Privacy Policy
Last updated July 8, 2026
1. Who We Are
This Privacy Policy explains how Invideo collects, uses, discloses and otherwise processes personal data when you access or use the Services. Capitalised terms used here have the same meanings as in our Terms of Service.
The Invideo entity responsible for processing your personal data, and the meaning of “Invideo”, “we”, “us” and “our” in this Privacy Policy, is the entity that contracts with you under our Terms of Service, Section 1.
This Privacy Policy forms part of the four-document framework described in our Terms of Service, Section 1. Where there is any conflict between this Privacy Policy and the Terms of Service on matters of personal data processing, this Privacy Policy prevails. If you do not agree with this Privacy Policy, you must not use the Services.
a. Scope. This Privacy Policy applies where Invideo determines the purposes and means of processing your personal data, that is, where Invideo acts as a data controller, data fiduciary or equivalent under applicable law.
It does not apply to personal data that we process solely on behalf of a business customer that has signed a separate written agreement with Invideo, such as a Master Services Agreement and Data Processing Addendum (“Customer Personal Data”). In those cases the business customer is the controller and our processing is governed by that agreement. If you believe your personal data is held by a business customer that uses our Services, please contact that organisation directly.
b. Our roles under data protection law.
i. Business customers (enterprise track). Where an organisation has signed a Master Services Agreement with Invideo and submits personal data to the Services as Customer Personal Data, that organisation is the controller (or equivalent) and Invideo acts as its processor (or equivalent). We process Customer Personal Data only to provide, maintain and support the Services as instructed by that customer, and not for our own independent purposes.
ii. Individual users (consumer and self-serve track). When you sign up for an Invideo account directly, visit our websites, browse our marketing pages or contact us outside of an enterprise contract, Invideo is the controller of the personal data we collect about you.
iii. System and Usage Data. We generate and use aggregated, de-identified system data (“System Data”), meaning technical and operational telemetry generated by the Services, and usage data (“Usage Data”), meaning data relating to feature usage and service interactions, such as performance metrics, error logs and usage patterns derived from how the Services operate. This data does not identify you and is used by Invideo as controller to operate, secure and improve the Services.
iv. Joint controllership. Invideo Innovation Pte. Ltd., Invideo Inc. and Whitesheep Technology Private Limited share common platform infrastructure and together determine the purposes and means of processing certain personal data. To that extent they act as joint controllers within the meaning of Article 26 GDPR. The essence of the arrangement between them, and the contact point for exercising your rights against any of them, is available on request at support@invideo.io. You may exercise your rights against, and in relation to, each joint controller.
v. Workspace members. Where a workspace owner invites you to collaborate in a workspace under Section 2(c) of the Terms of Service, you remain an individual data subject in your own right. Invideo is the controller of the account, profile and usage data it collects about you directly. The workspace owner cannot access your files other than those you share into the workspace, export your personal data, or suspend your account, and you keep the rights set out in Section 9. Any personal data that another user chooses to upload about you remains that user’s responsibility.
2. Personal Data We Collect
a. Information you provide to us.
i. Identifiers and contact details, such as your name, email address, billing and mailing address, company name, job title and phone number, when you create an account, subscribe to communications, complete web forms or contact us.
ii. Account and profile data, such as your username, password or other authentication credentials, profile photo, preferences and account settings.
iii. Payment and transaction data, such as subscription tier, billing country, amounts paid or refunded, and payment method token information. Payment card data is processed by our payment processors under their own terms and is not stored by Invideo.
iv. User Content, text, scripts, images, audio, video, prompts, Avatars and other materials you upload or create through the Services, together with associated metadata such as time of creation, file format and device information.
v. Communications and support data, information in emails, chat messages, support tickets and other communications with us, including any attachments or logs you provide.
vi. Feedback and survey responses, information you submit when you participate in surveys, beta programmes or other feedback activities.
b. Information collected automatically.
i. Technical and device data, IP address, device identifiers, operating system, browser type and version, language settings, mobile network, approximate location (city or region) inferred from IP or other signals, and device capability data such as graphics processing capabilities, available memory and processor information, which we use to optimise rendering and performance and to diagnose technical issues.
