Privacy Policy

Last updated September 30, 2026

This Privacy Policy explains how GradeVideo ("GradeVideo," "we," "us," or "our") collects, uses, discloses and retains personal information. It applies to our website, application, review links, billing and support services. Contact hello@gradevideo.com with privacy questions or requests.

This policy describes our practices. It does not replace a separate data processing agreement or remove rights that apply under privacy law. Our Terms of Service govern use of the service.

Our role and your workspace

GradeVideo determines how to process information needed to run its own accounts, website, billing, security and support. For personal information in customer uploads and review activity, the customer generally determines the purpose of processing, and we process that information to provide the service under the customer's instructions.

If an employer, client or school controls your workspace, its administrator can manage access and project records. Its privacy notice may also apply. Contact that organization first for requests about content it controls. We will assist with those requests as required by our agreement and applicable law.

Information we collect

• Account and workspace information. Your name, email address, profile information, password hash, sign-in records, workspace membership, role and invitations. If you use an identity provider, we receive the profile and authentication information it supplies.
• Files and review activity. Uploaded video, audio and other project files; file names and media metadata; versions; comments; drawings; timecodes; review decisions; and link settings. Files can contain personal information about people who do not have an account.
• Reviewer information. The name you supply when you leave a guest note, the note itself, its position in the video, and technical information needed to serve and protect the review link. You can be a reviewer without being a paying customer.
• Billing information. Billing contacts, plan and subscription details, payment status, invoices, transaction identifiers and usage records. Stripe processes payment credentials. We receive the information needed to administer billing, rather than your full payment card number.
• Technical and usage information. IP addresses, browser and device details, session identifiers, request and error logs, playback diagnostics, feature activity and usage events where analytics is enabled.
• Communications. Information you send in support requests, abuse reports, privacy requests and other correspondence, including attachments you choose to send.

We receive information directly from you, from workspace members who upload or share work, and from identity, payment and service providers. Some technical information is generated automatically when a page, video or API request loads. Fields required to create an account, pay for a plan or leave a note are identified in the relevant flow. Without required information, we may be unable to provide that feature.

How we use information

• Authenticate users, maintain sessions, manage workspaces and enforce permissions.
• Store, process and deliver files; create playback renditions; and keep comments and decisions with the relevant version.
• Run features you select, including automated media analysis, captions, translations or other generated outputs where available.
• Administer subscriptions, calculate authorized usage charges, maintain billing records and resolve payment issues.
• Send service notices, answer support requests and investigate reported problems.
• Detect fraud, abuse and security incidents, enforce our terms and meet legal obligations.
• Measure service performance and diagnose errors so we can improve reliability and usability.

Automated media features can send the relevant content and instructions to the provider that performs the selected task. Generated transcripts, summaries and other outputs can contain personal information from the source. Review those outputs before sharing them. Our permission to process content is limited by the content license in our terms; uploading a file does not give us a general license to advertise with it or train general-purpose AI models on it.

Legal bases for processing

Where applicable law requires a legal basis, we rely on performance of our agreement to provide accounts, media delivery and billing; legal obligations for required records and lawful requests; and legitimate interests in securing, supporting and improving the service. We consider the effect of those interests on individuals. Where consent is required, such as for certain optional tracking, we rely on consent. You can withdraw consent without affecting processing that was lawful before withdrawal.

When we act as a processor for a customer, the customer is responsible for establishing the legal basis for its content and instructions. A processing agreement, where agreed, further defines those responsibilities.

Who can see project content

Workspace members and invited users can see content within their permissions. A review link can grant access to anyone who obtains it, subject to the link's password, expiry and other settings. A recipient can forward a link. Comments and review decisions can be visible to other people with access to that review.

The person who shares the content is responsible for choosing recipients and permissions. Turning off a link cannot recall files already downloaded, screenshots or copies made by recipients. Do not put private information in a public link title, file name or comment unless you intend its recipients to see it.

Other disclosures

We disclose information to providers that perform the functions listed below and to authorized people who need it to operate, secure or support the service. Access must serve a legitimate service purpose. We may also disclose information when you direct us to do so through a connected service.

We may disclose information when reasonably necessary to comply with law or a valid legal request, investigate abuse, enforce an agreement, or protect rights and safety. We may share relevant information with professional advisers for those purposes. If GradeVideo is involved in a merger, acquisition, financing or transfer of assets, information may be transferred subject to applicable confidentiality and data protection requirements.

