Legal
Privacy policy
Last updated
- Your music, clips and photos stay on your device. Videos are made in your browser. A finished video leaves it only when you post or schedule it.
- We store your account (email, name, a hashed password) and the text and settings of your projects.
- We use Google Analytics and PostHog to see how people find and use Razzle. No ads, no selling data.
- You can ask for a copy of your data or for it to be deleted at any time: write to [email protected].
01Who we are
Razzle (getrazzle.com) is operated by CaretLabs, Plot 72, Saket Bhusattva, Medchal, Hyderabad, Telangana, India (“we”, “us”). We decide how and why your personal data is used, so we are the data controller (the “data fiduciary” under India's Digital Personal Data Protection Act). Questions, requests and complaints: [email protected].
02What we collect and why
| What | Why | Legal basis (where GDPR applies) |
|---|---|---|
| Account: email address, display name, a bcrypt hash of your password | To create your account, log you in and keep it secure | Contract |
| Your work: team, project and folder names, a project's brief and look, and the text, settings and timing of your videos and carousels | To save your work and let your team open it | Contract |
| Review links: the text and settings of a shared video, and the names people add to versions | So the people you share a link with can review it | Contract |
| Posting: captions, schedules, posting results, the finished video or images, and for each connected Instagram account its handle, account id and access token (encrypted) | To publish what you ask us to, when you ask | Contract and your consent when you connect an account |
| AI chat (when it's switched on): your messages, the video's script and settings, and the project's brief if you pick a project | To draft and edit videos for you | Contract |
| Emails we send you: your address and the email's content (account verification, password reset, team invites) | To run your account | Contract |
| Usage: pages visited, the site that sent you, campaign tags, device and browser type, approximate location, and product events such as 'video exported' (settings and counts only, never your text or media) | To understand how people find and use Razzle and to improve it | Legitimate interests, or your consent where the law requires it (see Cookies) |
| IP address | To protect log-in, sign-up and the AI chat from abuse (rate limits held briefly in memory, not stored by us); our hosting and analytics providers also receive it | Legitimate interests |
We don't collect payment details (Razzle is free), and we never sell personal data or use it for advertising.
03What stays on your device
Music you add, background clips, photos and logos are stored in your browser (IndexedDB and local storage) and never sent to us. The free tools (Diwali wishes, text to video, BPM finder, beat detector, safe zone checker and the Instagram converter) work entirely in your browser: nothing you drop into them is uploaded. A video you make leaves your device only when you post or schedule it.
04Who we share it with
We use these providers to run Razzle. Each only gets what it needs, under its own terms and data protection commitments.
| Provider | What they do | What they receive |
|---|---|---|
| Vercel | Hosts the website and app | Requests to the site, including IP address |
| MongoDB (Atlas) | Database | Accounts, teams, projects, review links, posts |
| Cloudflare | DNS, file storage (R2) for videos you post, and the scheduler that publishes due posts | Posted files; requests to getrazzle.com |
| Meta (Instagram) | Publishes to Instagram accounts you connect | The post, its media and caption |
| Google (Analytics) | Visit and traffic analytics | Usage data, IP address (see Cookies) |
| PostHog | Product analytics | Product events and pages viewed, without cookies |
| Resend | Sends account emails | Your email address and the email |
| OpenAI or Anthropic | The AI chat, when it's switched on | Your chat messages, the video's script and settings, the project brief |
We may also share data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business (we'd tell you first).
05Where it's processed
Our providers process data in the United States, the European Union and other countries, which may be outside where you live. Where data leaves the EEA or UK, we rely on the providers' standard contractual clauses or equivalent safeguards. Transfers from India follow the DPDP Act and any countries the Indian government restricts.
06How long we keep it
| Data | Kept |
|---|---|
| Account and your work | Until you ask us to delete your account |
| Log-in session | 30 days, or until you log out |
| Verification and reset links | 24 hours and 1 hour; only a hash is stored |
| Files you post | 30 days on our storage, then deleted (the post stays on Instagram) |
| Review links | Deleted after 180 days without activity |
| Connected Instagram accounts | Until you disconnect them (tokens last at most 60 days unless refreshed) |
| Analytics | Up to 14 months, then aggregated or deleted |
07Your rights
Depending on where you live, you can ask to see, correct, delete or get a copy of your personal data, object to or restrict how it's used, and withdraw consent at any time (it doesn't affect what happened before). You can change your name and password in Settings, and disconnect an Instagram account from the project's settings. For anything else, including deleting your account, email [email protected] from the address on your account. We'll reply within 30 days. If you're in India, this address is also our grievance contact under the DPDP Act; you may complain to the Data Protection Board of India. In the EEA or UK you may complain to your data protection authority.
We honour Global Privacy Control: if your browser sends it, analytics stays off. Under California law we don't sell or share personal information.
08Security
Passwords are stored only as bcrypt hashes, sessions are signed, platform tokens are encrypted, and all traffic uses HTTPS. Upload links for posted files are signed and short-lived. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.
09Age
Razzle is for people aged 18 or over. We don't knowingly collect data from anyone younger; if you think we have, write to [email protected] and we'll delete it.
10Changes
We'll update this page when our practices change and change the date at the top. For significant changes we'll tell you by email or in the app first. See also our cookie notice and terms.