Vidori · A Cassette Group product
Privacy Policy
What we collect when you use Vidori, why we collect it, who else sees it, and what you can do about it.
01Who is responsible for your data
Cassette Group Ltd is the data controller for personal data processed through Vidori. We are registered in England and Wales under company number 14147271, with our registered office at 9 Bank Road, Kingswood, Bristol, United Kingdom, BS15 8LS. We are registered with the Information Commissioner's Office under registration number ZB524631. You can reach our Privacy Officer at letschat@cassettegroup.com.
This policy covers the Vidori application at vidori.eazly.io, the Vidori website, and guides hosted on Vidori subdomains. It sits alongside the Terms of Service and the Cookie Policy. It does not cover other Cassette Group services or the wider cassettegroup.com website, which have their own policies.
One important distinction. Where you use Vidori to build content for your own organisation and that content collects data about your viewers, you are the controller of that data and we are your processor. Where the data is about your relationship with us as a customer, we are the controller. Section 9 sets out what that means in practice. Note that this only arises for content you host with us. Video you download and distribute yourself sits entirely outside our systems.
02What we collect
Information you give us
| Category | What it includes |
|---|---|
| Account data | Name, email address, password (hashed, never stored in plain text), account preferences, marketing choices. |
| Billing data | Plan, billing address and country, VAT status, transaction history, invoices. Card details go directly to Stripe and never touch our servers. |
| Your Content | Scripts, prompts, uploaded images, brand assets, logos, fonts, source documents, audio, and any personal data you choose to include in them. |
| Support data | Emails, messages and anything you send us when you ask for help. |
Information we collect automatically
| Category | What it includes |
|---|---|
| Usage data | Which features you use, which output formats you generate, render volumes, credits spent, session times, error reports. |
| Device and connection data | IP address, browser type and version, operating system, device type, approximate location derived from IP. |
| Cookies and similar | As set out in the Cookie Policy. |
| Viewer data on hosted guides | Where you publish an HTML guide to a Vidori URL, we record page views, approximate location, referrer and device type. This is about your viewers, and section 9 applies. |
Information we get from others
Stripe tells us whether a payment succeeded, the last four digits of the card, the billing country and the tax applied. We never receive full card numbers. If you arrive from an advertising campaign and have accepted marketing cookies, our advertising providers may tell us which campaign brought you.
03Why we process it, and on what lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, providing the service, generating and rendering your output, hosting guides you publish | Performance of a contract |
| Taking payment, invoicing, calculating and accounting for tax | Performance of a contract, and legal obligation for tax records |
| Support and service communications | Performance of a contract |
| Security, abuse prevention, enforcing usage limits and credit metering | Legitimate interests: protecting the service and other users |
| Product improvement, diagnosing faults, understanding which features are used | Legitimate interests, and consent where cookies are involved |
| Marketing email and advertising | Consent, or legitimate interests for existing customers where the law allows |
| Analytics and advertising cookies | Consent |
| Complying with law, responding to legal requests, establishing or defending claims | Legal obligation, and legitimate interests |
Where we rely on legitimate interests we have considered the impact on you and concluded that our interest does not override your rights. You can object at any time, and we will stop unless we have compelling grounds to continue.
04AI generation and what we send to providers
When you generate something in Vidori, we send the necessary input to a third-party AI provider. That input is your prompt or script, plus any image, audio or asset the generation depends on. The provider processes it, returns the output, and we store the output in your project.
| Provider | What we send them | What it is used for |
|---|---|---|
| Google (Gemini models, Veo video models) | Text prompts, scripts, reference images | Generating video clips, still imagery, and written guide copy |
| ElevenLabs | Script text, sound design prompts, and your choice of preset voice | Generating narration and ambient audio |
| HeyGen | Script text, your choice of stock presenter, generated audio | Generating lip-synced presenter video |
Three commitments.
- We do not use your prompts, uploads or outputs to train our own models.
- We contract with our AI providers on terms that exclude your inputs and outputs from being used to train theirs, and we use their enterprise or API tiers where those terms apply. If a provider cannot offer that, we do not route your content to it.
- We do not sell your data, and we do not share it for anyone else's advertising.
Providers may retain input briefly for abuse monitoring, typically up to 30 days, as their own terms describe. Some processing takes place outside the UK, including in the United States. See section 6.
Be careful what goes into a script. Anything you type or upload is sent to a third-party model. Do not include confidential information, personal data about others, or anything you would not want processed outside your organisation, unless you have the right to do so. This applies as much to a product script or an internal training narration as it does to a prompt.
Likeness and voice
Vidori does not offer voice cloning or the generation of avatars from photographs of real people. Narration uses preset synthetic voices and presenters come from a stock library. We do not process biometric data, and you should not upload voice samples or photographs of individuals for the purpose of recreating them.
If a photograph you upload as source material happens to feature an identifiable person, that is personal data and you need a lawful basis for using it. It is not processed to identify or recreate anyone.
05Who else we share data with
We share personal data with the following categories of recipient, each under a written contract that limits them to acting on our instructions:
- AI model providers, as set out in section 4.
- Cloud hosting, rendering and storage providers, who host the application, run the video rendering pipeline, and store your projects and published guides.
- Content delivery providers, who serve video and hosted guides to your viewers.
- Stripe Payments UK Ltd, our payment processor. Stripe receives your card details, billing address and country, and transaction data, and processes them to take payment, calculate the tax due and prevent fraud. Stripe acts as our processor for the payment itself and as an independent controller for its own fraud prevention and regulatory obligations, so its privacy policy also applies. Cassette Group Ltd remains the seller of record and issues your invoice.
