Privacy Policy

This Privacy Policy describes how Woxgen (operated by Karan Mehta, a sole proprietor based in India, referred to here as “Woxgen”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you visit woxgen.com, use the editor at app.woxgen.com, or otherwise interact with our services (together, the “Service”).

By using the Service you agree to this policy. If you do not agree, please stop using the Service. This policy is published in accordance with the Information Technology Act, 2000 read with Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India.

1. Information we collect

We collect only what we need to deliver the Service. This includes:

Account information

• Your name and email address, supplied when you sign up.
• A hashed password (we never store passwords in clear text).
• Optional profile preferences such as default voice and language.

Content you upload

• Screen recordings and source videos you upload for processing.
• AI-generated scripts, voice-over audio, subtitles, and rendered output associated with those uploads.
• Project metadata: titles, timeline edits, and your inputs in the Producer chat.

Billing information

• Plan selection, billing email, and subscription status.
• Card details are never seen or stored by Woxgen; they are handled directly by our PCI-DSS compliant payment processor (Razorpay). We receive only a tokenised reference and the transaction outcome.

Usage and device data

• Log data: IP address, browser type, device type, pages viewed, timestamps, referring URLs.
• Render counts, storage used, and other quota-related metrics tied to your plan.
• Cookies used for authentication and basic preferences (see Section 6).

2. How we use your information

• To run the core product features: generate scripts, synthesise narration, render videos, and store your projects.
• To authenticate you and keep your account secure.
• To process payments, apply plan limits, and send billing-related emails.
• To send transactional emails such as verification, password reset, and render-completion notices.
• To debug issues, monitor performance, and improve the Service.
• To detect and prevent fraud, abuse, and violations of our Terms.
• To comply with applicable Indian laws and respond to lawful requests.

We do not sell your personal data. We do not use the videos you upload to train any third-party AI model. Your uploads stay associated with your account and are not made public unless you explicitly choose to share them.

3. Service providers we share data with

To run the Service, certain data is processed by trusted third parties under contractual safeguards:

• Google Cloud Storage — encrypted storage for uploaded and rendered video files.
• Google Gemini API — used to analyse video frames and generate narration scripts. Frames are sent for inference only and are not retained for model training by Woxgen.
• Microsoft Edge Text-to-Speech — converts generated scripts into voice-over audio.
• Razorpay Software Pvt. Ltd. — payment processing. Card and bank data are handled directly by this processor.
• Brevo (Sendinblue) — transactional email delivery (verification, password reset, billing receipts).
• Hosting infrastructure — virtual private servers hosted on commercial cloud providers within data centres operated under standard security controls.

We share only the minimum data each provider needs to perform its function. We do not authorise any of these providers to use your data for their own marketing purposes.

4. Data retention

• Account data is retained while your account is active.
• Uploaded source files and rendered videos are retained for as long as you keep them in your account. If you delete a project, the associated files are permanently removed from our active storage within 30 days; backup copies are purged within 90 days.
• Billing records and tax-relevant invoices are retained for the period required by Indian law (currently up to 8 years).
• System logs (request logs, error logs) are retained for up to 90 days for security and debugging purposes.
• If you close your account, we delete personal data within 30 days unless retention is required by law.

5. Security

We protect your data with industry-standard measures:

• HTTPS / TLS 1.2+ for all traffic between you and Woxgen.
• Passwords stored as salted bcrypt hashes.
• Server-side authentication using JWT access tokens with short expiry and refresh-token rotation.
• Encrypted storage at rest for uploaded media (Google Cloud KMS).
• Strict role-based access controls on production systems.
• Database credentials, signing secrets, and API keys held in environment variables, never in source control.

No system is perfectly secure. If we ever become aware of a personal data breach affecting you, we will notify you and the appropriate authority in line with the timelines required by applicable Indian law.

6. Cookies

We use a small number of first-party cookies to operate the Service:

• Authentication cookies — keep you signed in across pages.
• Preference cookies — remember UI choices such as theme or default voice.
• Anti-abuse cookies — identify automated traffic and protect against fraud.

We do not place advertising or cross-site tracking cookies. You may block cookies in your browser, but the Service may not function correctly without authentication cookies.

7. Your rights

Subject to applicable law (including the DPDP Act, 2023 in India and the GDPR for EU users), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate personal data.
• Request deletion of your personal data (subject to retention obligations under law).
• Export your data in a portable format.
• Withdraw consent, where processing is based on consent, by closing your account.
• Lodge a complaint with the relevant data protection authority.

To exercise any of these rights, email support@woxgen.com from the address on your account. We respond within 30 days.

8. Children

The Service is not intended for children under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

9. International transfers

Our infrastructure and certain subprocessors operate outside India. When personal data is transferred internationally, we rely on appropriate safeguards such as the standard contractual terms offered by the relevant subprocessor and the protections built into their cloud-region controls.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective” date at the top of this page reflects the latest revision. For material changes, we will notify registered users by email at least 7 days before the change takes effect.

11. Grievance officer & contact

For privacy questions, data requests, or grievances under Indian IT Rules, write to: