Legal

Privacy Policy

How DecaTrend collects, uses, stores, shares, retains, exports, and deletes personal information and creator content.

These documents are implementation-informed drafts, not legal advice. Replace placeholders and have North Carolina counsel review them before public launch.

Scope

This Privacy Policy explains how Faction Community, LLC, doing business as DecaTrend, processes information when you visit the website, create an account, upload media, generate clips, use the Virality Engine, connect posting platforms, create API keys, subscribe, contact support, or use related services.

Data we save

  • Account records: user ID, email, locale, timezone, plan, Stripe customer ID, creation time, and admin flag when applicable.
  • Workspace and preferences: workspace owner, workspace name, notification preferences, cookie choices, language, and timezone.
  • Billing and usage metadata: subscription status, plan, Stripe customer/subscription identifiers, credits used and remaining, storage bytes, quota period, and credit transactions.
  • Jobs: job ID, user ID, workspace ID, status, progress, error logs, source file storage keys, source file byte size, job mode, batch mode, montage URL, montage duration, and expiration time.
  • Clips: clip ID, job ID, file URL, thumbnail URL, captions URL, timestamps, duration, file size, engagement score, relevance score, virality score, content type, and clip metadata.
  • Projects: project ID, job ID, project JSON URL, and timestamps for OpenCut-compatible project exports.
  • Uploaded and generated media: raw uploads, clip files, thumbnails, captions, montages, and project JSON files stored in S3-compatible storage under user-scoped paths.
  • Platform connections: platform name, encrypted access token, encrypted refresh token when provided, platform user ID, token expiration, and platform metadata.
  • API keys: key name, SHA-256 hash, creation time, last-used time, and revocation time. The raw API key is not saved after creation.
  • Notifications and delivery records: in-app/email/SMS/push notification type, channel, title, body, resource references, delivery metadata, read time, and creation time.
  • Push subscriptions: browser push endpoint, public key material, auth secret material, user agent, and timestamps for users who enable push.
  • Audit and security logs: sensitive account actions, upload initiation, billing events, API-key actions, admin actions, correlation IDs, rate-limit data, and operational logs.
  • Virality Engine data: clip scores, content type, trend-signal aggregates, public trend metadata, recommendations, and platform-post metadata.
  • Support and communications: messages you send to support, legal, privacy, or sales channels, plus information needed to respond.

Data we do not save by design

  • Full payment card numbers or CVC codes. Stripe processes payment details.
  • Plaintext platform access or refresh tokens. Connected platform tokens are encrypted before storage.
  • Raw API keys after creation. Only a hash and metadata are stored.
  • Private platform analytics unless you explicitly connect or provide a platform integration that supplies them. The current Virality Engine design uses public signals for trend analysis.
  • A customer-content model-training dataset by default.
  • Worker-local persistent state. Workers are designed to be stateless and clean temporary job files after processing.
  • Direct database credentials in worker code. Workers report results through internal API routes.

How we use information

  • Authenticate users and maintain sessions.
  • Provide uploads, processing, captions, scoring, montage rendering, exports, OpenCut project files, and downloads.
  • Enforce subscriptions, credits, quotas, tier limits, storage limits, rate limits, and abuse controls.
  • Operate direct posting to YouTube, TikTok, Instagram, or other supported platforms when authorized.
  • Send service, billing, storage-expiry, job-completion, quota, security, marketing, and support messages where permitted.
  • Debug errors, secure the Service, audit sensitive actions, detect abuse, and monitor worker/API health.
  • Generate public-signal trend intelligence, product analytics, aggregate statistics, and operational reporting.
  • Comply with law, enforce agreements, process takedown requests, protect rights, and respond to legal process.

How we share information

  • Supabase for authentication, database, row-level security, and account records.
  • Stripe for checkout, subscriptions, invoices, payment status, billing portal, and tax/payment compliance.
  • DigitalOcean Spaces or another S3-compatible storage provider for uploads, clips, thumbnails, captions, montages, and project JSON files.
  • DigitalOcean Droplets or worker infrastructure for FFmpeg, ClipsAI, Whisper captions, montage generation, polish, and export jobs.
  • Inngest for workflow orchestration, retries, scheduled cleanup, quota monitoring, and event-driven processing.
  • Resend, Twilio, Novu or web-push infrastructure for email, SMS, and push notifications if enabled.
  • Connected platforms such as YouTube, TikTok, and Instagram when you ask DecaTrend to connect, refresh, upload, schedule, or post content.
  • Support, logging, observability, security, legal, accounting, and infrastructure vendors as needed to operate the Service.
  • Authorities, courts, or third parties when required by law or needed to protect rights, users, the Service, or the public.

Retention and deletion

  • Media retention is plan based: Starter 7 days, Creator 30 days, Pro 90 days, Studio 365 days.
  • A daily storage cleanup job warns users before expiry and deletes expired job files from S3-compatible storage.
  • Account deletion attempts to delete all user job files, cancel any active Stripe subscription, write an audit event, and then delete the Supabase auth user so user-scoped database records cascade where configured.
  • Backups, provider logs, billing records, legal records, fraud-prevention records, and security logs may persist for limited periods where required or reasonably necessary.

Your controls

  • You can export a JSON copy of account, preference, job, clip, project, notification, credit, API-key metadata, platform-connection metadata, and teaser-grant data from Settings.
  • You can delete your account from Settings.
  • You can revoke API keys and disconnect platform accounts.
  • You can update locale, timezone, email, SMS, and push notification preferences.
  • You can choose cookie preferences for essential, analytics, and marketing categories.
  • Privacy requests can be sent to [email protected].

Children and sensitive features

The Service is not directed to children under 13, and DecaTrend does not offer standard under-13 accounts at launch. If we learn that a standard account belongs to a child under 13 without a valid supported consent flow, we may delete or restrict the account and associated information.

Teen users may receive restricted feature defaults, including limits on public sharing, monetization, community discovery, and higher-risk synthetic-media features.

The current codebase processes uploaded video/audio to create clips and captions. If future features store voiceprints, face templates, digital twins, avatars, or other legally biometric data, DecaTrend should provide feature-specific notices and consent controls before launch.

Age-assurance and minor data

  • If DecaTrend collects date of birth, region, parental-consent status, age-assurance result, or Teen Mode status, it should use that data to enforce legal, safety, and feature-access rules.
  • Raw identity evidence, if ever collected for age assurance, should be retained only as long as needed and separated from normal account analytics where feasible.
  • Minor-related data should not be used for targeted advertising, unnecessary profiling, or avoidable third-party analytics.

International transfers

Information may be processed in the United States and other countries where DecaTrend or its vendors operate. Where required, DecaTrend should use appropriate transfer mechanisms, such as data-processing terms, standard contractual clauses, or equivalent safeguards.

Contact

Faction Community, LLC, [placeholder-business-address], North Carolina, USA. Privacy: [email protected]. Legal: [email protected].

Contact

Business
Faction Community, LLC
Address
[placeholder-business-address], North Carolina, USA
Privacy / Data Protection
[email protected]

Do Not Sell or Share My Personal Information

DecaTrend does not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising. If you are a California resident and would like to confirm or exercise this right, email [email protected] with the subject "Do Not Sell/Share". You can also adjust analytics and marketing cookies from the consent banner footer link.