Privacy Policy

Version 2026-10-09.

VAMP Privacy Policy

Version: 2026-10-09
Effective date: October 9, 2026

This policy explains what personal information VAMP Technologies Inc. ("we", "us") handles, why, who else touches it, how long we keep it, and the choices and rights you have. It covers the VAMP desktop app, the online service and our website at vamp.media. It is part of the agreement described in the Terms of Service.

1. The short version

Your footage stays on your drives. The desktop app works on your own computer. Your media reaches us only when you use a cloud feature: publishing a catalog, sending a file, uploading from a phone, or running an AI feature on our account.
We don't sell personal information, and we don't share it for advertising. Nothing on our website or in the app tracks you for advertising. Our website counts its visits without cookies.
The app sends us diagnostic logs - what it did, with file names and paths - to fix problems. Log lines are kept for up to 30 days; records of actions, AI requests and errors for up to a year.
Nobody's content trains AI - not ours, and not our AI providers'.

2. Two roles we play

For your account, billing and our own operations (who you are, what you pay, our logs and security records), we decide how the data is used. Under the GDPR we are the controller.

For Your Content - the footage, catalogs, transcripts, comments, and the faces and names of the people in your footage - you decide what goes in and who sees it, and we process it on your behalf to run the service. Under the GDPR we are your processor; under US state privacy laws, your service provider. If you were filmed by a VAMP customer and want something about you changed or removed, contact that customer - and tell us too, at [email protected], and we'll help.

3. What we collect, and why

What	Examples	Why	GDPR legal basis
Account details	name, email, password (stored only as a one-way hash), Google account ID if you sign in with Google	to run your account and sign you in	contract
Billing	plan, billing history, country; card details are held by our payment processor, never by us	to charge for subscriptions	contract; legal obligation (tax records)
Agreement records	which version of the Terms and Acceptable Use Policy you accepted, when, from which IP address and browser	to prove what was agreed	legitimate interests; legal obligation
Your Content on the online service	published catalogs, previews, contact sheets, transcripts, tags, comments, requests, shares, delivered files, phone uploads	to provide the features you use	contract (and your instructions, as processor)
Face data	face signatures, portrait frames, face groupings and the names you give them, talent photos	to show and search the people in your catalogs, as you ask	contract; your responsibility to obtain consent (Section 6)
Diagnostic logs	what the app and server did, errors, file and folder names and paths, computer name, OS and version, a random install ID, each action that changes something and the account email that took it or was involved in it, and for each AI request the service, model, tokens, cost and time (never the prompt, frames or answer)	to find and fix problems, keep VAMP secure, and understand how VAMP is used so we can improve it	legitimate interests
Website analytics	pages viewed (without anything after a "?" or "#"), when, where the visit came from, browser, device type, OS, and errors a page hits in your browser; visitors are counted by an anonymous code that changes daily, derived from the visit including its IP address, which is not stored. No cookies	to understand how our website is used and fix it	legitimate interests
Security audit log	sign-ins, shares, publishes, admin actions, with IP address	to detect and investigate abuse and security incidents	legitimate interests
Messages to us	contact form, waiting list, support email, abuse and DMCA reports	to answer you	legitimate interests; legal obligation
Product news	whether you asked for occasional news email	to send it, only if you opted in	consent - withdraw any time from the link in each email or your account

We don't collect sensitive information beyond the face data above, and we don't knowingly collect information from anyone under 18.

What the desktop app keeps to itself. Your catalogs, previews, transcripts and local face data live in a database on your own computer. We have no access to them unless you publish.

4. Who we share it with

Only the companies that help us run VAMP, each limited to what their job needs and bound by contract to protect it:

Company	Location	What they receive
Render	United States	everything the online service stores (hosting and database)
Cloudflare	United States	network traffic and IP addresses; published catalogs, previews and delivered files (R2 storage); form bot checks (Turnstile); connection setup for live playback
PostHog	United States	diagnostic logs and website analytics
Anthropic	United States	low-resolution frames, for AI keywording on our account
OpenAI	United States	compressed audio, for paid website transcription
Google	United States	sign-in, if you use "Sign in with Google"; connection setup for live playback
Our email provider	named on request	your email address and the email we send you
Our payment processor	named on request	billing details and payment card data

When you share a catalog, the people you share it with see it - that is the point of sharing. If you add VAMP to Slack, what VAMP posts goes to your Slack workspace. If you use your own AI API key, that provider receives frames or audio under your agreement with them.

