Privacy Policy

Effective Date: July 16, 2026

Last Updated: July 22, 2026

CaptionBolt ("we," "us," or "our") operates captionbolt.com and the CaptionBolt application (collectively, the "Service"). This Privacy Policy explains what personal information we collect, why we use it, how we disclose and retain it, and the choices available to you.

Where applicable law requires consent, we request it separately. Using the Service does not waive any privacy rights that cannot legally be waived.

1. Information We Collect

1.1 Account and Authentication Information

When you create or use an account, we may collect:

Profile information — name, email address, username, profile image, language, and locale.
Authentication information — hashed passwords, passkey public credentials and device metadata, two-factor authentication settings, verification tokens, and account-linking records.
Session and security information — session identifiers, IP address, user agent, login timestamps, and information used to detect unauthorized access.
Google Sign-In information — if you sign in with Google, we receive your email address, display name, profile picture, and Google account identifier. We request only the email and profile scopes and do not request access to Google Drive, Gmail, Calendar, Contacts, or other Google services.

1.2 Billing and Subscription Information

Payments are processed by Stripe. We do not store your full payment card number, expiration date, or security code. We may store or receive:

Stripe customer, checkout, subscription, and price identifiers.
Your selected plan, billing interval, subscription status, and renewal or cancellation status.
Transaction, refund, invoice, promotion, country, and payment-audit information needed to operate and support billing.
The IP address and approximate country associated with a checkout attempt for security, fraud prevention, and regional offer eligibility.

Stripe may collect additional payment and identity information directly from you under Stripe's Privacy Policy.

1.3 Videos, Audio, Projects, and Creative Assets

When you use CaptionBolt, we process the content and project data needed to provide the features you choose, including:

Source video or audio files, file names, technical metadata, thumbnails, previews, and rendered outputs.
Audio temporarily extracted or converted for speech recognition.
Transcripts, captions, word-level timestamps, manual corrections, imported subtitle files, and hidden or removed sections.
Editor settings such as caption styles, resize and background choices, Trim and cut decisions, Cover settings, B-Roll placement, Logos, Progress Bars, and export settings.
Saved Video Templates, uploaded logos, uploaded B-Roll, selected Pexels assets, and related attribution information.
Prompts, transcript excerpts, and generated results for optional AI-assisted features such as keyword and emoji suggestions, headlines, Covers, summaries, B-Roll suggestions, and Social posts.
Exported MP4, TXT, SRT, ASS, or VTT files when available under your plan.

CaptionBolt does not use your uploaded content to train CaptionBolt-owned AI models. Some features use third-party AI providers, whose processing is described in Section 5 and governed by our agreements and their applicable policies.

1.4 Support and Contact Information

If you submit a contact form or support ticket, we collect the information you provide, such as your name, email address, topic, message, project details, and attachments. We also collect the submission IP address and user agent for abuse prevention and troubleshooting.

1.5 Organization Information

If organization features are available to your account and you use them, we may collect organization names, logos, member email addresses, roles, invitations, shared project information, and organization billing records.

1.6 Usage, Device, Analytics, and Attribution Information

We and our service providers may automatically collect:

Browser type, operating system, device type, screen information, IP address, approximate location, and user agent.
Pages viewed, links clicked, feature and editor events, processing status, error events, timestamps, and referring pages.
UTM parameters, landing page, referral source, affiliate identifiers, and advertising click identifiers such as gclid, gbraid, wbraid, fbclid, msclkid, or ttclid.
Signup device, IP-derived country, and whether a Google Ads identifier was present.
Cookie and similar-technology data described in Section 6.

2. How We Use Information

We use personal information to:

Provide and operate the Service — receive uploads, transcribe speech, create and edit captions, save project settings, render outputs, provide downloads, and show eligible historical results.
Provide optional AI-assisted tools — process the text or project context you submit for suggestions, Covers, B-Roll, summaries, headlines, and publishing copy.
Manage accounts and subscriptions — authenticate users, maintain sessions, process plan changes, apply promotions, manage billing, and handle refunds.
Provide support — respond to questions, investigate project problems, and send ticket confirmations.
Maintain security and reliability — prevent abuse and fraud, enforce plan and processing limits, diagnose failures, refund failed processing credits, and protect users and infrastructure.
Measure and improve the Service — understand feature usage, site performance, conversion, attribution, and reliability; test improvements; and create aggregated or de-identified statistics.
Communicate with you — send authentication, account, support, billing, renewal, cancellation, product, and policy messages. Marketing or product-update messages are sent where permitted by law, and you may unsubscribe from marketing messages.
Comply with law and enforce agreements — respond to valid legal requests, maintain required records, resolve disputes, and enforce our Terms.

