Privacy Policy

Effective date: [[EFFECTIVE DATE]] · Content Factory

This Privacy Policy explains how [[COMPANY LEGAL NAME / SRL]] ("we"), the data controller, collects and processes personal data when you use Content Factory (https://factory.nocmd.ro). We comply with the EU General Data Protection Regulation (GDPR) and applicable Romania law.

1. Data we collect

• Account data — your name, email address and a securely hashed password.
• Billing data — handled by our payment processor, Stripe. We do not store your full card details; we store your subscription status, plan and a Stripe customer/subscription identifier.
• Usage data — jobs you create (type, status, timestamps), monthly usage counts, and the source URLs and options you submit.
• Content — the videos/audio referenced by the URLs you submit and the outputs generated for you, stored temporarily to deliver the Service (see retention below).
• Technical data — IP address, browser/device information, and security/audit logs.

2. How we use your data & legal bases

• To provide the Service and process your jobs — performance of a contract.
• To bill you and manage subscriptions — performance of a contract.
• To secure the Service, prevent abuse and enforce our Terms — legitimate interests.
• To communicate service and account emails (e.g. verification, password reset) — contract / legitimate interests.
• To comply with legal obligations (e.g. accounting, tax) — legal obligation.
• Any optional marketing would be based on your consent, which you may withdraw at any time.

3. Sharing & sub-processors

We share data only with providers that help us run the Service, under appropriate agreements:

• Stripe — payments and subscription management.
• ElevenLabs — text-to-speech / voice generation.
• Anthropic (Claude) — translation and text processing.
• Groq — speech-to-text transcription.
• Deepgram — speech-to-text transcription.
• Email provider — transactional emails ([[e.g. Resend / your SMTP]]).
• Hosting / infrastructure — [[your hosting provider]], where the Service and data are hosted.

We do not sell your personal data.

4. Data retention

• Account data — kept while your account is active and deleted (or anonymized) on account closure, subject to legal retention periods.
• Generated result files — automatically deleted after 7 days.
• Logs — kept for a limited period for security and troubleshooting.
• Billing records — retained as required by tax/accounting law.

5. International transfers

Some of our sub-processors are located outside the European Economic Area (e.g. in the United States). Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent where processing is based on consent. To exercise these rights, contact us at [[contact@yourdomain.com]]. You also have the right to lodge a complaint with your supervisory authority — in Romania, the ANSPDCP (Romanian Data Protection Authority).

7. Rights for residents of California and other US states

If you live in California, the CCPA/CPRA gives you the right to know what personal information we collect and why, to request a copy of it, to request deletion, to correct inaccuracies, and to opt out of any "sale" or "sharing" of personal information. Residents of other US states with comparable privacy laws have similar rights.

We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We will never discriminate against you for exercising a privacy right. To make a request, email [[contact@yourdomain.com]] — we verify requests by asking you to confirm from the email address on the account, and you may use an authorised agent.

8. Cookies

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use third-party advertising or tracking cookies unless separately disclosed and consented to.

9. Security

We use reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, access controls and network isolation of internal services. No method of transmission or storage is completely secure.

10. Children

The Service is not directed to children and may not be used by anyone under 18 (or the applicable age of majority).

11. Changes

We may update this Policy. Material changes will be notified by email or in-app. The "Effective date" above indicates the latest version.

12. Contact

Data controller: [[COMPANY LEGAL NAME / SRL]], [[REGISTERED ADDRESS]], Romania. Privacy contact: [[contact@yourdomain.com]].

---

Questions about this document? Contact us at [[contact@yourdomain.com]].

Terms · Privacy · Refund