Privacy Policy

1. Introduction

BeepBop LLC operates BeepBop Studio ("BeepBop," "we," "us," or "our"), a software platform for creating, editing, organizing, and preparing images and videos for social media. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services at studio.beepbop.me.

By accessing or using BeepBop Studio, you agree to the terms of this Privacy Policy. If you do not agree with the practices described herein, please do not use our services.

2. Information We Collect

We collect several types of information to provide and improve our services:

Account Information

When you create an account, we collect your name, email address, password (stored in hashed form), and optional profile details such as your avatar image and display name.

Video Content

We store the video files you upload for processing and distribution. This includes original source files, processed exports in various aspect ratios, generated thumbnails, and any associated metadata such as titles, descriptions, and tags.

Usage Data

Service and security logs can include upload and export activity, browser and device information, and IP addresses. If you allow optional analytics, our analytics providers can also collect page visits, interactions, session information, and browser identifiers to help us understand and improve the service.

Platform Connections

Depending on the connection method you enable, we may store encrypted API credentials or OAuth access and refresh tokens for the permissions you grant. Browser-assisted workflows use your signed-in browser session, while manual exports let you download content to publish yourself. Available methods and permissions differ by platform and connection status.

AI Quality Records

When you use an AI feature, we record what the AI produced, the information used to produce it (such as video details, your prior posts, or the instruction you gave), and what you did with the result — kept it, edited it, or discarded it. We use these records to measure and improve the quality of our own AI features. They are stored against your account and are not shared with other customers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: Processing and transforming your videos into platform-specific formats, managing your publishing workflow, and maintaining your content in the BeepBop Vault.
• AI processing: Generating captions, hashtags, and transcriptions for your videos using artificial intelligence services. Video content may be temporarily processed by our AI providers to produce these outputs.
• Analytics: Providing unified performance analytics across your connected platforms, including views, likes, comments, shares, and engagement metrics.
• Account management: Managing your subscription, processing payments, and communicating with you about your account or service updates.
• Improvement: Analyzing usage patterns to improve our platform, fix issues, and develop new features.

4. Data Storage & Security

We take the security of your data seriously and employ industry-standard measures to protect it:

• Database: Account data, post metadata, and application state are stored in a PostgreSQL database hosted on Supabase with row-level security (RLS) policies ensuring users can only access their own data.
• File storage: Video files, thumbnails, and media assets are stored on Cloudflare R2, an S3-compatible object storage service with encryption at rest.
• Token encryption: Third-party OAuth tokens are encrypted using AES-256-GCM before being stored in our database.
• Transport security: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Authentication: Passwords are hashed using bcrypt. We support OAuth authentication through trusted providers.

5. Third-Party Services

We use the following third-party services to operate BeepBop Studio. Each service has its own privacy policy governing the data they process:

• Stripe: Payment processing for subscriptions and billing. We do not store your full credit card details; Stripe handles all payment information securely.
• Social media platforms: Content and account activity may be exchanged with platforms through the connections and permissions you enable. Workflows may use your own API credentials, browser-assisted steps, or manual downloads. Connecting a platform does not by itself enable automatic publishing; follow the availability shown in the product for that connection.
• AI services: We use artificial intelligence providers to generate captions, hashtags, transcriptions, and other AI features. Video content and metadata may be sent to these providers for processing. Generated outputs are cached to minimize repeated processing. Where we send a text-generation request through a model router rather than to a provider directly, we require endpoints that do not store or train on the content of that request; requests sent directly to a provider are governed by that provider’s own terms.
• Supabase: Database hosting, authentication, and real-time services.
• Cloudflare: Content delivery, DDoS protection, and R2 object storage for media files.
• Microsoft Clarity and PostHog: Optional usage analytics help us find confusing screens and improve the service. Depending on the provider configuration, these tools can process page visits, clicks, device and session identifiers, heatmaps, and session replays. They load after you allow analytics. These records are not necessarily anonymous. See the Microsoft Privacy Statement and PostHog Privacy Policy for their data practices.
• Resend: Transactional email delivery for account notifications, password resets, and service communications.

6. Cookies & Tracking

We use cookies and similar tracking technologies to operate and improve our services:

• Essential cookies: Required for authentication, session management, and security. These cookies are necessary for the platform to function and cannot be disabled.
• Analytics cookies: With your permission, help us understand page visits and interactions and identify problems through the analytics services described above. Analytics permission does not grant advertising-cookie permission.
• Preference cookies: Store your settings such as theme preference (light/dark mode), language, and layout choices.

You can choose Essential only on the sign-in or sign-up screen, or change analytics consent in Settings → Security. After turning analytics off, reload the page to stop previously loaded analytics tools. You can also manage cookies through your browser settings; disabling essential cookies may prevent some features from working.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct any inaccurate or incomplete personal data.
• Deletion: Request that we delete your personal data, including your account, video content, and all associated metadata.
• Export: Request a portable copy of your data in a standard machine-readable format.
• Account termination: You may delete your account at any time from your account settings. Upon account deletion, we will remove your personal data and video content within 30 days, except where retention is required by law.
• Withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@beepbop.me.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide you with our services:

• Account data: Retained for the duration of your account and deleted within 30 days of account termination.
• Video content: Stored for as long as your account is active. BeepBop Vault content is retained according to your subscription plan.
• Usage logs: Aggregated analytics data is retained for up to 24 months. Individual access logs are deleted after 90 days.
• AI response cache: So that an identical request does not have to be regenerated, AI results are cached. Cached captions expire after seven days; other cached AI responses expire within two hours. Expired entries are no longer served.
• AI quality records: The records described under “AI Quality Records” above are kept for as long as your account is open, so that we can measure whether our AI features are improving over time. They are deleted when you delete your account. We have not set a shorter retention period for them; if we do, we will update this policy first.
• Billing records: Payment and transaction records are retained for 7 years to comply with financial and tax regulations.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, sending you a notification via email or an in-app alert.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

10. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: