Privacy Policy

1. Who we are

AnvilHQ provides a multi-tenant workspace where users belong to teams. We offer AI thumbnail generation, YouTube title and idea tools, competitor intelligence, kanban planning boards, storyboards, a content calendar, partnership/brand-deal CRM, production budgeting, a video-edit marketplace, and AI video dubbing/localization. For privacy questions you can contact us at privacy@anvilhq.io.

Depending on how you use the Service, AnvilHQ may act as a data controller (for account, billing, and how we run the Service) and as a data processor (for the workspace content you and your team upload and create).

2. Information we collect

2.1 Account and identity data

• Email address and a password (stored only as a salted hash by our authentication provider, Supabase) when you sign up with email and password.
• Optional display name / full name you provide at signup.
• Google account profile (name and email) if you choose to sign in with Google. We do not receive your Google password.
• Team / workspace data: workspace name, your team membership, role, and invitation status; the email addresses of members you invite.
• An onboarding flag recording whether you have completed the setup wizard.

2.2 Creator profile (onboarding)

If you complete onboarding, we store the profile details you choose to share so we can tailor AI outputs to you: your niche, content formats, platforms, target audience, brand voice, goals, creator stage, and an optional free-text “about” description. This is optional and you may skip it.

2.3 Content you create or upload

We store the content you and your team create in the Service, which may contain personal data you choose to include:

• Projects, assets, and images (project covers, headshots, logos, and other uploaded images), boards and cards, storyboards and frames, and calendar events.
• Thumbnails you generate or save, including the title, topic, and the text prompt used to generate them.
• Competitor analyses and idea/title outputs, including the niche and topics you research.
• Budgets and expenses for your productions.
• Partnership/CRM records: partner names, companies, email addresses, phone numbers, websites, social links, notes, deal terms, and internal deal-payment tracking (these are records you maintain about third parties).
• Dubbing jobs: source video files you upload, file names, durations, selected languages, generated transcripts/translations, and dubbed output files.
• Marketplace data (video-edit marketplace): job posts, editor profiles (display name, bio, contact email, rates, portfolio links), and job applications.

2.4 Billing data

Payments are processed by Stripe. We do not store your full card number or other payment-instrument details. We store your subscription status, plan, billing interval, trial dates, credit balances and usage, and the Stripe identifiers (customer ID, subscription ID, payment-intent IDs) needed to manage your subscription.

2.5 Usage and technical data

• Usage/credit events: which AI features you used and the credits or dubbing minutes consumed, used for metering and billing.
• Authentication cookies: our provider sets secure session cookies (sb-*-auth-token) to keep you signed in and refresh your session. These are strictly necessary for the Service to function.
• Local browser storage: your theme preference is stored locally in your browser and is never sent to our servers.
• Standard server and hosting logs generated by our infrastructure provider (Vercel and Supabase), which may include IP address and request metadata.

We do not use third-party advertising, marketing, or analytics tracking cookies in the Service. If we add analytics in the future, we will update this policy.

3. How we use your information

• To provide, operate, and maintain the Service and your team workspace.
• To authenticate you and keep your account secure.
• To generate AI outputs you request (thumbnails, titles, ideas, budgets, competitor intel, and dubbing), including personalizing them using your creator profile.
• To process subscriptions, trials, credits, and payments.
• To meter feature usage and enforce plan limits.
• To respond to support requests and communicate service-related notices.
• To detect, prevent, and address abuse, security incidents, and technical issues.
• To comply with legal obligations and enforce our Terms of Service.

4. AI processing

When you use AI features, the relevant inputs — which may include your prompts, topics, creator-profile context, uploaded or reference images, and (for dubbing) a link to your uploaded video — are sent to our AI subprocessors so they can return a result. We send only what is needed to perform the feature you requested. AI providers process this data to generate outputs and under their terms; please review their policies, linked below.

5. Subprocessors and third parties we share data with

We share data with the following service providers strictly to operate the Service. We do not sell your personal data.

We may also disclose information when required by law, to enforce our agreements, to protect the rights, safety, and property of AnvilHQ or others, or in connection with a merger, acquisition, or sale of assets (with notice where required).

6. File storage and visibility

Uploaded images and generated media are stored in our media storage, and dubbing source/output videos are stored in our dubbingstorage, hosted with Supabase. Some stored files are served from public storage URLs so they can load in the app; anyone who has a file’s direct URL may be able to access that file. Please avoid uploading content you do not want to be accessible by URL.

7. Data retention

We retain your account, profile, and workspace content for as long as your account or team is active, and as needed to provide the Service. Billing records are retained as required for tax, accounting, and legal purposes. When you delete content or close your account, we will delete or anonymize the associated personal data within a reasonable period, except where we must retain it to meet legal obligations or resolve disputes. You can request deletion as described below.

8. Security

We rely on reputable infrastructure providers and use measures such as encrypted transport (HTTPS), hashed passwords, scoped access keys (with secret keys kept server-side only), and team-based access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. International transfers

Our providers may process and store data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

10. Your rights

Depending on where you live (for example, under the EU/UK GDPR or the CCPA/CPRA in California), you may have the right to access, correct, export, delete, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, email privacy@anvilhq.io. We will respond consistent with applicable law. You also have the right to lodge a complaint with your local data protection authority.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

Questions or requests about this policy or your data can be sent to privacy@anvilhq.io.