Subprocessors

The information each provider receives depends on the features you use. Providers acting on our behalf may process that information only for the authorized service purposes, subject to the applicable agreement. Stripe also acts as an independent controller for some payment, fraud prevention and regulatory activities. A provider's privacy policy does not replace our responsibilities to you.

International processing

GradeVideo and its providers may process information in the United States and other countries. Those countries can have different privacy laws. We do not promise that a standard account stores all data in a particular country. Where law requires safeguards for a transfer, we use the applicable lawful transfer mechanism, such as standard contractual clauses where appropriate. Contact us for information about safeguards that apply to your data.

Cookies, browser storage and analytics

Essential cookies and browser storage keep you signed in, maintain review access and remember settings. Removing or blocking them can stop those functions from working. Product analytics and diagnostics may use cookies or similar identifiers where enabled. Where law requires consent for optional tracking, it must be obtained before that tracking is used.

You can manage cookies through your browser and any preference controls offered by the service. Browser controls apply to that browser and device. Contact us to ask about analytics processing or to make an objection or opt-out request available under applicable law. We do not authorize service providers to use customer uploads for their own advertising.

Retention and deletion

We retain information for the purpose for which it was collected, including providing an active workspace, maintaining review history, meeting legal duties and protecting the service. Retention depends on the type and sensitivity of the information, the need to keep it, customer instructions, and applicable billing, legal and security requirements.

• Account and project information is retained while needed to provide the account or workspace, subject to deletion requests, customer instructions and applicable obligations.
• Billing and transaction records can remain after cancellation where needed for tax, accounting, payment disputes and legal requirements.
• Security logs, support records and abuse reports can remain for investigation, dispute resolution and protection of the service.
• Deleted information may remain temporarily in backups or provider systems until their deletion processes complete. Information retained for a legal obligation remains subject to appropriate access restrictions.

Subscription cancellation does not itself request deletion of all project data. To request account closure or deletion, email hello@gradevideo.com. Closing your own account does not necessarily delete content that a separate customer or workspace is entitled to retain. Download files you need before requesting deletion; we do not promise recovery after deletion.

Security

We use authentication, access controls and service security measures to protect information. Account passwords are stored as hashes. Security also depends on how you protect credentials and configure workspace and review access. No online service can guarantee complete security. Report suspected unauthorized access to hello@gradevideo.com. We will give notices of a personal data breach when applicable law requires them.

Your choices and privacy rights

Depending on your location and the law that applies, you may have the right to:

• Confirm whether we process your personal information and obtain access to it.
• Correct inaccurate information, request deletion, or receive a portable copy.
• Restrict processing or object to processing based on legitimate interests.
• Withdraw consent or opt out of processing covered by an applicable legal opt-out right.
• Appeal a refusal of a request and complain to the relevant regulator.

Email requests to hello@gradevideo.com with the subject "Privacy request." Identify the account or workspace involved and the action you request. Do not send a password or full payment card details. We may ask for information reasonably needed to verify identity or authority. An authorized agent may submit a request where law permits, subject to proof of authority.

We will respond within the period required by applicable law. Rights can be subject to exceptions, including another person's rights, security needs and required records. If we decline a request, we will explain the basis where required. To appeal, reply with the subject "Privacy appeal." We will review the appeal and explain any further complaint route that applies. We will not unlawfully discriminate against you for exercising privacy rights.

People in the European Economic Area or United Kingdom can also contact their local data protection authority. People in the United States can contact the relevant state regulator. If a customer controls the information you request, we may refer you to that customer and assist it with the request.

Children, students and sensitive information

GradeVideo is not directed to children under 13. Children under 13 must not create accounts or directly submit personal information through review links. Schools must control student access and obtain the permissions required for their use. A school account does not by itself establish compliance with education or children's privacy law.

If you believe a child under 13 has directly supplied personal information, contact us so we can investigate and take the steps required by law. Uploaded media can show children or other people who do not use the service; the uploader must have a lawful basis and the permissions needed to process and share that content.

Do not submit payment card credentials, government identifiers, medical records or similarly sensitive information in video notes or support messages. If your use requires special data protection terms, contact us before uploading that information.

Third-party services and policy changes

A site or service reached through an external link has its own privacy practices. This policy does not govern information you provide directly to that service.

We will update the date on this page when this policy changes. We will give additional notice of material changes and obtain consent where law requires it. A policy update does not remove rights that apply to information already collected.

Send privacy questions, deletion requests and appeals to hello@gradevideo.com.