Last updated 13 November 2026
This policy explains what Vidflow collects, why we collect it, and what you can ask us to do with it.
1. Who is responsible
GEXON TECHNOLOGY LIMITED, registered in Hong Kong at RM A5, 7/F, Astoria Building, No.34 Ashley Road, Tsim Sha Tsui, Kowloon, is the data controller for the personal data described here. Contact: gexon.tech@outlook.com.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email address, display name, password hash, sign-in times | To create and secure your account |
| Content | Prompts, uploaded footage, generated clips, subtitles | To render and deliver what you asked for |
| Billing | Order history, credit balance, Stripe customer and payment identifiers | To charge for top-ups and keep your ledger |
| Usage | Renders started, resolution, duration, credits spent | To bill correctly and diagnose failures |
| Technical | IP address, browser and device type, request logs, session cookie | To keep sessions working, prevent abuse and investigate incidents |
3. Why we are allowed to process it
- Contract. To provide the service you signed up for.
- Legitimate interests. To secure the service, prevent fraud and abuse, and improve reliability.
- Legal obligation. To keep accounting and tax records.
- Consent. For any optional email we send. You can withdraw it at any time.
4. Cookies and local storage
We set one essential cookie, vidflow_sid, which holds your session so you stay signed in. It is HttpOnly, SameSite=Lax, and Secure over HTTPS. We also keep your interface language in your browser’s local storage. We do not use advertising or analytics cookies and we do not embed third-party trackers.
5. Who we share it with
| Recipient | Purpose |
|---|---|
| Stripe | Card payments and receipts |
| Mailgun | Delivery of verification emails |
| AI model providers | Rendering the clips you request |
| Alibaba Cloud | Hosting the service and storing media in Singapore |
We do not sell personal data. We disclose it otherwise only where the law requires, or to establish or defend legal claims.
6. International transfers
Our servers are in Singapore, and our payment and email providers process data in the United States and the European Union. Where we transfer personal data out of the EEA or the United Kingdom we rely on the Standard Contractual Clauses.
7. How long we keep it
| Item | Retention |
|---|---|
| Account and content | While your account is open, then 90 days after deletion |
| Generated clips and uploads | Until you delete them; residual copies in backups are overwritten on the normal backup cycle |
| Billing records | 7 years, as required by Hong Kong tax law |
| Server logs | 30 days |
8. Your rights
You can ask us to:
- give you a copy of your data;
- correct data that is wrong;
- delete your account and content;
- export your data in a machine-readable format;
- object to or restrict processing based on legitimate interests;
- withdraw consent you previously gave.
Email gexon.tech@outlook.com and we will respond within 30 days. You also have the right to complain to your local supervisory authority — in Hong Kong, the Office of the Privacy Commissioner for Personal Data.
9. Security
Passwords are stored as hashes, sessions are held server-side and expire, and all traffic is served over HTTPS. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as required.
10. Children
Vidflow is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Changes
If we change this policy materially we will publish the new version here and, where required, email you.
12. Contact
GEXON TECHNOLOGY LIMITED, RM A5, 7/F, Astoria Building, No.34 Ashley Road, Tsim Sha Tsui, Kowloon, Hong Kong — gexon.tech@outlook.com.