Privacy Policy

Effective date: October 31, 2026. This policy describes the current website and Free and Pro plugin workflows.

This Privacy Policy explains how VidFlow AI handles information when you use the VidFlow AI WordPress plugin, the VidFlow AI website, and related documentation or support resources.

1. Scope

This policy covers:

the VidFlow AI WordPress plugin;
the VidFlow AI website; and
our documentation and related communications.

This policy does not replace the privacy policies of third-party AI video providers, WordPress hosts, analytics services, payment processors, or other third parties you use with the plugin.

In this policy, we and our refer to the operator of the VidFlow AI website and support service. Contact us at support@vidflow-ai.com. If you install VidFlow on your own WordPress site, you control that site and the plugin records held there. Freemius operates separately as merchant of record for Pro transactions; configured AI providers, Google/YouTube and your hosting provider process data under their own roles and notices.

2. Core product model

VidFlow AI Free provides provider connections and video generation from your WordPress site. VidFlow AI Pro adds local workflow tools, including WooCommerce Product Videos, while provider requests still use the connection you select.

In the bundled bring-your-own-key workflow:

you enter provider API credentials into your WordPress site;
your WordPress site sends requests directly to the provider you configure;
provider responses are returned to your WordPress site; and
VidFlow AI does not require a VidFlow-hosted credit relay for the bundled provider flow.

The Pro license and purchase flow uses Freemius and is described under data sharing below. The current bundled provider flow does not require a VidFlow-hosted credit relay.

3. Information processed on your WordPress site

Depending on how you use the plugin, VidFlow AI may store or process the following information on your WordPress site:

provider API credentials or tokens that you choose to save;
prompts, negative prompts, generation settings, and aspect ratio or model selections;
reference image URLs, attachment references, or other media inputs you choose to use;
provider job identifiers, statuses, error messages, timestamps, and returned media URLs;
plugin settings, UI preferences, and workflow records such as library entries;
Google OAuth client settings, encrypted authorization secrets or tokens, connected YouTube channel details, publishing records and published destination links when you enable YouTube publishing;
generated content metadata and shortcode or block configuration; and
operational logs created for debugging, polling, or troubleshooting.

Some of this information may be personal data if it relates to an identified or identifiable person.

4. Information sent to third-party providers

When you test a connection, submit a generation, retry a job, or poll job status, your WordPress site may send relevant data to the configured provider, such as:

your provider credential or authorization token;
prompt text and generation parameters;
reference media URLs or files, where supported;
callback or polling requests needed to complete the job; and
related technical request metadata required by the provider API.

For Pro Product Video, Continue in Auto mode authorizes two text requests: a storyboard, then scene prompts. WordPress sends the current product title (up to 300 characters), full and short descriptions (up to 2,000 characters each), and local style guidance to the selected Gemini or OpenAI connection. This can include unsaved editor text. The prompt contains no image bytes or separate price, category, or tag fields. The selected credential is sent separately to authenticate the provider request and is not part of the prompt. Custom mode does not call a text provider. Provider charges may apply.

Free sends the reviewed prompt, optional Start and End Frame bytes when supported, and selected settings to the selected video provider. Google video requests use your configured Google connection; WordPress keeps the interaction identifier for background status recovery and downloads the short-lived result to protected local Media Library storage before marking the video complete. Hailuo results may remain provider-hosted unless the site’s storage settings save a local copy. Product details are not separate provider fields unless you include them in the reviewed prompt. Opening an editor or assigning an existing video does not submit generation.

Provider connections can use encrypted credentials saved in VidFlow AI or credentials managed by WordPress Connectors. Product data, prompts, credentials, and media are not sent to a VidFlow-owned API. Public playback can contact a provider media host for provider-hosted video, or use the site’s local or protected playback endpoint when a local copy exists.

Returned provider data may include:

task or job IDs;
processing status;
error details;
generated media URLs; and
related output metadata.

Third-party providers process data under their own terms and privacy policies. Review those policies before using a provider.

Text and image workflows

Pro Auto plans structured scenes through the configured text connection. Gemini text and image tools can use the native Google key saved in VidFlow AI; a WordPress-managed connection retains its own credential storage. Custom prompt entry skips Auto text planning, but separately chosen image or video actions may still incur provider charges. Saved preferences do not prove account access or credits.

Pro opening-image preparation uses the fixed Gemini Nano Banana 2.1 image model. Auto sends the original product reference image bytes and an image prompt containing bounded product and style excerpts, the shared visual brief, and that scene’s video prompt. Explicit Regenerate sends the displayed opening-image prompt and original reference bytes; comparison text is not appended. A separate Check model access action sends the saved Google credential and fixed image-model ID only; it sends no product text or images and does not generate media or test Google video access. Each paid text, image, and video action is separate. Opening the editor or assigning existing media does not submit generation. Review generated output for changes to product details before publishing.

