Privacy Policy

1. Overview and Scope

Subtile is a video editing and captioning tool for content creators. It is operated by YUKARI LABS SRL, a company registered in Belgium under enterprise/VAT number BE1033402366, with its registered office at Cantersteen 47, 1000 Brussels, Belgium. Subtile is accessible at https://app.subtile.ai (the "Service"). YUKARI LABS SRL is the controller of the personal data described in this Privacy Policy.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you disagree with any part of it, please do not use the Service.

2. Information We Collect

2.1 Account and authentication data

You can sign in with email and password, Google, or Twitch. We store your email and a password hash for email sign-in, and your provider account ID, name, email, and profile image for Google sign-in. Matching verified emails link sign-in methods to the same account. Resend receives your email address to deliver verification and password-reset codes. We do not store your password in plain text. When you authorize Subtile, Twitch shares, and we store: your Twitch user ID, login and display name, profile image, and (where you have granted it) your email address. We also store the OAuth access and refresh tokens issued by Twitch so the Service can call the Twitch API on your behalf in the features that work with Twitch, where your account has access to them (for example, to read the channels you follow and to fetch clip and VOD data). You can revoke this authorization at any time from your Twitch account's Connections settings.

2.2 Workflow and content data

Data you create or upload in the Service: your editing projects, captions and transcripts, drafts, settings, any media you upload, and the rendered outputs you produce. Where your account has access to the Twitch clip features (see 2.3), this also includes the boards you build, the streamers you add to them and your clip queue. This is stored in our database to provide the Service to you.

2.3 Twitch clip and VOD media

Some features work with Twitch clips and recorded broadcasts (VODs). They are not part of the standard Service at this time and are available to invited accounts only. Where you use them, the Service fetches clip media from Twitch through Twitch's official clip download, for channels that have authorized it (see section 5), and works on VOD recordings you upload. For a small number of invited accounts, it can also fetch the media of your own past broadcasts from Twitch. We process, and may store or cache, this media as needed to provide the features you use (such as preview, download, editing and rendering). We follow a data-minimization, least-privilege approach: we limit this media to what is needed for those features and restrict access to it.

2.4 Audio processed for subtitles

When you generate subtitles, the audio of the clip you are working on is sent to our speech-to-text provider for transcription and returned to you as captions. That extracted clip audio is processed for transcription only and is deleted as soon as the transcript is produced. Transcribing a full VOD (a feature for invited accounts, see 2.3) works differently: we first create an audio-only copy of the whole recording in our own storage and transcribe from there, so that copy is retained under the media retention rule in section 8 rather than deleted immediately.

2.5 Technical data

We automatically collect limited technical data: device and browser information, your IP address (used for rate limiting and abuse prevention and not stored as part of your profile), and error and diagnostic logs used to keep the Service reliable. When an error occurs, an error report is sent to our error-monitoring provider (Sentry) with the error, the page, your IP address, your browser details and, if you are signed in, your account id, email address and name. Analytics cookies are used only with your consent (see section 6).

2.6 Product usage and auto-reframe data

We keep first-party usage logs to operate and improve the Service. This includes logs of which automatic-reframe suggestion you accept or adjust when editing, which we use to improve the reframing feature. These logs are kept in our own database; we do not use a third-party advertising or cross-site tracking network.

2.7 Accounts and data moved from the previous Subtile platform

Subtile AI is operated by YUKARI LABS SRL. If you had an account on the previous Subtile platform (subtile.ai), we did not collect the data below through the Service: we moved it from that platform into the Service so that you can keep working with it. What we moved:

• Your account: email address, name, profile image, and your sign-in methods, including your existing password in hashed form (never in plain text) and the link to your Google sign-in
• Your projects, with their transcripts, captions and word timings
• Your subtitle presets
• Your files: the videos you uploaded and the videos you exported
• Your waitlist sign-up, if you joined the Subtile waitlist. We do not send marketing email based on it unless you confirm that you want updates.

We also keep a complete copy of the previous platform's data (a full database export and all stored files, including records such as billing history that the Service does not use) in a private, access-restricted archive on Cloudflare R2. The archive is not public and is not used to provide the Service. We keep it only to check that the move is complete and correct, to fix errors, and to restore anything that was missed. Section 8 explains how long it is kept, and section 9 how to have your data in it erased.

