Privacy Policy
Last updated: September 19, 2026 · Operator: [[FILL: registered legal entity name]]
This Privacy Policy explains how Whiteboard Factory (“we”, “us”) collects, uses, stores, and shares personal data when you use our browser-based whiteboard animation service at whiteboardfactory.app and related subdomains.
1. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account | Email, name, password hash | Authentication, support |
| Project content | Slides, text, layout JSON, timeline | Provide the editor & cloud sync |
| Uploaded media | Photos, audio, video you upload | Render previews & project storage |
| Payment metadata | Plan, invoices, last 4 digits (via gateways) | Billing — we never store full card numbers |
| Usage | Exports count, AI credit usage, IP, user-agent | Quota enforcement, fraud prevention |
| Cookies | Session, CSRF, billing region, consent choices | Security & preferences |
2. Where data is stored
- Server: Account and project JSON in SQLite on our infrastructure ([[FILL: primary data hosting region, e.g. India / AWS ap-south-1]]).
- Browser: Large media may stay in OPFS/IndexedDB on your device (local-first). Optional background sync uploads to server.
- Video export: Rendered MP4 is created in your browser — we do not receive video frames unless you explicitly upload media.
3. Retention
- Active account data: retained while your account is active.
- Deleted account: projects and media hard-deleted after 7-day grace; anonymized audit record retained up to 7 years for legal compliance.
- Invoices & tax records: 7 years (India GST / company law).
- Server logs: up to 90 days.
- Waitlist emails: until launch or until you unsubscribe.
4. Third parties
- Stripe (international payments) — payment processing.
- Razorpay (India payments) — UPI, cards, netbanking.
- AI providers (when you use AI features) — text/image/voice sent only when you trigger AI; governed by your plan credits.
- Email provider [[FILL: transactional email provider, e.g. Resend / AWS SES]] — verification & billing emails.
- Analytics (only if you consent) — [[FILL: analytics provider, e.g. Google Analytics 4]].
5. Your rights (GDPR & India DPDP Act)
Depending on your location, you may have the right to:
- Access — view account data in Settings.
- Export — download all projects JSON + media as ZIP (Settings → Download my data).
- Delete — request account deletion with 7-day grace (Settings).
- Correct — update name or GSTIN in Settings / Billing.
- Withdraw consent — change cookie preferences anytime (banner re-shown if you clear local storage).
- Complaint — contact us or your local supervisory authority / India Data Protection Board when operational.
Data Protection contact: [[FILL: Data Protection Officer name & email]]
6. Cookies
Essential cookies (session, CSRF, security) are required. Analytics and marketing cookies load only after consent. See cookie banner on first visit.
7. Children
Service is not directed at children under 16. We do not knowingly collect data from children.
8. Contact
Privacy questions: [email protected] · Contact page