Privacy Policy

Sapari is a video editing platform operated by Sapari Systems LLC, a Delaware limited liability company. You upload videos, we process them, you download the result. This policy explains what data we collect, why, and what we do with it.

We don't sell your data. We don't share it with advertisers. We don't use your content to train AI models.

This policy applies to all users worldwide. If you are located in the European Union/EEA, Brazil, California, or other jurisdictions with specific privacy laws, additional rights and disclosures apply to you — see the jurisdiction-specific sections below.

Data Controller

The data controller responsible for your personal data is:

Sapari @ Benav Labs LLC
A Delaware limited liability company
Email: privacy@sapari.io
Web: sapari.io

For data protection inquiries, including exercising your rights under GDPR, LGPD, CCPA, or other privacy laws, contact our Data Protection Officer at privacy@sapari.io.

What We Collect

Account Data

When you sign up, we store your name, email address, and a hashed version of your password. If you sign in with Google or GitHub, we receive your name, email, and profile photo from that provider. We store a reference ID from the provider. We never receive or store your Google or GitHub password.

Payment Data

Payments are processed by Stripe. We never see or store your credit card number, CVV, or bank details. We store your Stripe customer ID, subscription status, plan type, and payment amounts for our billing records.

Your Content

When you upload a video, the original file is stored on Cloudflare R2 (S3-compatible cloud storage). During processing, we derive audio and text data from your video for AI analysis. Edits, captions, asset configurations, and export files are all stored in your project. Your content is yours. We access it only to provide the service you requested.

Usage Data

We log API requests (endpoint, method, status code, response time) for performance monitoring and rate limiting. We record your IP address in connection logs. If you create API keys, we track usage per key (endpoint, tokens used, cost). We use Logfire (OpenTelemetry) for backend observability — this covers request traces and system metrics, not your video content.

How We Use Your Data

We process your data for the purposes listed below. For each purpose, we've identified the legal basis under GDPR and equivalent regulations.

No user content is included in monitoring or analytics data. We do not process your data for profiling, automated decision-making with legal effects, or advertising purposes.

AI & Automated Processing

Sapari uses artificial intelligence and machine learning as a core part of the service. Here's what that means for your data:

• What gets sent: During analysis, audio data derived from your video is sent to OpenAI for processing. Text data derived from your content may be sent to DeepSeek or OpenAI for further analysis. Only the data necessary to perform the analysis is transmitted — we don't send your full video files to AI providers.
• How it's processed: AI provider calls are stateless — no conversation history or user context is maintained on the provider side. Data is processed in-flight and is not retained by providers for model training (per their respective API data usage policies as of this writing).
• All suggestions are reviewable: Every AI-generated edit and caption is presented to you as a suggestion in the editor. Nothing is published or exported without your explicit review and approval.
• No training on your content: We do not use your videos, audio, or any derivative data to train, fine-tune, or improve any AI or machine learning models — ours or anyone else's.

Note for EU/EEA users: DeepSeek is operated by a company based in China. Only text data — not audio, video, or personal account data — is sent to DeepSeek. See "International Data Transfers" below for the safeguards in place.

Third-Party Services

Your content is processed by external services as part of the editing pipeline. Here's what gets sent where:

We maintain a current list of subprocessors at our subprocessors page. We will update this list before adding new subprocessors and provide notice of material changes.

International Data Transfers

Sapari is operated from the United States. If you use the service from outside the U.S., your data will be transferred to and processed in the United States and potentially other countries where our service providers operate (see the table above).

For EU/EEA users: We rely on the following mechanisms to ensure adequate protection for cross-border data transfers:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• The EU-U.S. Data Privacy Framework for transfers to certified U.S. service providers, where applicable.
• We conduct Transfer Impact Assessments for transfers to jurisdictions without adequacy decisions, particularly for data processed by DeepSeek (China). Only text data — not audio, video, or personal account data — is sent to DeepSeek.

For Brazilian users: Transfers are conducted in compliance with LGPD requirements, using Standard Contractual Clauses or equivalent safeguards as required by the ANPD.

Cookies & Sessions

We use cookies for authentication and security only. Both cookies are classified as "strictly necessary" under the ePrivacy Directive and do not require consent.

We don't use advertising cookies, tracking pixels, or browser fingerprinting. We don't run Google Analytics, Facebook Pixel, or similar tracking tools. If we ever add non-essential cookies, we will implement a consent mechanism and update this policy.