We also disclose information when the law requires it (a valid subpoena or court order), to report child sexual abuse material to NCMEC as US law requires, to protect someone's safety, or to a buyer of the business, who would be bound by this policy.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as California law defines those terms.

5. How long we keep it

What	How long
Account details	while your account is open, then 30 days after you close it
Published catalogs	until you unpublish them, then 30 days (so they can be restored); a catalog not published or reported by its owner's computer for 3 years is unpublished
Your comments, talent photos, phone uploads and settings	until you delete them, or 30 days after you close your account
Delivered files	7 days after delivery, or 24 hours after the first complete download
Phone uploads	until your computer collects them, or 30 days
Face data on the online service	see Section 6
Diagnostic logs	log lines up to 30 days; records of actions, AI requests and errors up to 1 year
Website analytics	1 year
Security audit log	1 year
Backups of our database	deleted data leaves our backups within 7 days
Agreement records	while your account is open; after it closes, until 6 years after you accepted
Billing records	as long as tax law requires, generally 7 years
Messages to us	up to 2 years after the conversation ends
Anything preserved for an investigation or legal hold	as long as the law or the investigation requires

6. Face data: our retention and destruction schedule

VAMP can compute face signatures - numeric descriptions of a face - to group the same person across clips and match a photo to the clips they appear in. Laws such as the Illinois Biometric Information Privacy Act treat these as biometric identifiers. This section is our public written policy for them.

Purpose. Face data is used only to show, group and search the people in a customer's own catalogs, for that customer and the people they share with. It is never sold, leased, traded, used for advertising, used to train AI, or used to identify anyone for anyone else.
On the customer's computer, face data is created and stored locally, under the customer's control, and is deleted with the catalog.
On the online service, face data in a published catalog (portrait frames, face groupings and names) is permanently destroyed at the earliest of: 30 days after the catalog is unpublished (the window in which it can be restored); the customer's account closure completing; or 3 years after the catalog was last published or reported by the customer's computer, when it is unpublished automatically. A talent photo's image is deleted once it has been matched, or after 14 days; its name and result go at account closure or after 3 years. Backups age out within 7 days after that.
Consent. Our customers decide whom they film and whether to run face recognition. Our Terms require them to give any notice and obtain any written consent the law requires from the people in their footage before doing so.
Requests from people who were filmed. Write to [email protected]. We'll remove your face data from the online service and tell the customer we did.
Security. Face data is protected with the same controls as the rest of the online service (Section 9), at least as well as other confidential information.

7. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you, and get a copy in a portable form;
correct it;
delete it;
object to or restrict how we use it, including use based on legitimate interests;
withdraw consent where we rely on it (product news email);
not be discriminated against for exercising these rights;
complain to your data protection authority (in the EU, UK or elsewhere).

You can change your details and close your account in account settings. For anything else, write to [email protected] from your account's email address. We may need to confirm it's you. We answer within one month (45 days for California requests), and we'll tell you if we need longer.

If you were filmed by a VAMP customer, see Section 2: they control that content, and we'll help them honor your request.

8. Moving data across borders

VAMP Technologies Inc. is in the United States, and so are the companies in Section 4. If you're outside the US, your information is transferred to and processed in the US. For transfers from the EU, UK and Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents), with our providers and in our Data Processing Addendum, which business customers can request at [email protected].

9. Security

Passwords are stored only as one-way hashes. Traffic to the online service is encrypted with HTTPS. Published content is stored privately and served through short-lived signed links. Access to our systems is limited and logged in a tamper-resistant audit log. No system is perfectly secure; if a breach affects your personal information, we'll tell you and the authorities as the law requires. Report a vulnerability to [email protected].

10. Cookies

We use only the cookies VAMP needs to work - no advertising or analytics cookies:

a sign-in cookie that keeps you signed in to the online service;
two short-lived security cookies (10 minutes) used while you sign in with Google or add VAMP to Slack;
Cloudflare Turnstile, which checks our forms are filled in by a person and may set its own strictly necessary cookie.

11. Changes

When we change this policy we update the version and date at the top. For a material change we give at least 30 days' notice by email or in the app.

12. Contact

VAMP Technologies Inc. 502 W 7th St, Ste 100 Erie, PA 16502, USA

Privacy requests: [email protected] Everything else: [email protected]