Privacy Policy

Effective: April 1, 2026  |  Last updated: March 30, 2026

1. Introduction

This Privacy Policy describes how EzraVideo ("we", "us", "our") collects, uses, and protects your personal information when you use our service. We are committed to protecting your privacy in compliance with the Act on the Protection of Personal Information (Japan), the General Data Protection Regulation (GDPR), and other applicable data protection laws.

2. Data Controller

3. Information We Collect

4. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract performance — to provide the Service you requested (Art. 6(1)(b) GDPR)
• Legitimate interests — for security, fraud prevention, and service improvement (Art. 6(1)(f) GDPR)
• Consent — for optional communications such as marketing emails, which you may withdraw at any time (Art. 6(1)(a) GDPR)

5. Third-Party Services

We use the following third-party services to operate EzraVideo:

• Google Cloud (Text-to-Speech API) — processes narration text to generate audio. Google's privacy policy applies.
• OpenAI (GPT-4o) — processes slide content to generate narration scripts. OpenAI's API data usage policy applies; API inputs are not used for model training.
• Microsoft Graph API — converts PowerPoint slides to images. Microsoft's privacy policy applies.
• Google OAuth 2.0 — handles user authentication. Only profile information (name, email) is accessed.
• Cloudflare — CDN and security. Cloudflare's privacy policy applies.
• Amazon Web Services — infrastructure hosting. Data is processed in the Tokyo (ap-northeast-1) region.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including Japan and the United States (via cloud service providers). We ensure appropriate safeguards are in place, including standard contractual clauses where required.

7. Data Security

We implement reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), secure authentication (OAuth 2.0 + JWT), and prompt deletion of uploaded files after processing.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a portable format
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — where processing is based on consent

To exercise these rights, contact us at [Your Contact Email]. We will respond within 30 days.

9. Cookies

We use essential cookies only (authentication session tokens). We do not use tracking cookies, advertising cookies, or analytics cookies. No cookie consent banner is required for essential-only cookies.

10. Children's Privacy

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service. The "Last updated" date at the top reflects the most recent revision.

12. Contact & Complaints

For privacy-related inquiries or complaints, contact us at [Your Contact Email].

If you are in the EU/EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.

If you are in Japan, you may contact the Personal Information Protection Commission (個人情報保護委員会) at www.ppc.go.jp.