Storage & Security

• Passwords are hashed before storage. We never store or transmit plain-text passwords.
• Files are stored on Cloudflare R2 with access controlled by signed URLs that expire after 1 hour (24 hours for export downloads).
• Database connections use TLS encryption.
• API communication is HTTPS-only.
• Rate limiting protects against abuse (100 requests per 60 seconds by default, adjustable per tier).
• Sessions are limited to 5 concurrent per account. Inactive sessions are cleaned up every 15 minutes.

Data Breach Notification

In the event of a security breach that compromises your personal data, we will:

• Notify affected users without undue delay, and no later than 72 hours after becoming aware of the breach where feasible.
• Notify the relevant supervisory authority (e.g., the lead EU data protection authority, Brazil's ANPD) as required by applicable law.
• Provide information about the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it.

If the breach is unlikely to result in a risk to your rights and freedoms, we may not be required to notify you directly under GDPR, but we will still take all necessary steps to mitigate the breach.

Data Retention

Your uploaded videos, edits, and assets are stored as long as your account is active. Exports are retained based on your plan tier:

• Hobby: 30 days
• Creator: 90 days
• Viral: 90 days

After export retention expires, exported files are automatically deleted from storage. Your project data (edits, settings) remains so you can re-export at any time.

If you cancel your subscription, your data is retained for 7 days. After that, projects may be archived and files scheduled for deletion. You can export or delete your data at any time before that.

After account deletion: We anonymize your personal information (name, username, profile data, OAuth IDs). Your email address is retained for up to 7 years for tax, legal, and compliance purposes, then permanently deleted. All associated files are scheduled for deletion within 30 days of account deletion.

Server logs (IP addresses, API request logs) are retained for 90 days, then automatically purged.

Your Rights

Regardless of where you're located, you can:

• Access your data through the app at any time — your projects, videos, exports, and account settings are all visible to you.
• Export your processed videos by downloading them.
• Delete individual projects, assets, and exports from within the app.
• Delete your account entirely from your account settings.
• Request a full data export by contacting us at privacy@sapari.io.

We respond to all verifiable data subject requests within 30 days. If your request is complex, we may extend this by an additional 30 days and will notify you of the extension.

EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have the following additional rights under the General Data Protection Regulation:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your personal data, subject to legal retention obligations.
• Right to restriction — request that we restrict processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests. We will stop processing unless we demonstrate compelling legitimate grounds.
• Right not to be subject to automated decision-making — Sapari uses AI to generate edit suggestions, but all suggestions are reviewed by you before export. No automated decisions with legal or similarly significant effects are made about you.

You also have the right to lodge a complaint with your local data protection supervisory authority.

Brazilian Residents (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) grants you the following rights:

• Confirmation of the existence of processing.
• Access to your data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Data portability to another service provider.
• Deletion of personal data processed with your consent.
• Information about public and private entities with which your data has been shared.
• Information about the possibility of not providing consent and the consequences thereof.
• Revocation of consent.

To exercise your rights, contact privacy@sapari.io. You may also file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act grant you the following rights:

• Right to know — what personal information we collect, use, disclose, and sell.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate personal information.
• Right to opt-out of sale/sharing — we do not sell or share your personal information as defined by the CCPA/CPRA. We do not use your data for cross-context behavioral advertising.
• Right to non-discrimination — we will not discriminate against you for exercising your rights.

Categories of personal information collected: identifiers (name, email, IP address), commercial information (subscription history, payment amounts), internet activity (API logs, feature usage), and audio/visual content (your uploaded videos).

We do not sell personal information. We share personal information with service providers (listed in the Third-Party Services section) solely to provide the service. To exercise your rights, contact privacy@sapari.io.

Email Communications

We send transactional emails only: account verification, password resets, and export notifications. We don't send marketing emails unless you explicitly opt in. We use Postmark for email delivery and track email delivery status (sent, delivered, opened) for reliability monitoring. You can't unsubscribe from transactional emails (they're required for the service to function), but we keep them minimal.

Children

Sapari is not intended for users under 16. We don't knowingly collect data from children. If we learn that a user is under 16 (or under the applicable age of consent in their jurisdiction), we will promptly delete their account and associated personal data. If you believe a child has created an account, contact us at privacy@sapari.io and we'll act immediately.

Changes to This Policy

If we make material changes, we'll notify you by email or through the app at least 30 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

Contact

General questions: hello@sapari.io

Data protection & privacy rights: privacy@sapari.io

Sapari @ Benav Labs LLC
A Delaware limited liability company
sapari.io