Privacy Policy
Effective: October 21, 2026
This policy explains what Zaption collects, why, who else sees it, and how long we keep it. "We" means Lily Living LLC, 1721 N 1200 E, Lehi, UT 84043, USA. Questions go to [email protected].
The short version
- We collect your email address, the videos you give us, the captions we make, and a few technical details we need to run the service and stop abuse.
- We don't sell your information and we don't show ads.
- Your video's audio goes to Microsoft's Azure speech service, which makes the transcript.
- We never use your videos, audio, or transcripts to train any AI model.
- We delete your videos and captions automatically, 24 hours or 7 days after they're made, depending on your plan. See "How long we keep it" below.
- To delete your account, email [email protected].
What we collect
Your account. Your email address, when you made the account, and when you last signed in. If you came to Zaption from one of our ads or posts, its link has tags like utm_source=reddit in it. We save those tags with your new account, so we know which ads and posts bring people in.
Your videos and captions. The videos you upload, or the links you give us through the API. Each video's file name and details like its length, size, and resolution. The language and key terms you set, the transcript with the timing of each word, your edits, the style you pick, and the looks you save to My styles. The files we make for you: the captioned video, the SRT and VTT subtitle files, and the JSON file with word timings.
API keys. Each key's name, whether it's live or test, its first few characters, and when it was last used. We never store the key itself, only a one-way hash of it.
Webhooks. If you give us a webhook URL, we keep it with the caption. We also keep a record of each event we send there: what it said, whether it arrived, and how many tries it took.
Billing. Your plan and when it renews, your credit balance and each change to it (purchases, use, and refunds), and usage records: how many seconds each caption used, what it cost, and how it was paid. We also keep the id Stripe gives your account. Stripe handles your card, and we never see your full card number.
Suspensions. If we suspend an account for breaking our terms, we keep the reason and a one-way hash of its email address, so the address can't start a new account.
Technical details.
- Your IP address. For rate limits and sign-up limits we store only a hash of it, made with a secret key, not the address itself. Our server logs do keep the plain address for a short time.
- Cloudflare's bot check looks at your IP address and some details about your browser when you sign in.
Cookies. We use two, and both are needed to sign in:
zap_sessionkeeps you signed in, for up to 30 days. Scripts on our pages can't read it.zap_csrfprotects your account from forged requests, for up to 30 days.
Cloudflare's bot check may set its own cookie when you sign in. We don't use advertising or analytics cookies, and we don't use any third-party trackers. The ad tags above wait in your browser tab's session storage until you ask for a sign-in link, and go away when you close the tab.
How we use it
- To run the service: sign you in, make your transcripts and captions, and send you your files.
- To send you email: sign-in links and notices about your account. We don't send marketing email.
- To bill you for plans and credits, and to keep the records tax law requires.
- To see which of our ads and posts work, by counting new accounts for each tag. We don't share this with ad networks.
- To prevent abuse and fraud: limits on free minutes, sign-ups, and requests, and the bot check.
- To keep costs in check, so free minutes stay possible.
- To understand how the product is used, from counts and totals.
Training
We don't use your videos, audio, or transcripts to train any AI model, ours or anyone else's. We don't sell them or share them for that. Microsoft gets your video's audio only to make your transcript. Under Microsoft's terms for Azure, it doesn't use that audio to train its models.
Who else sees your information
We share information only with companies that help us run the service, and only what each one needs:
| Company | What it does | What it gets |
|---|---|---|
| Microsoft (Azure AI Speech, with the MAI-Transcribe-2 model) | Makes the transcript from your video's audio | The audio track of your video, and the language and key terms you set. Under Microsoft's terms for Azure, it doesn't use the audio to train its models. |
| Cloudflare | Runs our DNS, protects the site, and runs the bot check on sign-in | All traffic to the site, including your IP address and browser details |
| Cloudflare (R2) | Stores uploaded videos, the files we make, and our backups | Your videos and the files we make from them, and copies of our database, which are encrypted |
| Stripe | Handles payments, subscriptions, and the billing portal | Your name, email address, card details, and billing address. We never see your full card number. |
| Resend | Sends our emails | Your email address and the email we send |
| Contabo | Hosts the server that runs Zaption, in the USA | Everything in our database, and your videos and files while we work on them |
We don't sell your information or share it for advertising.
If you give us a webhook URL, we send caption events to that address, which you control.
We may also share information if the law requires it, to protect people's safety, or to protect our rights. If the company is sold or merged, your information would go to the new owner under this policy.
How long we keep it
| What | How long |
|---|---|
| Your account, API keys, plan, and credit balance | Until your account is deleted |
| Videos you upload but never make a caption from | 24 hours |
| A caption's video, transcript, and files, made in the web app on the free Spark plan or with a test API key | 24 hours after the caption is made |
| A caption's video, transcript, and files, made in the web app on a paid plan or with a live API key | 7 days after the caption is made |
| A caption you delete | Its video, transcript, and files are deleted right away |
| A short record of a deleted or expired caption (its id, file name, and status, with no video and no transcript) | 30 days, then it's removed |
| Download links | They stop working after 1 hour |
| Sign-in links | They stop working after 15 minutes. The record is removed a day later |
| Sessions | 30 days from when you sign in |
| Copies of API responses, so a retried request isn't run twice | 24 hours |
| Records of webhook events | 30 days |
| Rate limit counters | About a day after last use |
| Sign-up counters (hashed IP addresses) | 7 days |
| A suspended address (a one-way hash) and the reason | Until the suspension ends, even after the account is deleted |
| Billing records, including usage records (seconds used, cost, and which caption) | As long as tax law requires, even after the account is deleted |
| Backups (encrypted copies of the database) | 14 days |
| Server logs with IP addresses | Until newer logs replace them, usually within days. We keep a fixed amount for each part of our system, so how long depends on traffic |
Deleting your account
You can't delete your account in the app yet. Email [email protected] from the address on your account and ask us to delete it. We delete the account and its data within 30 days, including any captions and files still kept, your API keys, and your sessions. Copies in backups are gone within 14 days after that.
A few things stay after a deletion, as the table above says: billing records, a suspension if the account had one, short-lived counters, and server logs until they're overwritten. Stripe keeps its own records of your payments under its own privacy policy.
Your rights
You can:
- see your captions and download your files in the app, while we keep them
- ask us for a copy of the information we have about you
- ask us to fix information that's wrong
- ask us to delete your account
Depending on where you live, you may have more rights, like objecting to how we use your information or complaining to a data protection authority. To use any of these rights, email [email protected]. We'll answer within 30 days.
Where your information is stored
Our server is in the USA. Uploaded videos, the files we make, and our backups are stored in Cloudflare R2. Some of the companies above may process your information in the United States or other countries.
Security
We store API keys, sign-in links, and sessions only as one-way hashes. Download links stop working after an hour. All traffic uses HTTPS, and backups are encrypted. No system is perfectly secure, so we can't promise nothing will ever go wrong. If a breach affects you, we'll tell you as the law requires.
Children
Zaption isn't for children under 13. We don't knowingly collect information from them. If you think a child has made an account, email [email protected] and we'll delete it.
Changes
If we change this policy in a way that matters, we'll email you or show a notice in the app before the change takes effect. The date at the top shows the latest version.
Contact
Write to Lily Living LLC, 1721 N 1200 E, Lehi, UT 84043, USA, or email [email protected].