This policy explains what VidMee (the “Service”, operated by ZHC Labs) collects, why, how we handle it, and your choices. It applies to vidmee.ai, the dashboard, the REST API, and the MCP server.
01What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Email, name, authentication identifiers | You, via our auth provider (Clerk) |
| Billing | Plan, credit balance, transaction history, Stripe customer/subscription IDs | You and Stripe (we do not receive full card numbers) |
| Job inputs | URLs, prompts, uploaded images, reference assets, viewport and options | You / your agent |
| Job outputs | Screenshots, rendered pages, generated images and video, QA findings, transcripts | Generated by the Service |
| Saved logins | Encrypted browser session state you choose to vault (see §4) | You / your agent |
| Usage & logs | API calls, tool names, timing, cost, errors, IP address, user agent | Automatic |
02How we use it
- Operate your account and authenticate you.
- Execute the jobs your agent requests and return results.
- Meter usage, hold and settle credits, and process payments.
- Maintain reliability and security, debug, and prevent abuse.
- Communicate about your account (service notices, billing, support).
We do not sell your personal data, and we do not use your private job inputs or outputs to train our own models. Job inputs are sent to the third-party model and infrastructure providers listed in §5 solely to perform your request.
03Job data & screenshots
Screenshots, rendered pages, generated media, and QA results are stored under your project and are private by default: served only through short-lived signed URLs to your authenticated project. If you set an asset to public, it is served from a permanent public URL that anyone with the link can view, until you delete it. Rendering runs in a sandboxed, credential-less browser with internal-network access blocked. Visual-memory features store embeddings and hashes of your assets within your project to detect regressions and similarities.
04Saved logins
When you use the login vault, VidMee stores the browser session state (for example cookies and local storage) so your agent can resume an authenticated session by name. This data is encrypted at rest (Fernet / AES) with a server-held key and is decrypted only in-memory to drive the sessions you initiate. Listing your logins returns names, domains, and expiry only, never the stored session contents. You can delete a saved login at any time, which removes it. Only store sessions for accounts you are authorized to use.
05Processors we use
We rely on third-party sub-processors to run the Service. They receive only the data needed for their function:
| Processor | Purpose |
|---|---|
| Clerk | Authentication and account identity |
| Stripe | Payments and subscriptions (PCI-compliant; card data stays with Stripe) |
| PostHog | Product and web analytics on vidmee.ai and the dashboard (page views, feature usage; identified only after you sign in — anonymous visitors are not profiled). Sets a first-party cookie/localStorage entry to keep session continuity. |
| Railway | Application hosting and managed database |
| Cloudflare | CDN, edge, and asset delivery |
| Model & vision providers | Executing generation and analysis (e.g. Google, fal.ai, Replicate, Zark, and our routing gateway) on your job inputs |
The exact set of model providers used for a given job depends on routing; each receives only that job’s inputs. We will update this list as our processors change.
06Retention
We keep account and billing records for as long as your account is active and as required for legal, tax, and accounting purposes. Job inputs, screenshots, and generated assets are retained under your project until you delete them or close your account, after which they are scheduled for deletion (backups roll off on their own cycle). Saved logins persist until they expire or you delete them. Operational logs are kept for a limited period for security and debugging.
07Security
We use encryption in transit (HTTPS), encryption at rest for the login vault, tenant isolation so projects cannot read each other’s data, signed short-lived URLs for private assets, and edge-authenticated origins. No system is perfectly secure; keep your API keys secret and rotate them if exposed.
08Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete assets and saved logins yourself in the product, and you can request account deletion or a data export by emailing us. We respond within the time required by applicable law.
09Children
The Service is for developers and is not directed to children under 16, and we do not knowingly collect their personal data.
10Changes
We may update this policy. Material changes update the date above and, where significant, we provide reasonable notice. Continued use after changes take effect means you accept the updated policy.
11Contact
Privacy questions or requests: hello@vidmee.ai.