- Email and communications providers, for transactional and support email.
- Google Ireland Limited, for website analytics through Google Analytics 4 and for advertising through Google Ads. Both are set only if you accept the relevant cookies.
- Error-monitoring providers, to diagnose faults and crashes.
- Professional advisers, including accountants and lawyers, where necessary.
Analytics and advertising
If you accept analytics cookies, we use Google Analytics 4 to understand how the site and application are used. Google processes that data as our processor under its data processing terms. We have IP anonymisation enabled, so your full IP address is not stored, and we do not link analytics data to your account. Analytics data is retained for 14 months.
If you accept marketing cookies, we use Google Ads to measure which campaigns lead to sign-ups and to show Vidori advertising to you on other sites. In that context Google acts as an independent controller as well as our processor, and its own privacy policy applies. You can control ad personalisation at adssettings.google.com.
Neither is used inside the signed-in application for advertising purposes, and neither ever receives Your Content, your scripts or your prompts. Which cookies do what, and how to refuse them, is set out in the Cookie Policy.
We may also disclose data where the law requires it, in response to a valid legal request, to establish or defend legal claims, or to protect the safety of our users. If Cassette Group is involved in a merger, acquisition or sale of assets, data may transfer as part of that. We will tell you by email or prominent notice if that happens and if it changes how your data is used.
An up-to-date list of our sub-processors is available on request from letschat@cassettegroup.com.
06International transfers
Vidori is operated from the United Kingdom. Some of our providers process data in the United States and other countries outside the UK and EEA. This includes our AI model providers, our rendering and delivery infrastructure, and Google, which may transfer analytics and advertising data to the United States.
Where we transfer personal data out of the UK or EEA, we rely on one of the following safeguards:
- an adequacy decision by the UK government or the European Commission covering the destination country, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
- EU Standard Contractual Clauses, supported by a transfer risk assessment
You can ask us for a copy of the safeguards that apply to a particular transfer.
07How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as your account is open, then 30 days after closure |
| Your Content and generated output | Until you delete it, or 30 days after your account closes, whichever is sooner |
| Render queue and job logs | 90 days |
| Backups | Up to 90 days after deletion, after which backups are overwritten |
| Billing and tax records | 7 years, as UK tax law requires |
| Google Analytics data | 14 months from your last activity |
| Advertising and conversion data | Up to 13 months |
| Security and abuse logs | 12 months |
| Support correspondence | 3 years from the last contact |
| Aggregated, anonymised usage statistics | Indefinitely. This data can no longer identify anyone |
Content you have downloaded, exported or self-hosted is outside our systems and outside our control. Deleting your Vidori account does not remove a video from wherever you published it, nor a guide from a server you host yourself.
08Your rights
Under UK and EU data protection law you have the right to:
- Access the personal data we hold about you, and receive a copy
- Rectify data that is inaccurate or incomplete
- Erase your data, where we no longer have a reason to keep it
- Restrict processing while a dispute about accuracy or legitimate interests is resolved
- Port your data to another provider in a structured, machine-readable format
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent where we rely on it, without affecting processing that already happened
To exercise any of these, email letschat@cassettegroup.com with the request in the subject line. We will respond within one month. Complex requests may take up to a further two months, and we will tell you if that applies. We do not charge for this unless a request is manifestly unfounded or excessive.
We may ask you to verify your identity before we act, to make sure we do not disclose your data to someone else.
You can download your videos, guides and projects directly from the application at any time while your subscription is active. Your right to a copy of your personal data does not depend on an active subscription. If your subscription has ended, ask us and we will provide a copy in a portable format for as long as we still hold the data.
Complaints
Please raise concerns with us first. If you are not satisfied you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. If you are in the EEA you may complain to your local supervisory authority instead.
09When you are the controller
If you use Vidori to build content for an organisation, and you host that content with us so that it collects personal data about your viewers, you decide why and how that data is processed. You are the controller. We process it on your behalf.
In that arrangement we will:
- process viewer data only on your documented instructions
- keep it confidential and apply appropriate technical and organisational security measures
- use only the sub-processors we have published or notified to you, and tell you before we add one
- help you respond to data subject requests and to security incidents
- delete or return the data when your account closes
You are responsible for having a lawful basis for the data your published content collects, for giving your viewers their own privacy notice, and for handling their requests. If you need a signed data processing agreement, ask us at letschat@cassettegroup.com.
This arrangement applies only to content hosted on our infrastructure. Where you download output and distribute it through your own channels, we have no involvement in the resulting processing and are not your processor for it.
10Security
We take security seriously and apply measures proportionate to the risk. These include encryption of data in transit and at rest, hashed password storage, access controls on a need-to-know basis within Cassette, logging and monitoring, and regular review of our providers.
No system is completely secure. We cannot guarantee absolute security, and you are responsible for keeping your own credentials safe. If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell you without undue delay where the risk is high.
11Children
Vidori is not intended for children. You must be at least 18 to hold a paid account and at least 16 to hold a Free account with the consent of a parent or guardian. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.
12Cookies
Vidori uses cookies and similar technologies. What they are, which ones we use, and how you control them is set out in the Cookie Policy.
13Changes to this policy
We may update this policy as the product develops or the law changes. Where a change is material, for example a new AI provider or a new purpose for processing, we will tell you by email or by prominent notice in the application before it takes effect. Every version carries an effective date.
14Contact
Privacy Officer
Cassette Group Ltd, company number 14147271
9 Bank Road, Kingswood, Bristol, United Kingdom, BS15 8LS
ICO registration ZB524631
letschat@cassettegroup.com