Image submission authority lasts 24 hours. Scene-bound encrypted temporary candidate bytes remain available for six additional days of local recovery, and durable replay receipts remain after candidate cleanup. Legacy unbound candidates use a ten-minute cleanup grace period. Legacy prompt-request recovery also lasts ten minutes; current durable preparation records preserve frozen inputs, stage receipts, and recovery state. These are WordPress records controlled by the site operator. Check or recover an existing paid operation before considering another charged request.

Hailuo videos may remain provider-hosted unless the site’s existing storage settings create a local copy. Google video results are retrieved into protected local Media Library storage before completion. Prepared images, thumbnails, and merged videos can use local uploads. Google stored interactions default to 55 days on paid tiers and one day on the Free tier; Google-generated files generally expire after 48 hours, and retaining an interaction does not extend a file’s lifetime. Review Google’s current Interactions API and Files API documentation. Media requests expose ordinary request metadata to the relevant provider or media host. Site and CDN protection must be configured; local storage cannot prevent copying.

Google / YouTube publishing

VidFlow AI uses YouTube API Services for optional channel connection and video publishing. When you authorize a channel, your WordPress site sends Google the OAuth client information, authorization request, requested scopes and token requests needed for the connection. When you publish, it sends the selected video bytes, title, description, visibility and other supported upload settings to YouTube.

Google/YouTube can return channel identity, access or refresh tokens, upload-session information, video IDs, processing status, errors and public/embed links. These records support channel verification, authorized uploads, upload recovery, publishing history and playback. The validated refresh token is stored encrypted on your WordPress site. Successful uploads remove resumable upload-session URLs from publishing logs. Other site administrators with the relevant permissions, your host and your backups may hold or access local records; this workflow does not send them to a VidFlow-owned generation relay.

Review the Google Privacy Policy, YouTube Terms of Service and YouTube API Services Terms of Service before connecting. If you select published YouTube playback, visitors load a YouTube player; YouTube may process device/request information, use cookies and serve content or advertisements under its own policies.

To withdraw authorization, remove VidFlow AI access on the Google account permissions page. For local deletion, stop queued publishing work and ask the administrator of your WordPress site to remove saved YouTube authorization and associated publishing records using the site’s available controls or request assistance at support@vidflow-ai.com. Site backups follow the site’s retention practices. Revoking access does not delete a video already uploaded to YouTube; manage or delete that video in YouTube. For information held directly by VidFlow support, send a separate access or deletion request to support@vidflow-ai.com.

5. VidFlow AI website information

The website has no contact form. You can email support@vidflow-ai.com for support, refund requests, privacy questions or copyright concerns. We receive your email address, name if supplied, message, attachments and any purchase/site details you choose to send so we can respond. Do not send API keys, passwords, license keys, signed media URLs or private customer data.

Free plugin support is also available through the WordPress.org support forum. Forum posts are public and are processed by WordPress.org under its privacy policy. An email link opens your chosen email service; the sending and receiving mail services process the message. The retired Contact route points to Support and does not collect form submissions.

If you activate or purchase Pro, Freemius may receive account, site, WordPress environment, plugin, theme, license, order and payment-related information. Freemius is the merchant of record for checkout and handles payments, transaction taxes and its buyer/account records. It may share customer and transaction/licensing information with us to deliver licenses and support. Review the Freemius Privacy Policy. We do not receive your complete payment-card details through the normal Freemius checkout.

Website requests can expose IP address, browser/device information, requested pages, referrer and timestamps to the website host, security services and relevant content providers. The exact records depend on the service and settings in use.

Cookies and embedded video

WordPress uses cookies for administrator login and related preferences when those features are used. Essential hosting/security functions may also use cookies. Our Cookie preferences control stores a first-party localStorage record named vidflow_ai_consent on this browser for 180 days after you save a choice. It records the notice version, your Vimeo choice, the saved time and expiry time; it is not a tracking identifier or sent to us by this control. Clearing browser storage removes the choice. If storage is unavailable, the choice applies to the current page only.

Vimeo videos are optional. Before you allow Vimeo videos, we do not load their embedded players. Accept Vimeo videos or enable that category in Cookie preferences to let tutorial players load automatically on this site; the homepage presentation still waits for Play. If you reject or withdraw, the player stays off and we show a video link explaining the declined consent. With JavaScript disabled, use the external video link. Opening Vimeo directly contacts Vimeo under its own policies.

When loaded, Vimeo receives request/device information such as your IP address, browser information and referring origin. Our players use dnt=1 to limit session analytics and tracking. Vimeo says essential security cookies may still be set, and cookies already stored from earlier Vimeo visits may still be sent. DNT does not make playback free of third-party requests. See Vimeo Privacy and Vimeo Player Cookies for purposes and current expiry information.