ii. Usage and analytics data, pages visited, features used, clicks, session duration, navigation paths, time and date of access, error logs, performance metrics, and email opens and link clicks via pixel tags and web beacons embedded in our marketing emails.
iii. Cookies and similar tracking technologies, we use cookies and SDKs as summarised in Section 6 of this Privacy Policy and described in full in our Cookie Policy
c. Biometric and Avatar-related information. Depending on the features you use, we process biometric and biometric-derived information in the following ways:
i. Avatar and facial data, where you create custom Avatars or submit recordings of your face, we may process facial embeddings or similar facial feature representations to generate and animate your Avatar and to provide lip-sync and similar functionality.
ii. Voice data, where you use voice-cloning features, we process voice characteristics to generate and reproduce a synthetic voice. Where you enable voice cloning, we may run automated liveness or consent-verification checks to confirm that the recording is of a live, consenting person and to deter impersonation.
iii. Incidental biometric information, media you upload may contain the faces or voices of individuals, including yourself, which we do not use to identify any individual.
Where required by applicable law, we treat the information in (i) and (ii) as sensitive personal data or special category data. We process it only with your explicit consent, only to provide the feature you have requested, and for as long as your Avatar or account remains active, unless a longer retention period is required by law. This consent is captured through a dedicated step within the product at the point you first use the Avatar or voice-cloning feature, separate from your acceptance of our Terms of Service, and can be withdrawn at any time through your account settings.
d. Information we receive from others.
i. Business customers, who may identify you as an authorised user and provide your business contact information to us.
ii. Authentication and single sign-on providers, such as Google or Apple, if you choose to log in via those services. We receive limited profile and identifier data as permitted by that provider.
iii. Service providers and partners, such as analytics, security and payment providers, who may share derived or aggregated data about your interactions with our Services or marketing campaigns.
3. Model Training and Content Use
We do not use your User Content, Inputs, Output or Designs to train or fine-tune our proprietary artificial intelligence or machine-learning models.
We do use aggregated, de-identified System Data and Usage Data, such as performance metrics, error logs and general usage patterns, to maintain, secure and improve our models, algorithms and infrastructure. This data does not identify you.
For information on how the third-party AI providers we use handle your content, see the Standard and Experimental Tier framework described in Section 5(a) below.
4. How We Use Personal Data and Legal Bases
The table below sets out our processing purposes, the categories of personal data involved, and the legal basis under the GDPR. Where other laws apply, including the DPDP Act 2023, the CCPA/CPRA or equivalent, the legal basis is the closest equivalent under that law.
Where we rely on legitimate interests, we have carried out a balancing test weighing our interests against your rights; a summary is available on request at https://trust.invideo.io. Where we rely on consent, you may withdraw it at any time, see Section 9 (Your Rights and Choices).
| Purpose | Categories of personal data | Legal Basis (where applicable) |
| Account creation, authentication, and provision of the Services | Identity, account, contact, payment and transaction data; technical and usage data; User Content where needed to deliver a feature | Performance of contract |
| AI generation (video, image, audio, Output) | User Content, Inputs | Performance of contract |
| Avatar creation (facial data) | Photographs, facial embeddings | Explicit consent |
| Voice cloning | Voice recordings | Explicit consent |
| Payment processing | Payment data, billing address | Performance of contract |
| User support | Communications, account data | Performance of contract |
| Fraud prevention, network security, and content moderation | IP, device, behavioural data; uploaded media; detection results | Legitimate interests |
| Server-side operational analytics and AI model quality monitoring | Aggregated usage, server logs, generation metadata (de-identified) | Legitimate interests |
| Client-side product analytics (via cookies and SDKs) | Usage and device data | Consent (via cookie banner) |
| Email marketing, advertising measurement, and retargeting | Contact data; conversion events; cookie identifiers | Consent |
| Legal compliance, tax reporting, regulatory obligations | As relevant to the specific obligation | Legal obligation |
| Defence and pursuit of legal claims | As relevant | Legitimate interests |
5. How We Share Personal Data
We do not sell or rent your personal data to third parties, and we do not sell or share personal data for cross-context behavioural advertising as those terms are defined under applicable US privacy laws. We may share personal data in the following circumstances:
a. Service providers. We share personal data with service providers in the categories described in our sub-processor list at https://trust.invideo.io/subprocessors. We operate a two-tier framework for AI service providers:
i. Standard Tier providers are contractually prohibited from using your content for their own purposes, including model training. These providers comply with all applicable laws associated with data residency and data privacy.