3. How We Use Your Data

We use the information we collect to:

• Provide, maintain and secure the Service
• Authenticate you and act on your behalf with Twitch as you direct
• Provide the editing, subtitle and rendering features and, where your account has access to them, aggregate and display clips for the boards you curate
• Prevent abuse, fraud and excessive automated requests
• Diagnose and fix problems and improve features such as automatic reframing
• Use eligible Free-plan creations in presentations, slideshows, demos, events and marketing for Subtile and other products and services developed or operated by YUKARI LABS SRL, including future products and services, under section 7 of our Terms of Use and subject to the safeguards and choices below. Paid-plan, earlier and migrated content requires separate permission.
• Use eligible Free-plan content and editing feedback for research and to develop, train, fine-tune, test and evaluate AI models and algorithms for Subtile and other products and services developed or operated by YUKARI LABS SRL, including future products and services, subject to the safeguards and choices below.
• Communicate essential Service notices and, unless you opt out, news about Subtile and other YUKARI LABS products that may interest you
• Comply with our legal obligations

Our commitment: We do not sell or rent your personal data or share it with unaffiliated third parties for their own marketing. We use it for the purposes described in this policy, including providing the Service and, where permitted, researching, developing and promoting Subtile and other YUKARI LABS products and services. Public examples may disclose content to their audiences as described below.

3.1 Free-plan content, research, AI improvement and promotion

On the Free plan, section 7 of our Terms of Use permits us to use eligible videos, audio, images, transcripts, captions, subtitle presets, projects, editing instructions, corrections and exports for research and to develop and improve Subtile and other products and services developed or operated by YUKARI LABS SRL, including future products and services. This includes AI training and evaluation and using examples in presentations, slideshows, demos, events and marketing. Training may involve review and labelling by authorised staff or contractors. Examples may be published on our websites, social media, app-store listings or in advertisements. These permissions apply only to content submitted or created on the Free plan after you have been informed of and accepted the updated Terms. Subject to mandatory law, maintaining the research and AI-improvement licence is a condition of continued editing and processing on the Free plan; presentation and marketing permission can be revoked separately.

We do not automatically include earlier content, content migrated from the previous Subtile platform or content submitted or created on a paid plan in these uses. Separate permission is required. Passwords, access tokens, payment details and the private migration archive are excluded. We will not intentionally select sensitive personal information or content featuring children. We minimise personal data in samples and remove identifying details where possible; removing an account identifier alone does not make a face, voice or transcript anonymous.

A general Free-plan content-training programme is not currently active. Before starting one, we will explain the processing and its lawful basis, provide a way to exercise your choices, and obtain separate consent where required. The automatic-reframing feedback described in section 2.6 is separate from this programme. Sending content to an AI provider to perform a feature you request is also separate from using it to train a model. The additional licence does not authorise providers to train their own models independently; our existing provider training opt-outs remain in place.

To revoke the research and AI-improvement licence or refuse or revoke presentation and marketing permission, for all or specific content, email contact@subtile.ai. Subject to mandatory law, revoking the research and AI-improvement licence means you cannot continue editing or processing on the Free plan: you must upgrade to an available paid plan or stop using Free and close your account, with the opportunity to export your projects first. Revoking presentation and marketing permission alone does not end Free-plan access. Subject to the existing-materials exception below, we will stop new uses covered by your revocation and remove affected source samples from active datasets and presentation or marketing materials under our control within 30 days, or sooner if required by law. We do not automatically charge you or delete your account because you make a request. Your statutory GDPR rights are separate: you can exercise them without payment, withdraw consent at any time where we rely on it, and object to legitimate-interest processing as described in section 9. We assess those requests independently, and the Free-plan condition does not apply where mandatory law requires us to continue providing access.

Upgrading to a paid plan or closing your account does not automatically revoke the licences granted for earlier eligible Free-plan content; you can revoke them separately. After a separate revocation, the contractual licence may continue, to the extent permitted by law, for publications already released and presentations, slideshows, demos, event materials or campaigns already prepared or contractually committed before we receive it. Those specific materials may be used for the originally planned publication, event or campaign until it is discontinued or completed, but revoked content cannot be used in a new event, campaign or materially different purpose. This exception preserves content-licence rights only; it does not provide a GDPR lawful basis or override a valid withdrawal of consent, an applicable objection or erasure right, or an obligation to remove unlawful content. If data-protection law requires processing or display to stop, we must comply even where a presentation is already prepared.

