This policy explains what personal data VideoUpload collects, why, and what you can do about it. The data controller is Ron Shilimov, operating as VideoUpload, based in Israel. Questions or requests: support@videoupload.team.
1. What we collect
- Account details: your name, email, profile picture (if you add one) and password — stored only as a secure hash, never in plain text.
- Workspace content: what you and your team put in: videos, thumbnails, titles, notes, comments, statuses, due dates, and — if you use them — payment-tracking amounts and team members' phone numbers.
- Billing details: your plan, billing period and subscription status. Card details go straight to Lemon Squeezy; we never see or store them.
- Security and usage data: IP address, browser type, login times and attempts, and active sessions — used to keep accounts safe and stop abuse.
- Waitlist and referrals: if you join the waitlist, your email, name and who referred you.
- Messages: what you send us by email or through the feedback form.
2. Why we use it
- To provide the Service you signed up for — this is necessary to perform our contract with you.
- To keep it secure, prevent fraud and enforce our terms — our legitimate interest.
- To send service emails (invites, resets, trial and billing reminders) — necessary for the Service.
- To meet legal duties, such as tax and accounting records.
We don't sell your data, don't show ads, and don't use your videos or content to train AI models.
3. Who we share it with
Only with the service providers that run VideoUpload for us, under contracts that protect your data:
- Vercel Inc. (USA) — Hosting and running the website and app
- Neon (Databricks, USA) — Database — accounts, workspaces, boards, comments
- Bunny.net (BunnyWay d.o.o., EU) — Storing, encoding and streaming uploaded videos and images
- Resend (USA) — Sending emails such as invites, password resets and plan reminders
- Lemon Squeezy (Stripe, USA) — Payments, invoices and sales tax, as merchant of record
- Google / YouTube (USA) — Only if you connect a YouTube channel — publishing and channel statistics (see section 4)
Inside a workspace, the people you work with see what's shared there (your name, comments, assignments). We may disclose data if the law requires it. Some of these providers are outside Israel and the EU; where that applies, transfers are covered by safeguards such as the EU Standard Contractual Clauses.
4. YouTube connection
If a workspace owner or admin connects a YouTube channel, VideoUpload uses YouTube API Services. By connecting, you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
- What we access: permission to upload videos (and set their thumbnails) to that channel, and read-only access to the channel's public details and statistics — name, picture, subscriber, view and video counts, and its recent videos with their views, likes and comments.
- How we use it: only to publish the videos you choose, and to show these numbers inside your workspace. We never delete or edit existing videos, never post anything you didn't ask us to, and never sell or share this data.
- What we store: Google's access tokens (encrypted), the channel's basic details and statistics, and the IDs and statistics of videos linked to your board. Statistics are refreshed at most hourly.
- Removing access: disconnect anytime from the channel's YouTube tab — we delete the stored tokens immediately and stop accessing the channel. You can also revoke access in your Google Account security settings. Stored YouTube data is deleted with the channel or account, or within 30 days of a request to support@videoupload.team.
5. Cookies
We only use cookies we need — no advertising or tracking cookies:
- session — keeps you logged in (7 days).
- pending_2fa — remembers the first login step while you enter your two-step code (10 minutes).
- yt_oauth_nonce — protects the YouTube connection step from forgery (15 minutes).
- vu_aff — if you arrive through a partner's referral link, remembers who referred you so they get credit (90 days).
6. How long we keep it
- Account and workspace data: while your account exists. Delete it anytime by writing to us.
- Uploaded video files: deleted 30 days after your trial or plan ends without a new plan (we email you first).
- Security logs: kept for a limited time, then deleted automatically.
- Billing records: as long as tax law requires (usually 7 years).
7. Security
Traffic is encrypted (HTTPS), passwords are hashed with Argon2, two-step login is available for every account, login and signup attempts are rate-limited, and access inside the app is checked on every request. No system is perfectly secure, but we take it seriously and will tell affected users promptly if a breach happens.
8. Your rights
Depending on where you live (including under the EU/UK GDPR and the Israeli Privacy Protection Law), you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Email support@videoupload.team — we answer within 30 days. You can also complain to your local data protection authority.
If you're a member of someone else's workspace, that workspace's owner controls the shared content there; we'll help you, and may involve them, for requests about it.
9. Children
The Service isn't meant for anyone under 16, and we don't knowingly collect their data.
10. Changes
If we change this policy in a meaningful way we'll let you know by email or in the app. The date at the top shows the latest version.
11. Contact
Ron Shilimov, operating as VideoUpload, Israel · support@videoupload.team