ii. Experimental Tier refers to service providers that have not committed to refraining from training on Customer Personal Data, or do not hold complete independent security certifications. Experimental Tier providers may use content for model improvement in accordance with their own terms and data practices. The service providers under this tier, along with the jurisdictions in which Standard Tier and Experimental Tier providers operate including any providers located outside your region are set out in our sub-processor list.
b. Invideo affiliates. We may share personal data with Invideo group companies involved in operating, supporting or developing the Services, consistent with this Privacy Policy.
c. Business transfers. We may share personal data in connection with, or during negotiations of, any merger, acquisition, sale of assets, financing, reorganisation, insolvency or similar transaction involving all or part of our business.
d. Legal and regulatory disclosure. We may disclose personal data to public authorities or other third parties where we reasonably believe disclosure is required by law, regulation or legal process, or is necessary to protect our rights, our users or the public.
e. Content safety and mandatory reporting. We use automated systems to detect content that breaches our Acceptable Use Policy or applicable law, including sexual content involving minors, graphic violence and other prohibited material. Where the law requires us to do so, we preserve and report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) or the competent authority in your jurisdiction. These checks are automated; you may request human review of a decision that affects you under Section 9.
f. Advertising platforms. Where we run advertising and measurement campaigns through platforms such as Google and Meta, those platforms may act as independent controllers, or in some cases as joint controllers with us, of the personal data collected through their conversion pixels and SDKs for measurement and retargeting. Their own privacy notices govern that independent processing. We deploy advertising and retargeting technologies only with your consent, which you can manage or withdraw through our cookie banner or, where applicable, your device settings.
6. Cookies and Similar Technologies
We use cookies, SDKs and similar tracking technologies on our websites and apps. Full details of the categories we use, the consent framework, regional defaults and how to manage your preferences are set out in our Cookie Policy.
We use strictly necessary cookies to authenticate you and maintain sessions; analytics cookies (with your consent in the EEA, UK and Switzerland) to understand how the Services are used; and marketing cookies (with your consent) to measure advertising effectiveness. You can manage your cookie preferences at any time through the cookie preferences panel in your account settings or the consent banner on our websites.
7. International Data Transfers
We may transfer personal data to countries other than the one in which it was originally collected, including to jurisdictions where our affiliates, service providers or infrastructure are located. Where required by applicable data protection law, we implement appropriate safeguards for international transfers, which may include:
a. the EU-US Data Privacy Framework (DPF) for transfers to DPF-certified providers;
b. Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914;
c. the UK International Data Transfer Addendum (IDTA) for transfers from the UK;
d. the Swiss Federal Act on Data Protection-compliant transfer mechanisms or equivalent under the revised Swiss Federal Act on Data Protection (FADP); and
e. adequacy decisions where the European Commission, UK ICO or other competent regulator has made one.
A copy of the relevant transfer mechanism for a specific data flow is available on request at https://trust.invideo.io.
8. Data Retention
We retain personal data for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, including to provide the Services, meet our legal and regulatory obligations, and address disputes and enforce our agreements.
| Sr. No. | Data category | Retention period |
| 1. | Account data | Duration of account, plus 90 days after deletion request |
| 2. | User-generated content | Duration of account; deleted within 90 days of account deletion or deletion request |
| 3. | Avatar facial data and voice profiles | Until deletion request or account deletion, whichever occurs first |
| 4. | Payment and transaction records | 7 years (legal / tax obligation) |
| 5. | Server logs and security data | 12 months |
| 6. | Aggregated analytics | 24 months from collection |
| 7. | Individual-level analytics | 24 months from collection, then anonymised or deleted |
| 8. | Marketing consent records | Duration of account, plus 3 years |
| 9. | Cookie consent records | 12 months (then re-prompted) |
| 10. | User support conversations | 36 months from last interaction |
| 11. | Email marketing data | Until unsubscribe, plus 30 days |
We may retain aggregated or de-identified data that no longer identifies individuals for analytics and product improvement purposes without fixed time limit.
