only upload to your account; it is kept encrypted on your computer.

Billing and keys

Credit purchases are processed by Stripe; we receive a payment confirmation and keep a record of your credit purchases and spending, but never see your card number. If you add your own AI-provider keys, they are encrypted (AES-256-GCM) into a cookie held by your browser and are not stored on our servers.

Technical data

Our hosting provider records standard server logs (IP address, browser type, requested pages and times) for security and troubleshooting. See section 9 for cookies.

2. Why we use it and our legal bases

To provide Vidora — your account, making and storing your videos, publishing what you schedule, support. Legal basis: performance of our contract with you.
Optional connections and digital creators — analysing your channel, publishing to your accounts, using a likeness or voice. Legal basis: your consent, which you can withdraw at any time by disconnecting or deleting it in Vidora.
Security, fraud and abuse prevention, keeping the service running and understanding usage in aggregate. Legal basis: our legitimate interests, balanced against your rights.
Billing and tax records. Legal basis: legal obligation.

We do not sell personal information, use it for advertising, or use your content or Google data to train AI models. Vidora makes no decisions about you based solely on automated processing that have legal or similarly significant effects.

3. How we use Google and YouTube data

We use data received from Google APIs only to provide the Vidora features you request:

Niche Analysis (before a film): summarising which of your videos, formats and traffic sources perform best, contrasted with public peer-video signals, to suggest an original angle for your next film.
Publishing package (after a film): drafting title options, thumbnail directions, a description, chapters, hashtags and search/audience clusters for the film you made in Vidora.
Publishing: uploading the videos you schedule to the channel you choose.

We do not:

sell Google user data or use it for advertising, retargeting or interest-based ads;
use Google user data to develop, improve or train generalized AI or machine-learning models;
transfer Google user data to others except as necessary to provide or improve these user-facing features, for security or legal compliance, or as part of a merger or acquisition with notice to you;
allow humans to read your Google user data, except with your explicit consent for support, where needed for security or abuse investigations, or to comply with law.

4. Who we share data with

We use these service providers (processors) only to run Vidora, under contracts that limit them to processing on our instructions:

Vercel — website and application hosting, server logs.
Railway — database, video rendering and background jobs.
Bunny.net — media storage (Germany) and worldwide delivery network.
Stripe — payments.
Google — sign-in and the YouTube APIs you choose to connect.
CheaperInference — AI text generation: receives scripts, transcripts and, for a Niche Analysis or publishing package, a compact summary of your channel research.
AI33 — narration, music, sound effects and transcription: receives scripts, prompts and the audio of recordings you upload.
KIE — AI image and video generation: receives prompts and reference images. It does not receive your YouTube Analytics data.
Brave Search and Octoparse — web research about the topics you choose and transcripts of public videos; they receive search terms and public video links, not your account details.
Cloudflare — sends the reminder emails before films are deleted.
GitHub — reads public information about a repository you name for a launch video.

When you publish, the video, title and caption you approve go to the platform you choose (YouTube, TikTok, Instagram or Facebook), whose own terms and privacy policies then apply. We may also disclose information when required by law or to protect rights and safety, or to a successor in a merger or acquisition with notice to you.

5. International transfers

We are based in Canada, which the European Commission recognises as providing adequate protection for commercial personal information. Our providers process data in the United States, the European Union and other countries. Where personal information from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) included in our providers' data processing terms, or on a provider's certification under the EU–US Data Privacy Framework.

6. How long we keep it

Finished films, their saved project state and publishing materials: deleted 14 days after each final render. We email reminders one week, two days and two hours beforehand; if a reminder is late, deletion waits at least two hours after the final notice. Drafts without a finished film are not on this clock.
Niche Analyses derived from your YouTube data: deleted automatically 30 days after they are created. Raw YouTube API and Analytics responses are processed in memory and not stored.
Clip Room jobs, Re-Makes, launch videos, Re-Imagine boards, digital creators, Vidora Capture uploads and publishing history: kept until you delete them or your account.
Connected accounts: kept until you disconnect them or delete your account.
Account: until you delete it.
Credit purchases, spending and adjustments: kept for as long as tax and accounting law requires (generally six years in Canada), including after the account is deleted, without your name or email.
Copies held by our delivery network expire within 30 days, and deleted data leaves our providers' backups as they are overwritten.

7. Security

All traffic is encrypted in transit (HTTPS with HSTS). Sign-in uses Google with PKCE; sessions are signed, HttpOnly, Secure cookies.
Tokens for YouTube and social accounts are stored only encrypted with AES-256-GCM; access tokens for YouTube analysis are requested on demand and never stored.
Each account can open only its own projects; administrators work under separate sign-in, role-based permissions and an audit log.
Your media files are stored at long, unguessable private links rather than behind sign-in, so they can be played and downloaded quickly. Anyone you give such a link to can open that file.
If a breach puts your information at risk, we will notify the relevant regulator within 72 hours where required and tell affected users without undue delay.

8. Your rights and choices

Depending on where you live, you have the right to access your information, receive it in a portable format, correct it, delete it, restrict or object to how we use it, and withdraw consent at any time (without affecting processing before withdrawal).

Download your data: in Vidora, open Settings, then Your data, then Download my data.
Delete your account: Settings, then Your data, then Delete my account. This deletes your videos, uploads, creators, publishing history and connected accounts immediately (revoking Vidora's access at each platform), keeping only the billing records described above.
Disconnect a channel or account in Settings or Publish. For YouTube analysis we revoke Vidora's Google access and delete the stored token, channel record and its Niche Analyses. You can also revoke access at myaccount.google.com/permissions.
Anything else, or if you cannot sign in: email privacy@vidora.rcinc.app. We respond within one month (30 days under PIPEDA), and may ask you to confirm your identity.
Complaints: you can contact your local data protection authority (in the EEA or UK) or the Office of the Privacy Commissioner of Canada. We would appreciate the chance to address your concern first.

9. Cookies

Vidora uses only cookies that are strictly necessary: a signed session cookie that keeps you signed in, a separate one for administrators, short-lived cookies that protect sign-in and account connections, and, if you add them, the encrypted cookie holding your own AI-provider keys. We do not use analytics, advertising or cross-site tracking cookies.

10. YouTube API Services

Vidora uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

11. Children

Vidora is not directed to children under 13, and we do not knowingly collect their information. Where the law requires a higher age to consent to data processing (up to 16 in parts of the EEA), you must meet it or have a parent's or guardian's consent.

12. Changes and contact

We will post changes here and update the date above; material changes, including to how we use Google user data, will be notified in the app before they take effect. Questions and requests: privacy@vidora.rcinc.app · Radiant Crest Inc., Toronto, Ontario, Canada. Security issues can be reported to the same address (see security.txt).