Privacy Policy
Last Updated: November 5, 2026
Our Commitment to You
Vidimize is a product and service operated by CandyMustache, Inc. ("Vidimize", "we", "our", or "us"). We are committed to transparency, security, and user control over personal data. To provide our digital assets, AI-powered creative tools, software extensions, and related services (collectively, the "Services"), we must collect and process certain personal information.
The Services include our websites and applications at vidimize.com, www.vidimize.com, app.vidimize.com, help.vidimize.com, d1.vidimize.com, our Adobe extensions and desktop tools (including X-Motion, MotionFlow, Movo, and Hub), our integrations with third-party platforms, and any related or successor domains we operate.
By accessing or using our Services, you acknowledge that your Personal Data will be processed as described in this Privacy Policy. If you do not agree with this Policy, please discontinue use of the Services.
1. Who We Are (Data Controller)
The controller responsible for your Personal Data is:
CandyMustache, Inc. (doing business as Vidimize)
651 North Broad Street, Suite 201
Middletown, DE 19709, United States
Email: privacy@candymustache.com
2. Grounds for Data Collection
We process Personal Data where necessary to:
- Perform our contractual obligations under the Terms of Use and License Agreement (the "Agreement")
- Operate, secure, and improve the Services
- Comply with applicable legal and regulatory obligations
- Protect our legitimate business interests
- Act on your consent, where we ask for it
You are not legally required to provide Personal Data; however, without it, we may be unable to provide core functionality such as account access, billing, AI generation, or asset downloads.
3. Types of Data We Collect
Personal Data
We may collect the following categories of Personal Data:
- Registration Information: Name, email address, and, where you provide them, professional details (such as company name or role).
- Payment Information: Payments are processed by third-party providers (Stripe and PayPal). We do not store full payment card details; we receive only tokens, billing country, and limited transaction metadata.
- Order and Project Information: If you order a custom production, the details, contact information, and files you provide for that order (such as property photos, logos, or scripts).
- AI Inputs: Text prompts, images, video, audio files, or other content you voluntarily submit to generate Outputs.
- Images, Faces & Likeness (Optional): If you use features such as talking avatars, image-to-video, or AI VFX, the images or video you submit may contain faces or other likeness of you or others.
- Audio Data (Optional): If you choose to use AI voice-related features, the audio recordings you submit.
- Connected Account Data (Optional): If you connect a YouTube, Instagram, ChatGPT, or other third-party account, the access tokens, account identifiers, channel or profile details, and content or analytics data described in Section 5.
- Usage Data: Account ID, session data, device and browser information, IP address, general location (city/country level), plan tier, credit and billing-cycle records, generation history, and usage activity across Vidimize, X-Motion, and our other extensions.
- Creator Program Submissions (Optional): If you join the Earn Credits program, the links to your public posts, social handles, and submission details you provide.
- User-Provided URLs (Optional): URLs to content you created using our Services, provided voluntarily for license verification or support purposes.
- Communications: Messages you send to support and your email preferences.
Non-Personal / Aggregated Data
We collect technical and aggregated data (such as browser type, operating system, referral source, time zone, and anonymized usage statistics) that does not directly identify you. If such data is combined with Personal Data, it will be treated as Personal Data.
4. AI Services, Images & Audio Data
No-Training Pledge
Vidimize does not use your Inputs or Outputs to train, fine-tune, or improve our AI models or any third-party AI models.
Third-Party AI Processing
To generate Outputs, your Inputs are sent to the AI infrastructure providers that run the selected model (for example, Replicate, Google, and Anthropic). They process Inputs only to return the requested Output.
Faces, Likeness & Audio
We process images, video, and audio you submit solely to generate the Outputs you request. We do not use them to identify individuals, create facial or voice recognition templates, or infer personal characteristics.
Depending on your jurisdiction, images of faces and voice recordings may be considered sensitive or biometric data. You must only submit another person's image, video, or voice if you have their permission. You can ask us to delete your Inputs and Outputs at any time by emailing privacy@candymustache.com. Deleted data is removed from our active systems, subject only to limited legal retention requirements and backup cycles.
5. Connected Accounts & Integrations
Some features let you connect third-party accounts. We only access these accounts after you authorize it, and only to provide the feature you requested.
Sign in with Google
You can create your Vidimize account and sign in with your Google account. Our sign-in provider, Clerk, then receives from Google only your name, email address, profile picture and Google account ID. We use them only to create your account, sign you in and contact you about your account. We do not ask Google for access to your Gmail, Drive, contacts or any other Google data.