We do not make decisions that produce legal or similarly significant effects about you solely through automated processing.

3. Legal Bases for EEA and UK Processing

If the GDPR or UK GDPR applies, we rely on the following legal bases as appropriate:

Performance of a contract — to create your account, process requested videos, provide exports, manage subscriptions, and deliver support.
Legitimate interests — to secure and improve the Service, prevent fraud and abuse, diagnose failures, measure product performance, understand attribution, and communicate about the Service, where those interests are not overridden by your rights.
Consent — for non-essential cookies, certain analytics or marketing activities, and optional communications where consent is required. You may withdraw consent at any time.
Legal obligations — to meet tax, accounting, consumer-protection, fraud-prevention, and lawful disclosure requirements.

Videos and transcripts may contain personal or sensitive information about you or other people. You are responsible for having the rights, permissions, and lawful basis needed to upload and process that content. We process it to provide the features you request.

4. Storage, Security, and Retention

4.1 Where Information Is Stored

Project media and rendered files are stored in Cloudflare R2.
Account, project, transcript, billing-reference, and support data are stored in secured databases and application infrastructure.
Payment card information is stored and processed by Stripe.
Temporary media files may be created on processing infrastructure and removed after processing or operational cleanup.

Some media must be retrievable by CaptionBolt's browser editor and rendering systems through exact object URLs. These URLs use difficult-to-guess paths and are intended for project use, but anyone who obtains an exact media URL may be able to access it. Do not publish or share a project media URL unless you intend the recipient to access that file.

4.2 Retention

We retain information for the shortest period reasonably necessary for the purposes described in this policy, subject to operational, legal, security, and dispute-resolution needs:

Account and profile data is generally retained while your account is active.
Project records, transcripts, captions, and editor settings are retained while needed to provide projects, exports, support, account history, and eligible read-only archive results.
Media, B-Roll, previews, and rendered outputs are subject to operational storage lifecycle rules and may be removed independently of related database records. CaptionBolt is not a permanent media backup service, and you should download outputs you want to keep.
Removing a project from the project list currently hides it through a database soft delete. It does not guarantee immediate physical deletion of every related media object, backup, log, or derived file. Those items are removed or expire through operational lifecycle and deletion processes.
The 14-day window shown in project lists controls which projects are displayed; it is not a promise that every underlying record or file is deleted exactly after 14 days.
Support, billing, tax, fraud-prevention, and security records may be kept for the period reasonably needed to comply with law, resolve disputes, prevent abuse, and maintain financial records.
Logs and backups are retained according to operational security, continuity, and debugging needs, then deleted or overwritten.

Deleting your account initiates deletion or de-identification of account-linked data. Some billing, support, security, backup, project, or media records may remain where reasonably necessary for the purposes above or where immediate deletion is not technically possible. We will not use retained data for a new incompatible purpose.

4.3 Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including:

TLS/HTTPS encryption in transit.
Hashed passwords and established authentication controls.
Access controls for internal systems.
Run-scoped media processing and restricted upload paths.
Logging, monitoring, and security reviews.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

5. How We Disclose Information

We do not sell personal information for money. We disclose information as described below to operate the Service:

| Provider or Category | Purpose | Information Processed | |---|---|---| | Stripe | Payments, subscriptions, invoices, refunds, tax and fraud prevention | Billing, transaction, account, device, and checkout information | | Cloudflare, Vercel, and other infrastructure providers | Hosting, object storage, delivery, security, databases, queues, and processing infrastructure | Account data, IP address, requests, project data, uploaded media, and outputs as needed | | Groq and CaptionBolt-managed transcription infrastructure | Speech recognition | Audio derived from your uploaded video, language choice, and technical request metadata | | OpenRouter and routed model providers, currently including Google models | Optional editor AI features | Prompts, transcript or caption excerpts, requested tone or format, and generated results | | Google | Google Sign-In and, through routed AI services, model processing | Basic Google profile information for sign-in; text submitted to applicable AI features | | Pexels | Stock image and video search and delivery | Search terms, selected asset requests, and standard request metadata | | Resend | Transactional and permitted product emails | Email address, name, locale, and email content or delivery metadata | | Google Analytics, self-hosted Umami analytics, and Affonso | Site measurement, conversion attribution, and affiliate tracking | Device and browser data, page and event activity, referrer, IP-derived information, cookies, and attribution identifiers |

Third-party providers may process information in other countries and may use their own subprocessors. Their privacy policies describe their controller activities; our agreements govern processing they perform on our behalf.

