Privacy policy

This policy explains what personal data Bolofy (“we”) collects when you use AdReel Studio, why, who it is shared with, how long it is kept and the rights you have under India’s Digital Personal Data Protection Act, 2023. हिन्दी में सार नीचे है।

1. What we collect

• Account details: your name and email address, and a password (stored only as a secure hash). If you sign in with Google we receive your name, email address, profile picture and Google account ID from Google (never your Google password), and only once Google confirms your email address.
• Mobile number and contact email: we ask for your mobile number when you sign up, or right after you sign in with Google, and we keep it with your account. To check that the number is yours, we send a 6-digit code to it on WhatsApp and record when you confirmed it; we keep only a scrambled form of the code, for up to 10 minutes. If you leave your details to be told when a video is ready, we keep the email address and mobile number you type, with that video; if you have no account, they are also kept as your contact details (your email there is never treated as an account).
• Your choice about offers: a box, off unless you tick it, to get offers on WhatsApp or SMS. If you tick it we record that you agreed and when.
• Your content: the videos, photos, PDFs, audio, logos, brand details and prompts you upload or type, and the videos we make from them. This can include the faces and voices of people in your footage.
• Payments: payments are handled by Razorpay. We receive the order and payment reference, the amount and the status. We never see or store your card, UPI or bank details.
• Network address and device: when you start your free video (with or without an account) or sign up, we keep your IP address only in a scrambled form (we do not store the address itself), and we set a random device cookie (ars_dev) in your browser. We use the scrambled value and the cookie only to give each network and each device one free video, and we keep them for as long as we need them for that. They are not deleted after a few days. Our servers and network provider also process IP addresses and browser type for a short time to deliver the site and block attacks.
• Website statistics (only if you accept): if you choose “Accept analytics” in the cookie notice, Google Analytics records which pages you open, roughly where you are (from your IP address, which Google does not store), your device and browser type, and a random identifier in a cookie. We do not use it for advertising and we switch off Google’s advertising features.
• Anonymous visit counts (no cookies): when you open a page on AdReel Studio we note which page it was, the website that sent you here (and the campaign tag in that link, if it has one), your device type (phone, tablet or computer), your browser and system type, and whether you were signed in (not who you are), together with a scrambled visitor ID that changes every day. We use no cookie for this and we do not store your IP address: the ID is made from your IP address and browser details with a secret key that is different every day, so it cannot be turned back into either, and it cannot follow you from one day to the next. Robots and our own admin pages are not counted.
• Bot check: when you open the home page or the sign-up page without being signed in, Cloudflare Turnstile checks that you are a person and not a program. The check starts as the page opens, before you start a video or press sign up. For this check Cloudflare receives your IP address and signals from your browser, such as its type and settings.

We collect only what the Service needs. We do not buy data about you from anyone.

2. Why we use it

We use your data with your consent, which you give when you upload files or create an account, and only for these purposes:

• To make, store and deliver your videos and to run your account and credits.
• To take payments and keep the records that tax law requires.
• To prevent fraud and abuse of the free videos (one per network and device, and a check that you are a person), and to keep the Service secure.
• To contact you by email, SMS, WhatsApp or phone about your account, a payment, an important change or your video, to send the notification you asked for when your video is ready, and to help you if something goes wrong with it.
• To count visits to our pages anonymously (see section 1), so we know which pages and devices matter and where visitors come from.
• Only if you ticked the box: to send you offers on WhatsApp or SMS. You can withdraw this at any time (section 5). We do not send marketing email.
• Only if you accepted analytics: to see which pages are used and make the site better.

We do not sell your personal data or your content, and we do not use your content to train AI models or to advertise to you.

3. Who processes it for us

• Google (Gemini AI): your footage, pictures, documents and prompt are sent to Google’s AI service, which analyses them to plan the edit and make the voiceover. Under Google’s terms for its paid service they are used only to answer our request and not to train Google’s models.
• Google sign-in: if you choose “Continue with Google”, Google knows that you signed in to AdReel Studio and tells us your name, email address, picture and account ID.
• Google Analytics: only if you accept analytics cookies. Google receives your IP address, device and browser signals and the pages you open, and acts on our behalf to give us statistics.
• WhatsApp (Meta Platforms): the code that confirms your mobile number and the “your video is ready” message are sent through Meta’s official WhatsApp Business Platform. Meta receives your mobile number, the message (the code, or your video’s title and a link to it) and whether it was delivered and read.
• Our email service: if you also give an email address, the provider that sends the “your video is ready” email receives it and the message.
• Razorpay: payments.
• Hostinger: the server where the site, your files and the database are kept.
• Cloudflare: delivers the site, protects it from attacks and stores backup copies of our database.
• Cloudflare Turnstile: the bot check when you open the home page or the sign-up page without being signed in. Cloudflare receives your IP address and browser signals for it.
• Pexels: when free stock clips are added to an ad, only search words are sent to Pexels, never your files or details.

