Privacy Policy

The data controller responsible for your personal data is Slate HQ. You can reach us at hello@slatehq.org. For privacy-specific requests, see Section 9 below.

• Account data. Email address (required) and a display name (optional) that you provide when you sign up.
• User-generated content. Product images you upload, the one-line product descriptions you enter, and the video outputs our AI video engine generates from those inputs.
• Billing data. Payments are handled by Lemon Squeezy as Merchant of Record. We do not see or store your full card number. We receive your billing email, card last four digits, and invoice records via the Lemon Squeezy API.
• Usage data. Aggregated page views and feature interactions collected through Vercel Analytics, which is cookieless and privacy-friendly. IP addresses are truncated before storage.
• Communications data. When we send you transactional or waitlist emails via Resend, we receive delivery metadata such as message IDs, opens, and link clicks.

• Providing the service (creating your account, generating videos, storing your outputs) — performance of a contract.
• Sending confirmation and status emails related to your account, generations, or purchases — performance of a contract.
• Marketing waitlist emails. Signing up to our waitlist constitutes your consent to receive related product updates. You can withdraw consent at any time via the unsubscribe link in any email.
• Analytics. Cookieless, aggregated analytics — legitimate interest in understanding and improving our service.
• Legal and tax compliance (e.g. retaining invoices) — legal obligation.

We share personal data with the following sub-processors strictly to provide the service. Each is bound by a data processing agreement.

Our sub-processors are primarily located in the United States. When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on the EU Standard Contractual Clauses (SCCs) and, where applicable, on the EU-US Data Privacy Framework and its UK and Swiss extensions.

• Account data: retained until you delete your account, plus 30 days for backup expiry.
• Uploaded product images: automatically deleted 90 days after generation, or sooner on your request.
• Generated videos: stored until you delete them or close your account, plus 30 days for backup expiry.
• Billing records: retained for 7 years to comply with tax and accounting obligations.
• Analytics: aggregated metrics retained indefinitely; raw events deleted after 30 days.

If you are located in the EEA, UK, or Switzerland, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion (“right to be forgotten”);
• request restriction of processing;
• data portability in a structured, machine-readable format;
• object to processing based on legitimate interests, including profiling;
• opt out of solely automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, email privacy@slatehq.org. You also have the right to lodge a complaint with your local supervisory authority.

We use first-party session cookies set by Supabase strictly to keep you signed in — these are essential for the service to function. Our analytics provider (Vercel Analytics) is cookieless and does not track you across sites. We do not use third-party advertising cookies and do not engage in cross-site tracking.

Slate HQ is not directed at users under 18, and we do not knowingly collect personal data from children. The service is not intended for children under 13 in the United States; if you believe a child has provided us with personal data, please contact us so we can delete it.

We protect your data with TLS encryption in transit and encryption at rest for storage and databases. Passwords are hashed by Supabase (we never see plaintext passwords). In the event of a personal data breach affecting EEA users, we will notify the relevant supervisory authority within 72 hours of becoming aware, in line with GDPR Art. 33, and notify affected users without undue delay where required.

If you are a California resident, you have the right to know what personal information we collect, to request deletion or correction of your personal information, and to opt out of the “sale” or “sharing” of your personal information. We do not sell or share your personal information for cross-context behavioral advertising. To exercise these rights, email privacy@slatehq.org. We will not discriminate against you for exercising any of these rights.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and notify registered users by email or in-product notice at least 7 days before the changes take effect.

General questions: hello@slatehq.org.

Data Protection Officer / privacy requests: privacy@slatehq.org (placeholder address — to be confirmed).