Privacy Policy

• Account data: email address and name (when you register by email or with Google).
• Payment data: managed entirely by Stripe. Bandi does not store card numbers; we only store subscription/customer identifiers and your plan status.
• Content you create: topics, scripts, settings, and the resulting videos.
• Technical usage data: logs necessary to operate the service (errors, quotas, session identifiers).
• Free-trial abuse prevention: we store a device identifier and technical signals from your browser (as a hash) linked to your account. They are not used for advertising purposes.
• Usage and origin data: what you do in Bandi (for example, creating, downloading or publishing a video, connecting a social account or starting a payment), your device and browser type, your country and the campaign or page you arrived from. It does not include the text of your topics or scripts. If you accept cookies, also dashboard session recordings with the text hidden (see “Cookies”).
• Notifications on your phone or computer: if you turn them on, we store the subscription your browser gives us (a technical address and its keys), your device and browser type, time zone and language, which notifications you want and which ones we have sent you or you have opened. So as not to ask you more than needed, we also store how and when you answered the notifications question.
• Statistics of the videos you publish with Bandi (if you have milestone notifications turned on): their views, likes, comments and shares. The ID of each published video is stored with the post.

• Providing the service (creating your account, generating and delivering videos) — performance of a contract.
• Managing payments and billing — performance of a contract and legal obligations.
• Support and communications regarding your account — legitimate interest / performance of a contract.
• Service improvement and security — legitimate interest.
• Measuring how the service is used and how well our ads work (what works and where problems occur) — legitimate interest. You may object at any time (see “Your Rights”).
• Analysing in the browser how you use Bandi, recording sessions and showing you ads — your consent in the EU, the EEA, the United Kingdom and Switzerland (you give it with “Accept” in the cookie notice and can withdraw it at any time).
• Sending you the notifications you turn on (for example, that your video is ready or that one of your videos has passed 1,000 views) — your consent, given when you allow notifications in your browser. You can switch them off by type under “Notifications” in your profile, or withdraw them in your browser settings.
• Tracking how the videos you publish with Bandi perform and telling you about your milestones — performance of the contract.

• Supabase — authentication and database.
• Stripe — payment processing.
• Cloudflare R2 — video storage and delivery.
• Vercel — web hosting.
• AI providers (image, voice, and text generation) — receive only the content required to generate your video.
• Google — only if you sign in with Google (name, email address, and profile picture).
• PostHog (servers in the EU) — analysis of how the service is used and session recordings.
• Browser push services (Google, Apple, Mozilla or Microsoft, depending on your browser) — they deliver the notifications you turn on; their content is encrypted and they cannot read it.

You may choose to connect your TikTok accounts and YouTube channels to Bandi in order to publish the videos you generate and to view their statistics. This connection is optional and is authorised by you on each platform's official screen (OAuth). Bandi never sees your password.

• Data we access: the account or channel identifier, name and picture; the list of published videos and their public metrics (views, likes, comments and shares); and permission to upload videos on your behalf.
• How we use it: solely to show you your connected accounts and their statistics inside Bandi, to tell you about the milestones of the videos you publish with Bandi (if you turn on notifications), and to publish the videos you choose to publish, with the title, description, privacy setting and audience declaration you select for each post. We do not use this data for advertising and we do not sell it.
• How we store it: access tokens are stored encrypted (AES-256-GCM) and are used only by our servers for the actions above. If you have milestone notifications turned on, statistics of the videos you publish with Bandi are fetched periodically to tell you about them and are kept for at most 30 days since they were last fetched; other statistics are fetched when you open the screen. They are not shared with third parties.
• How we protect this data: all communication with Google, TikTok and our servers is encrypted in transit (TLS 1.2 or higher). Tokens are encrypted at rest with AES-256-GCM using a key that lives only in the server environment, never in the browser or in the code; the database enforces row-level access policies so no user can read another user's connected accounts, and administrative access is restricted to the Bandi team under individual credentials. We do not keep copies of your YouTube videos or comments; statistics are read on demand when you open the screen and, if you have milestone notifications turned on, every few hours; those are kept for at most 30 days and deleted when you disconnect the account. Tokens are deleted when you disconnect the account or delete your Bandi account, and Google user data is never transferred, sold or used for advertising, profiling or training models. If we detected a security breach affecting this data, we would notify you and the competent authority within the legally required timeframes.
• How to revoke access: from your Bandi profile (Disconnect), and also from your Google security settings (https://myaccount.google.com/permissions) or TikTok settings. When you disconnect we delete the tokens; when you delete your Bandi account all associated data is erased.

Bandi uses YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service and the Google Privacy Policy. Bandi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.