Some of these companies process data on servers outside India. We may also disclose data when the law requires it.

4. How long we keep it

• Files you upload: deleted automatically 7 days after your last change to that video.
• Finished videos: deleted automatically 30 days after your last change to that video. Download the ones you want to keep.
• Videos made without signing in: deleted with all their files after 7 days, unless you sign in to keep them.
• Scrambled network address and device cookie: for as long as we need them to give each network and device one free video. We do not delete them after a fixed number of days. They stay after your account is deleted (otherwise deleting an account would bring back the free video), but they are no longer linked to you.
• Account details, mobile number, credit history and your choice about offers: until you delete your account.
• Mobile number and contact email of a visitor without an account: deleted with the rest of their data after 7 days, unless they sign in to keep their video (the contact email is then dropped, and the account email is used).
• Email and mobile number left to be told when a video is ready: removed from that video 7 days after it is made (or when you delete the video). The one WhatsApp message (and email, if you gave one) is sent once.
• Anonymous visit counts: about 13 months, then deleted automatically. There is nothing in them that could identify you.
• A lasting count of videos made (the date, whether it was a new video, a change or a re-render, its shape and length, whether it worked, the credits used and what it cost us, never the video, files or text): kept as business statistics. It is linked to your account only until you delete your account; after that the counts stay without any link to you.
• Website statistics (Google Analytics): only if you accept. They are kept in our Google Analytics account for 14 months at most; the cookies last up to 6 months.
• Payment records: for as long as tax and accounting law requires, also after your account is deleted.
• Backups: copies of our database (not of your videos or files) are kept for up to 12 months and then overwritten.

5. Your rights

• See your data: download a copy from Account & privacy in your dashboard.
• Correct it: change your mobile number on Account & privacy, or write to us and we will correct or complete your other details.
• Erase it and withdraw consent: delete single videos from your dashboard, or your whole account from Account & privacy. Withdrawing consent is as easy as giving it, and we stop processing your data when you do. It does not affect what was done before.
• Stop offers: switch off “Send me offers on WhatsApp/SMS” on Account & privacy, or write to us. Without an account, use “Remove my data” in the app or write to us.
• Stop analytics: choose “Only necessary” under “Cookie settings” (in the footer and in the app). We then stop measuring and delete the analytics cookies from your browser.
• Nominate someone: you may name a person who can use these rights for you if you die or become unable to. Write to us to do so.
• Complain: see the next section.

If you have no account, or cannot sign in, email sp@bolofy.com from the address you used and we will do it for you.

6. Questions and complaints

For any question or complaint about your personal data, write to sp@bolofy.com. We reply within 7 days and resolve complaints within 30 days.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

7. Children

The Service is for adults running a business. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18; if you believe a child has used the Service, write to us and we will delete their data.

8. People in your videos

If your footage shows other people (customers, staff, family), you are responsible for having their permission to film them and to use them in an ad. If you appear in someone’s video and want it removed, write to sp@bolofy.com.

9. Security

Data travels over encrypted connections, passwords are hashed, API keys are stored encrypted, and your files are visible only to your account. If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay: what happened, what it means for you and what we are doing about it.

10. Cookies

Necessary cookies, always on. One keeps you logged in (for a visitor without an account it also remembers their free video). Another is the random device cookie, ars_dev, which helps us give each device one free video. If you choose “Continue with Google” we also set a short-lived cookie (ars_goauth, kept for 10 minutes at most) that only lets us finish that sign-in safely; it is removed when the sign-in ends. Once you answer the cookie notice we remember your answer in ars_consent for 6 months. Our own anonymous visit counter (section 1) sets and reads no cookie.

Analytics cookies, only if you press “Accept analytics”: Google Analytics sets _ga and _ga_<id> (random visitor identifiers, up to 6 months). Before you accept, nothing is loaded from Google. You can change your mind at any time under “Cookie settings”: choosing “Only necessary” stops the measuring and deletes these cookies. We do not use advertising cookies and we do not share analytics data for ads.

11. Changes to this policy

If we change how we use your data, we will update this page and, for important changes, tell you in the app or by email before they apply.

12. Who we are

Bolofy, Second Floor, No.235, Indiranagar 2nd Stage, 13th Cross Road, Binnamangala, Bengaluru, Karnataka 560038, India. Email: sp@bolofy.com.