On receipt of a deletion request: account and content data is removed from active production systems within approximately 90 days, subject to backup and legal retention requirements, email marketing data is anonymised, and data held by service providers is deleted pursuant to our data processing agreements; and backup systems are overwritten through normal rotation cycles.
9. Your Rights and Choices
Depending on where you are located, you have the following rights regarding your personal data. Where applicable law (the CCPA/CPRA, the DPDP Act, and other US state privacy laws including the Virginia VCDPA, Colorado CPA, Connecticut CTDPA and Utah UCPA) provides equivalent rights, those rights apply to you under those laws.
a. Access: request a copy of the personal data we hold about you.
b. Correction: request that inaccurate or incomplete data be corrected.
c. Deletion: request that your personal data be deleted, subject to legal exceptions.
d. Restriction: request that we limit how we use your data in certain circumstances.
e. Portability: receive your data in a structured, machine-readable format.
f. Object: object to processing based on our legitimate interests, including profiling. This applies to our analytics, content moderation, and fraud-prevention processing.
g. Withdraw consent: where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out.
h. Opt out of sale or sharing: for cross-context behavioural advertising (California CCPA/CPRA and equivalent US state laws). Use our cookie banner or contact support@invideo.io.
i. Limit use of biometric data: under California CPRA, you may limit our use of facial geometry and voiceprints. Contact support@invideo.io.
j. Object to automated decisions: where we use automated systems that significantly affect you (content moderation, fraud scoring), you may request human review. Contact support@invideo.io.
k. Grievance redressal: Indian users may contact our Grievance Officer at ethics@invideo.io under the DPDP Act.
l. Nominate another individual: nominate another individual to exercise your rights on your behalf in the event of death or incapacity.
Automated decision-making. We use automated decision-making in the contexts below. In each case you may request human review by contacting support@invideo.io, or, where indicated, through a feature-specific channel.
| Sr. No. | Automated Decision | Impact | Legal Basis | Human Review |
| 1. | Content moderation blocking | May prevent content from being saved or published | Art. 6(1)(f) Legitimate interests | On request via support@invideo.io |
| 2. | Celebrity / public-figure detection | May limit features or block generation | Art. 6(1)(f); Art. 9(2)(g) substantial public interest | On request |
| 3. | Fraud scoring | May result in transaction rejection or account suspension | Art. 6(1)(f) Legitimate interests | On request |
| 4. | Web Application Firewall | May prevent access to the Services | Art. 6(1)(f) Legitimate interests | On request |
| 5. | Feature recommendations and personalisation | Affects recommended features, templates, content | Art. 6(1)(f) Legitimate interests | Opt out via privacy@invideo.io |
You can exercise some rights directly through your account settings (for example, updating profile information or deleting your account). You may also contact us using the details in Section 14 to exercise your rights. We may need to verify your identity before fulfilling your request and will respond in accordance with applicable law.
Where we process Customer Personal Data as a processor on behalf of a business customer, we may direct your request to that customer where appropriate, as they control the relevant data and are responsible for handling such requests under their own policies.
10. Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our measures include encrypted data transmission in transit, access controls, logging, and internal policies and training on data protection and security.
Further details of our current security practices are available at https://trust.invideo.io.
If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with applicable law.
11. Children’s Data
The Services are not directed at children. The minimum age thresholds set out in our Terms of Service, Section 2(a) apply equally to this Privacy Policy: at least 13 years old generally; at least 16 in the European Economic Area, the United Kingdom or Switzerland; at least 18 in India (or with verifiable parental consent under the DPDP Act 2023).
If we learn that we have collected personal data from a child below the applicable minimum age without the required consent, we will take reasonable steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at safety@invideo.io.
