Privacy Policy

This policy explains what data SARAS (sarasflow.com, the "Service") collects, why we collect it, and what happens to it. The short version: we collect what's needed to run an account-based AI video service and nothing more — we don't run ad trackers, and we don't sell your data to anyone.

Account information. Username, email address, and a password (stored only as a cryptographic hash — we cannot see it). Email verification uses one-time codes sent to your address.

Content you create. Your prompts, generated scripts, narration audio, images, videos, and captions are stored so they appear in your project library.

Usage and security logs. Actions you take in the Service (generations, logins, file access) are logged with timestamps, and in some cases IP address and browser user-agent, for security, abuse prevention, and debugging.

Credits and payments. Your credit balance and transaction history. Card details are handled entirely by Stripe on their hosted checkout page — they never reach our servers.

Waitlist and blog subscriptions. If you join the waitlist or subscribe to the blog: name, email, and (optionally) phone number.

• To provide the Service: generating your content, keeping your library, metering credits.
• To secure it: verifying your email, preventing abuse and fraud, investigating problems.
• To communicate: verification codes, payment receipts, and — if you subscribed — new posts or product updates. No spam, and marketing email always has an unsubscribe.
• To improve the Service: reviewing errors and aggregate usage. We do not use your prompts or content to train AI models ourselves.

SARAS is built on established providers, each of which processes some of your data to make the Service work:

• Google (Gemini) — script writing, narration, and image generation: receives your prompts and scripts.
• OpenAI — image generation and audio transcription: receives image prompts and narration audio.
• Runware — image generation: receives image prompts.
• Stripe — payments: receives your payment details directly.
• Resend — email delivery: receives your email address.
• Supabase — our database (hosted in the United States).
• Cloudflare — storage for your generated media files.

Each provider handles data under its own privacy terms. We share only what each one needs to do its job, and we never sell your data or share it for advertising.

Your content stays in your library until you delete it — deleting a project removes its files. Account, transaction, and log data are retained while your account exists and as needed for security and legal compliance. To delete your account and associated data, email us at the address below and we will process the request.

We don't use advertising or tracking cookies. The Service stores your session and theme preference in your browser's local storage (saras_user, saras_theme) so you stay signed in and keep your dark/light choice. Signing out clears the session.

Passwords are hashed with bcrypt, all traffic is encrypted in transit (HTTPS), payment data never touches our servers, and account access is protected by email verification. No system is perfectly secure, but if we ever become aware of a breach affecting your data, we will notify you.

You can access your content and account data any time through your dashboard. You may request a copy of your data, correction of inaccurate data, or deletion of your account by emailing us. Depending on where you live (for example, the EU/EEA under GDPR or California under CCPA), you may have additional statutory rights — we honor reasonable requests regardless of jurisdiction.

The Service is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will delete it.

If this policy changes materially, we will notify registered users by email or an in-app notice before the changes take effect.

Privacy questions and requests: sarasmediateam@gmail.com