Privacy Policy

[COMPANY LEGAL NAME] is the data controller for the personal data processed through Wrap. This policy explains what we collect, why, for how long, and how to exercise your rights under the GDPR.

What we collect

  • Account data: email address, password (stored hashed), account creation date, role.
  • Usage data: the briefs you write, the videos generated from them, their settings (format, length, model), credit movements and payment records.
  • Security data: IP address and user agent of your sessions, IP address and a coarse device fingerprint at sign-up (a hash of browser characteristics, no cookies, no third party), the card type, last four digits and expiry date returned by our payment provider. These serve only to prevent fraud and abuse of the free tier.
  • Payment data: handled by Paddle, our merchant of record, which sells you the credits and issues the invoice; we never see your card number. We store Paddle identifiers, amounts and dates.

Why and on what basis

  • Providing the service you asked for (contract): accounts, generations, credits, billing.
  • Keeping the service safe and fair (legitimate interest): abuse prevention, rate limiting, security logs.
  • Legal obligations: invoices and payment records kept for accounting and tax purposes.
  • Sending service emails such as password resets and billing notices (contract). We do not send marketing email without your consent.

Who processes it

We use carefully chosen processors bound by data processing agreements: video generation models operated by fal.ai (your brief is sent to them to generate the video), Paddle (merchant of record) for payments and invoicing, our hosting and storage providers, our transactional email provider and our error-monitoring provider. Some of them may process data outside the European Union under Standard Contractual Clauses or an adequacy decision. We do not sell personal data.

How long we keep it

  • Account and usage data: while your account exists. When you delete your account, your email, password, IP and device data are erased at once, your briefs are replaced by a placeholder and your video files are deleted.
  • Payment and credit records: 10 years, anonymised, as required by French accounting law.
  • Security logs: 12 months.
  • Password reset links: 1 hour.

Cookies

Wrap uses only strictly necessary cookies: two httpOnly session cookies that keep you logged in. No advertising or analytics cookies are set, so no cookie banner is required.

Your rights

You can access, correct, export and erase your data, object to or restrict certain processing, and withdraw consent where processing is based on it. Export and erasure are available directly from your Account page. For anything else, write to privacy@wrap.ai. You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Security

Passwords are hashed with bcrypt, sessions use short-lived tokens, all traffic is encrypted in transit, and access to production data is restricted to the people who need it to operate the service.

Contact

[COMPANY LEGAL NAME], [registered address]. Privacy questions: privacy@wrap.ai.