12. Third-Party Websites and Services
The Services may contain links to or integrations with third-party websites, applications or services. This Privacy Policy does not apply to those third parties’ processing activities and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party before providing them with your personal data.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements or industry practices. We will revise the “Last updated” date at the top of this page when we do so.
Non-material changes, such as formatting corrections, clarifications or legally required updates, take effect on publication.
For material changes, including changes that reduce your rights or materially expand our processing, we will provide at least 30 days advance notice via email and in-product notification.
For users in the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction whose consumer protection law requires affirmative consent to material changes, and for all users on a Paid Plan: material changes take effect only when you affirmatively accept them. If you do not accept a material change, you may cancel your subscription before it takes effect.
For all other users: your continued use of the Services after the effective date of a material change constitutes acceptance of the updated Privacy Policy.
14. Contact Information
For questions, concerns or requests regarding this Privacy Policy or our processing of your personal data, contact us at privacy@invideo.io.
For Indian users wishing to exercise rights under the DPDP Act or to contact our Grievance Officer: ethics@invideo.io.
EU Representative under GDPR Article 27: contact@gdprlocal.com.
15. Regional Information
These regional supplements add to the rest of this Privacy Policy. Where a regional supplement addresses the same topic as the main body and a conflict appears, the regional supplement controls for residents of that region.
a. EEA, United Kingdom and Switzerland. The controller of your personal data is the relevant Invideo entity identified in our Terms of Service, Section 1. You have the rights set out in Section 9 and may lodge a complaint with your local supervisory authority: EU authorities at edpb.europa.eu, the UK ICO at ico.org.uk, and the Swiss FDPIC at edoeb.admin.ch. International transfers outside your region use the safeguards described in Section 7.
b. California: CCPA / CPRA. If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA, effective January 2023) gives you specific rights regarding your personal information. The categories of personal information we collect, our sources, business purposes and the categories of third parties to whom we disclose are set out below.
| Category of Personal Information | Examples | Sources |
| Identifiers | Name, email, phone, IP address, device IDs | You; automatically; SSO providers (Google, Apple) |
| Customer records | Account name, billing address, tokenised payment information | You; payment processors |
| Commercial information | Subscription plan, transaction history | You; transactions |
| Internet or other electronic network activity | Usage data, page views, click events, cookie identifiers | Automatically via the Services and advertising partners |
| Geolocation data | City or region inferred from IP address | Automatically |
| Audio, visual or electronic information | User Content, including biometric data where you use avatar or voice-cloning features | You |
| Inferences | Preferences and characteristics derived from usage data | Generated from other categories above |
Business or commercial purposes: performance of contract (providing the Services, processing payments, providing support); security and fraud prevention; service improvement; email marketing with consent; and legal and compliance obligations. See Section 4 for the full legal bases table.
Categories of third parties: sub-processors (Section 5(a)); affiliates (Section 5(b)); business transferees (Section 5(c)); public authorities (Section 5(d)).
No sale of personal information. We do not sell your personal information for monetary consideration. You can opt out of cross-context behavioural advertising via our cookie banner, your account settings, or by contacting us at privacy@invideo.io.
Sensitive Personal Information. We process biometric data (facial geometry from Avatar features and voiceprints from voice-cloning features) only for the product features you have requested, with your explicit consent at the point of collection, and only as permitted under CCPA §1798.121. We do not use Sensitive Personal Information for cross-context behavioural advertising or to infer characteristics about you. To limit our use, contact us at privacy@invideo.io.
Other US states. If you are a resident of Virginia, Colorado, Connecticut, Utah or another US state with a comprehensive privacy law, you have rights similar to those in Section 9. To exercise these rights, contact us at privacy@invideo.io.
c. India: Digital Personal Data Protection Act 2023. The Invideo entity that processes your personal data as a data fiduciary for Indian users is Whitesheep Technology Private Limited (CIN: U72900MH2019PTC332207), with its registered office at 08A101, WeWork, Raheja Platinum, Off Andheri Kurla Road, Marol CHS Road, Sag Baug, Marol Naka, Andheri East, Mumbai 400059.