Privacy Policy
Last updated 30 September 2026
1. Who we are
KeyMo is a small, independently run software product. In this policy “we”, “us” and “our” mean the people who run KeyMo, and “you” means the person using it.
We decide what personal data KeyMo collects and why, so under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for it, and under the UK and EU GDPR we are the data controller. Privacy questions and complaints go to [hello@yourdomain.com], which a person reads.
2. What we collect
Information you give us
- Account: your email address, and your name and profile picture if you sign in with Google.
- Videos you upload or link: the video file, or the YouTube URL you paste and the video fetched from it, plus the file name, length, resolution and size.
- Your edits: caption corrections, style choices and the messages you send to the editing agent.
- Billing: your plan, billing country and invoice history. We never see or store your card details— those go straight to our payment providers.
- Support: anything you send us by email.
Information created by the service
- Transcripts of your video's speech, with word timings and who spoke.
- Clips and edit plans: the moments chosen, their scores and reasons, captions, zooms, effects and the finished video files.
- Usage: minutes used, jobs run, and when a job failed and why.
Information collected automatically
- Technical data: IP address, browser and device type, and pages visited. We use this to keep the service running and secure.
- Analytics: only if you accept analytics cookies. See our Cookie Policy.
3. Why we use it, and our legal grounds
| What we do | Why | Legal ground (UK/EU) |
|---|---|---|
| Transcribe your video, find moments, render clips | It is the service you asked for | Performance of a contract |
| Create and run your account, send job and account emails | To give you access and tell you when work is done | Performance of a contract |
| Take payment, issue invoices, keep tax records | To charge for the plan and meet tax law | Contract and legal obligation |
| Prevent abuse, fraud and copyright infringement | To keep the service safe and lawful | Legitimate interests |
| Fix errors and improve the product | To find bugs and make the service better | Legitimate interests |
| Product analytics | To understand which features are used | Consent (analytics cookies) |
Under the DPDP Act we process your personal data on the basis of the consent you give when you create an account and upload a video, and for the legitimate uses that Act allows. You can withdraw consent at any time by deleting your account, which is as easy as creating one.
4. Your videos, transcripts and clips
- Your files are stored in private storage. They are not public and cannot be browsed. The app reaches them through short-lived signed links that expire.
- Staff do not watch your videos. We only open a specific file if you ask us to, in writing, to fix a problem you have reported, or if we are legally required to.
- We do not sell your content, and we do not use it to train our own AI models. Where our AI vendors offer settings that exclude customer content from their training, we use them.
5. How long we keep things
| Data | Kept for |
|---|---|
| Uploaded source videos | 7 days, then deleted automatically |
| Finished clips and their thumbnails | 30 days, then deleted automatically |
| Transcripts, edit plans, clip titles and scores | Until you delete the project or your account |
| Account details and usage records | While your account is open |
| Invoices and tax records | As long as tax law requires, normally 8 years in India |
| Backups | Deleted data disappears from backups within 30 days |
We warn you by email 2 days before clips expire so you can download them.
6. Who we share it with
We do not sell your personal data and we do not share it for advertising. We use the companies below to run the service. Each one only receives what it needs and may only act on our instructions.
| Company | What it does for us | Where |
|---|---|---|
| Supabase | Account sign-in, database, job queue | EU / US |
| Cloudflare R2 | Storage for your uploads and finished clips | EU / US |
| Deepgram | Speech-to-text (your video's audio) | US |
| Google (Gemini API) | Finding moments, titles, captions, agent edits (your transcript) | US |
| Google Sign-In | Optional sign-in with a Google account | US |
| Dodo Payments | Payments outside India (merchant of record) | US / EU |
| Razorpay | Payments in India | India |
| Resend | Account and job notification emails | EU / US |
| PostHog | Product analytics (only if you accept analytics cookies) | EU / US |
| Sentry | Error reporting | EU / US |
We may also disclose data if the law requires it, to enforce our Terms, to deal with a copyright complaint, or as part of a merger or sale of the business, in which case we will tell you first.
7. Sending data abroad
Some of the companies above are outside India, the UK and the EU. Where personal data leaves those regions we rely on the transfer protections in our contracts with them, such as the European Commission's standard contractual clauses, and we only use providers that offer them.
8. Security
- All traffic runs over HTTPS, and files are encrypted at rest by our storage provider.
- Storage buckets are private; every download uses a link that expires.
- Database access is row-level restricted, so one account cannot read another's rows.
- Access to production systems is limited to people who need it and is protected by two-factor authentication.
No service can promise perfect security. If a breach affects your personal data we will notify you and the Data Protection Board of India, and any other regulator we must tell, without undue delay.
9. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you, and a summary of how it is processed;
- correct anything that is wrong or incomplete;
- delete your account and erase your data;
- restrict or object to certain processing, and withdraw consent for analytics cookies;
- send your data to another provider where that right applies;
- nominate someone to exercise these rights if you die or become incapacitated, as the DPDP Act allows.
Write to [hello@yourdomain.com]. We reply within 30 days. If you are not satisfied you can complain to the Data Protection Board of India, or to your local data protection authority in the UK or EU.
10. Children
KeyMo is not for children. You must be 18 or older to use it. We do not knowingly collect data from children, and we will delete any such account as soon as we learn of it.
11. Changes
If we change this policy we will update the date at the top, and we will email you before any change that materially affects your rights.
12. Contact
Everything — privacy requests, data deletion, complaints and support — goes to [hello@yourdomain.com].