We never sell this information, never use it for advertising and never use it to train AI models. You can disconnect Vidimize at any time from your Google account connections page, and deleting your Vidimize account deletes it from our systems.
Google sign-in, and every other Google API we use, is never used to create sexual, intimate or non-consensual imagery of real people. Our Terms of Use prohibit that content, and uploads are checked for unsafe content before any generation runs.
YouTube (Google)
Our scheduler uses YouTube API Services. If you connect a YouTube channel, we request permission to upload videos you schedule and to read your channel details and video statistics so we can show you post performance. We store the access tokens and the channel and video data needed to run your schedule.
By connecting YouTube, you agree to be bound by the YouTube Terms of Service, and your data is also subject to the Google Privacy Policy. You can revoke our access at any time from your Google account connections page. Once access is revoked, we can no longer access your channel. You can also email privacy@candymustache.com to have your stored tokens and YouTube data deleted; we delete it within 30 days of your request or of account deletion.
Vidimize's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not allow humans to read it except with your permission, for security purposes, or where required by law.
Instagram & Facebook (Meta)
If you connect an Instagram Business or Creator account, we access the account and linked Facebook Page details needed to publish content you schedule and to read post insights. You can revoke access at any time from your Meta account's Business Integrations settings, or email us to have the stored tokens and data deleted.
ChatGPT
If you link your Vidimize account to ChatGPT, prompts and parameters you send through ChatGPT to Vidimize are processed like any other Input, and Outputs are returned to ChatGPT. Your use of ChatGPT is governed by OpenAI's own terms and privacy policy.
6. Tracking Technologies
We use cookies, pixels, and similar technologies ("Tracking Technologies") to operate and improve the Services. Non-essential technologies run only if you consent, where consent is required.
- Strictly Necessary (Authentication & Security): Session, security, bot-protection, and identity-related technologies required to keep users signed in, protect accounts, prevent fraud, and maintain the integrity of the Services.
- Preferences & Functionality: Cookies help remember settings, consent choices, and performance-related preferences.
- Analytics: We use Google Analytics, Microsoft Clarity (which may record anonymized page interactions), and Vercel Analytics to understand how users interact with the Services.
- Error Monitoring: We use Sentry to detect and fix errors. Error reports may include IP address, browser and device details, and the page where the error happened.
- Advertising Measurement: If you consent to marketing cookies, we use the Meta Pixel and Meta Conversions API to measure whether advertising leads to visits and purchases. We may send Meta pseudonymized identifiers and transaction information, including hashed email and account identifiers, advertising click and browser identifiers, IP address, browser user agent, purchase value, currency, and transaction ID. We do not send full payment-card details.
You can change your choices at any time using , through your browser settings, or with opt-out tools such as the Google Analytics Opt-out Browser Add-on. Disabling cookies may affect certain features of the Services.
7. Purposes & Legal Bases for Processing
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Account creation & management | Registration, billing data | Performance of a contract |
| AI content generation | Inputs, optional images and Audio Data | Performance of a contract; explicit consent where sensitive data is involved |
| Custom production orders | Order details, files you provide, contact data | Performance of a contract |
| Scheduling and publishing to connected accounts | Connected Account Data, scheduled content | Performance of a contract; your authorization |
| Service delivery & support | Usage, plan, credit, billing-cycle data, communications | Performance of a contract |
| Regional pricing eligibility | IP-derived country, billing country | Legitimate interests |
| Platform improvement & error monitoring | Aggregated usage data, error reports, feedback | Legitimate interests; consent for analytics cookies where required |
| Security & fraud prevention | Account, usage, device, entitlement, and generation-pattern data | Legitimate interests |
| Marketing communications, including reminders about incomplete checkouts | Email address, plan and checkout status | Consent / legitimate interests |
| Advertising measurement and attribution | Hashed identifiers, advertising identifiers, IP address, browser user agent, and transaction metadata | Consent |
| Legal compliance | Relevant Personal Data | Legal obligation |
8. How We Use Your Data
We use Personal Data to:
- Provide and operate the Services
- Process AI generations, asset downloads, and custom production orders
- Publish content you schedule to accounts you connect
- Communicate service-related notices and updates
- Send marketing communications (you may opt out at any time using the unsubscribe link in any email)
- Enforce plan entitlements, credit refresh rules, rate limits, and fair use protections across Vidimize, X-Motion, and our other extensions
- Detect fraud, misuse, or violations of our Agreement
- Comply with legal and regulatory requirements
9. Automated Decisions
We use automated systems to filter unsafe prompts and to detect abuse of credits, free trials, and unlimited features. These systems may block a generation or flag an account for review. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing; account suspensions and terminations are confirmed by a person. You may contact us to request human review of any automated decision.