5.1 Organization Members

If you use an organization workspace, its owners, administrators, and authorized members may access shared projects and account details according to their roles. The organization may control the workspace content it manages.

5.2 Legal and Safety Disclosures

We may disclose information when we reasonably believe it is necessary to:

Comply with applicable law, a court order, or valid legal process.
Protect the rights, safety, and property of users, CaptionBolt, or others.
Investigate fraud, security incidents, abuse, or Terms violations.
Establish, exercise, or defend legal claims.

5.3 Business Transfers

Information may be disclosed or transferred in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of the business. Where required, we will notify you before your information becomes subject to a materially different privacy policy.

5.4 Sale or Sharing Under US State Privacy Laws

We do not sell personal information for monetary consideration. Analytics, advertising-attribution, and affiliate technologies may involve disclosures that some US state laws define as a "sale," "sharing," or use for targeted advertising even when no money is exchanged for the information. Where such laws apply, you may request to opt out by contacting us as described in Section 11.

6. Cookies and Similar Technologies

We use:

Essential cookies — authentication, sessions, security, and core account functions.
Preference cookies — locale, appearance, and saved choices.
Analytics technologies — Google Analytics and self-hosted Umami measurement.
Attribution and affiliate technologies — UTM and referral information, advertising click identifiers, cross-subdomain attribution, and Affonso affiliate tracking.

CaptionBolt's first-party attribution cookie and Affonso tracking are configured with a 30-day duration. The marketing site also stores your cookie-choice selection for 30 days.

You can block or delete cookies through your browser settings. Blocking essential cookies may prevent authentication or other core features from working. You can also use the choices presented on the marketing site where available.

7. Your Privacy Rights

Depending on your location and subject to legal exceptions, you may have the right to:

Access or obtain a copy of personal information we hold about you.
Correct inaccurate or incomplete information.
Delete personal information.
Receive certain information in a portable format.
Restrict or object to certain processing.
Withdraw consent where processing is based on consent.
Opt out of marketing communications.
Appeal a denied privacy request where applicable.
Complain to a data-protection authority.

To submit a request, email help@captionbolt.com or use captionbolt.com/contact. We may need to verify your identity and authority before completing a request. We respond within the timeframe required by applicable law and may extend the response period when legally permitted.

7.1 EEA, UK, and Switzerland

You may also object specifically to processing based on legitimate interests and lodge a complaint with your local supervisory authority. Withdrawing consent does not affect processing already lawfully completed before withdrawal.

7.2 California and Other US States

Where applicable, residents may request:

The categories and specific pieces of personal information collected.
The sources, business purposes, and categories of recipients.
Deletion or correction of personal information.
Opt-out of sale, sharing, or targeted advertising.
Limitation of certain uses of sensitive personal information.
Equal service and non-discrimination for exercising privacy rights.

You may use an authorized agent where permitted. We may request proof of authorization and identity verification. We do not knowingly sell or share personal information of users under 16.

8. International Data Transfers

CaptionBolt and its providers may process information in countries other than where you live. Where required, transfers rely on recognized safeguards such as adequacy decisions, contractual protections, or Standard Contractual Clauses. You may contact us for more information about applicable transfer safeguards.

9. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If local law sets a higher minimum age for independent consent to online services, that higher age applies. Users who are not old enough to enter a binding agreement must use the Service only with permission and supervision from a parent or legal guardian.

If you believe a child has provided personal information in violation of this section, contact help@captionbolt.com.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service, providers, or law. We will update the "Last Updated" date and, when required, provide additional notice through the Service or by email.

11. Contact Us

For privacy questions or requests:

Email: help@captionbolt.com
Website: captionbolt.com/contact