Use the Cookie preferences button available throughout the site to change or withdraw your choice. Reject optional or save with Vimeo videos switched off to remove loaded players and stop further embedded playback. This cannot undo earlier requests, erase information Vimeo already received, or delete third-party cookies; use your browser controls and Vimeo privacy routes for those. Blocking cookies or third-party requests may affect login or playback.

This choice covers Vimeo videos only. It does not authorize analytics, advertising or new purposes. Any future optional categories require their own explanation and choice before activation. Email support@vidflow-ai.com with privacy questions. Applicable privacy and data-protection requirements remain separate from this technical control.

6. How we use information

We use information to:

provide and operate the plugin and website;
document and explain plugin functionality;
troubleshoot issues and respond to support requests;
maintain security, integrity, and abuse prevention;
improve compatibility, performance, and product decisions; and
comply with legal obligations and enforce our terms.

7. Legal bases

Where data-protection law requires a lawful basis, it depends on the purpose and our relationship with you:

Contract or steps you request before a contract: responding to purchase enquiries, delivering a software license and providing the support included with your purchase.
Legitimate interests: responding to other enquiries, maintaining secure and reliable services, troubleshooting, preventing abuse and defending legal claims, subject to your rights and interests.
Legal obligation: retaining or providing records that applicable tax, accounting, consumer or other law requires us to keep.
Consent: where applicable law requires permission for an optional use or technology. You may withdraw that consent without affecting the lawfulness of earlier processing.

OAuth authorization permits the selected Google/YouTube actions; it does not transfer control of your WordPress site to VidFlow. The site operator and the providers you choose are responsible for the lawful bases of processing they control.

8. Data sharing

We may share information:

with third-party providers that you choose to connect;
with hosting, infrastructure, analytics, email, payment, or support vendors that help us operate our website or services;
with Google/YouTube when you authorize publishing or load YouTube playback, and with Vimeo when you load our embedded videos, as described above;
with professional advisors or authorities when required by law or needed to protect rights, safety, or security;
with Freemius for Pro license activation, account management, purchases, renewals, and updates, as described in its privacy policy; and
in connection with a merger, acquisition, financing, reorganization, or sale of assets.

We do not sell your personal information in exchange for money in the ordinary course of operating the current free plugin.

9. Data retention

Plugin data stored on your WordPress site remains under the site operator’s control and follows its settings, backups, logs, and deletion practices. Pro image submission authority lasts 24 hours; encrypted scene-bound candidate bytes remain for six more days, while durable replay receipts remain after cleanup. Pro uninstall removes its request records, caches, temporary candidates, and owned credentials only when the site’s Delete plugin records on uninstall preference is enabled. The shared Google key belongs to Free and follows Free’s separate cleanup preference.

Support correspondence and related troubleshooting records are kept for as long as needed to handle the request, provide any continuing support, resolve disputes and meet legal record-keeping duties. Purchase/license records follow applicable transaction, tax and licensing requirements. Website/security logs and backups follow the relevant system settings and retention practices. No contact-form retention period applies because the website has no contact form. Records may remain in backups until the normal backup cycle expires.

10. Security

We take reasonable steps to protect information we control, but no system is completely secure. You are responsible for securing your WordPress site, administrator accounts, hosting environment, backups, and provider credentials.

If you choose to store provider credentials in WordPress, you should limit administrator access and follow security best practices for your host and site.

11. International transfers

The website, email, Freemius, Vimeo and the providers you choose may process information in countries other than your own. The countries and safeguards depend on the service and settings used. Their linked privacy notices explain their processing. For information about transfers of data we directly control and the safeguards relevant to your request, email support@vidflow-ai.com. Applicable transfer and data-protection requirements continue to apply; using a merchant of record does not remove those requirements.

12. Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of personal data, restrict or object to processing, and withdraw consent. Some records may need to be retained for legal obligations, security or legal claims. Withdrawal does not affect processing that was lawful before withdrawal.

For website/support information we directly control, email support@vidflow-ai.com with your request. We may ask for proportionate information to verify identity and locate the records. We respond within the period required by applicable law; where GDPR applies, this is generally one month, with extensions only where allowed and explained.

For plugin records on your own WordPress site, contact that site’s administrator. For Freemius transaction/account records or data held by Google/YouTube, Vimeo or another provider, use that service’s account controls and privacy-request route. You may also complain to the data-protection authority competent for your situation; EU/EEA and UK users may contact their local supervisory authority, including the EU/EEA authorities or the UK ICO.

13. Children’s privacy

VidFlow AI is not intended for children under 13, and we do not knowingly collect personal information from children through our website or services.

14. Changes to this policy

We may update this Privacy Policy from time to time. The latest version may be published on the VidFlow AI website and may also be included in the plugin package.

15. Contact

Support, refunds, privacy requests and copyright concerns: support@vidflow-ai.com.

Website: vidflow-ai.com. Read our Terms and Conditions, including the 14-day first-purchase refund policy.