10. Data Sharing
We do not sell your Personal Data for money. We may share Personal Data with:
- Internal Personnel: Employees and contractors with a legitimate need to perform their duties.
- Service Providers (Processors): These providers act on our instructions and are contractually restricted from using your data for their own purposes or model training. They include:
- Hosting, storage & content delivery: Vercel, Supabase, Amazon Web Services, Cloudinary
- Authentication: Clerk
- Payments: Stripe, PayPal
- Email delivery: Resend
- AI infrastructure: Replicate, Google, Anthropic, and the model providers they host
- Analytics & error monitoring: Google Analytics, Microsoft Clarity, Vercel Analytics, Sentry
- Internal team notifications: Telegram (limited to account identifiers and submission details for review)
- Platforms You Connect: Content and metadata you choose to publish are sent to YouTube, Instagram, or other platforms you connect.
- Advertising Partners: If you consent to marketing cookies, we share limited identifiers and transaction data with Meta for conversion measurement, attribution, and advertising reporting.
- Legal & Safety Requirements: Where required by law, legal process, or to protect rights, safety, or security.
- Business Transactions: In the event of a merger, acquisition, or asset sale, data may be transferred as part of that transaction.
11. International Data Transfers
CandyMustache, Inc. is based in the United States, and our service providers may process data in the United States and other countries. If you are located in the EEA, UK, or Switzerland, your Personal Data may be transferred to and processed in the U.S.
We rely on approved safeguards such as Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or applicable data transfer frameworks (such as the EU-U.S. Data Privacy Framework, where a provider is certified) to ensure an adequate level of protection.
12. Your Privacy Rights
GDPR (EEA / UK / Switzerland)
You have the right to access, correct, delete, restrict, object to processing, and request portability of your Personal Data. Where we rely on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority. These rights are subject to applicable legal limitations.
California (CCPA / CPRA)
California residents have the right to:
- Know what Personal Information we collect, use, and disclose
- Request deletion or correction of Personal Information
- Opt out of the "sharing" of Personal Information for cross-context behavioral advertising
- Not be discriminated against for exercising these rights
Vidimize does not sell Personal Information for money. Our use of the Meta Pixel and Conversions API for advertising measurement may be considered "sharing" under the CPRA. To opt out, turn off marketing cookies using , or email privacy@candymustache.com with the subject "Do Not Sell or Share My Personal Information". We do not knowingly sell or share the Personal Information of consumers under 16.
Other U.S. States
Depending on your state of residence, you may have similar rights to access, correct, delete, and obtain a copy of your Personal Data, and to opt out of targeted advertising. If we deny your request, you may appeal by replying to our decision.
How to Exercise Your Rights
Email privacy@candymustache.com from the address associated with your account. We may need to verify your identity before acting on a request. We respond within the time required by applicable law (generally 30 days under GDPR and 45 days under U.S. state laws). You can also delete your account from your account settings.
13. Data Retention
We retain Personal Data only for as long as necessary to provide the Services, maintain your account, comply with legal, accounting, or regulatory obligations, and resolve disputes and enforce our agreements. In general:
- Account data is kept while your account is active and deleted or anonymized after account deletion, except where we must keep it longer.
- Inputs and Outputs are kept in your history until you ask us to delete them or your account is deleted.
- Connected account tokens and data are deleted within 30 days of your request or of account deletion, and stop working as soon as you revoke access on the platform.
- Billing and tax records are kept for as long as tax and accounting laws require (typically up to 7 years).
- Security, error, and analytics logs are kept for limited periods set by our providers, typically no longer than 26 months.
14. Security
We use reasonable technical and organizational measures to protect Personal Data, including encryption in transit, access controls, and signed, time-limited download links. No system is completely secure, and we cannot guarantee absolute security.
15. Children's Privacy
The Services are intended for users aged 18 and older and are not directed to children. We do not knowingly collect Personal Data from anyone under 18. If we become aware that such data has been collected, we will delete it promptly.
16. Updates to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date reflects the most recent revision. Material changes will be communicated via the Services or email where required.
17. Contact Us
For privacy questions or to exercise your rights, contact us at:
CandyMustache, Inc. (Vidimize)
651 North Broad Street, Suite 201, Middletown, DE 19709, United States
📧 Email: privacy@candymustache.com
📩 Support: Help Center / legal@candymustache.com