The content licence in our Terms concerns permission to use the content; it is not itself a GDPR lawful basis. Before using personal data for research, training, presentations or marketing, we must establish a separate valid lawful basis for the specific purpose. A general licence for future products does not itself authorise undisclosed personal-data processing: we will explain materially different purposes and obtain fresh consent where required before beginning them. We use legitimate interests only where a documented assessment establishes necessity and that those interests are not overridden by the affected person's rights and interests. Where consent is required, it must be specific, informed, freely given and separately obtained.

4. Lawful Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following lawful bases:

5. Twitch Data and Third-Party Content

Twitch is one of the ways to sign in, and some features of Subtile, available to invited accounts only at this time, work with content on Twitch. Twitch data is subject to Twitch's own terms and privacy notice. Clips and VODs are the content of Twitch and the respective streamers and rights-holders; Subtile does not own this content.

How the Service reaches Twitch:

• Signing in with Twitch gives us your Twitch identity (user ID, username, email address, profile picture) and the Twitch permission we use to list your own past broadcasts. It does not give us access to clips.
• Public channel and clip information (channel names, clip titles, view counts, thumbnails, live status) is read from the Twitch API with the credentials of our own application, not with your account.
• Downloading or editing a clip uses Twitch's official clip download. It works only when the streamer of that channel, or one of the channel's editors, has connected their Twitch account to Subtile for clips. We ask for this separate permission the first time you download or edit a clip. We then store that Twitch account's ID and username, the access tokens, the permissions granted and the date. When a streamer has connected their channel, their authorization is also used when other Subtile users download or edit clips of that channel.
• VODs are processed from the recording you upload. For a small number of invited accounts, the Service can fetch the media of the account's own past broadcasts from Twitch. Twitch has no official interface for this, so that fetch uses the same public playback endpoints as the Twitch player, without your Twitch credentials.
• Your confirmation of rights: before your first download or import we ask you to confirm that you own the content or have permission to use it. We store that you confirmed, when, and which version of the statement.

You can revoke the access you granted at any time from your Twitch account settings (Connections). The Service can then no longer act with that authorization. The next time it tries and Twitch refuses, we delete the stored clip authorization and the copies of your full broadcasts that we made from Twitch. If you are a streamer or a rights holder and want content removed or your channel blocked, use the report form. A report stores the name, email address and message you send, so that we can handle it and keep a record of it.

6. Cookies and Local Storage

Necessary. Cookies and local storage that keep you signed in, protect the Service against abuse and remember your cookie choice. They need no consent. To prevent abuse we also limit requests per account, per email address and per IP address (the address is turned into a keyed hash for this and not stored as such).

Only with your consent: analytics. PostHog cookies that measure which pages and features are used, linked to your account, so we know what to improve. The banner shown on your first visit asks for it, with "Refuse all" and "Accept all" side by side; refusing changes nothing else in the Service and sets none of these cookies. You can change or withdraw your choice at any time, in one click, in Cookie settings (at the bottom of every page and in Settings). The Cookies page lists every cookie we use, who sets it, why and for how long. Withdrawing deletes the analytics cookies already placed. We keep your choice for 6 months, then ask again, and keep a record of it to be able to show that consent was given. We do not record sessions, and we do not use advertising cookies or third-party cross-site tracking.

One exception, stated plainly. When you export a video in your browser, the rendering toolkit we use (Remotion) sends one usage event from your browser to www.remotion.pro. It contains only our hostname, our licence identifier, and whether the export was a still and whether it succeeded: no cookie, no identifier for you, and none of your media, which stays on your device during a browser export. Cloud rendering, where it is available to your account, is described with our render hosts in section 7. This event is how the toolkit is licensed. We consider this a licence-metering call rather than tracking, but it is a request to a third party that your browser makes, so we name it here rather than leave it out.

Third-party assets. Some features load files directly from third-party hosts: web fonts from Google Fonts, and, whenever you use automatic reframing, the on-device detection model from jsDelivr and Google Cloud Storage. Larger optional detection models come from Hugging Face. Those hosts necessarily see your IP address and browser user agent, as any host you request a file from does. They receive no account data and none of your media: the detection itself runs on your device, on video that never leaves it.

7. Service Providers (Subprocessors)

We rely on service providers that process data on our behalf under appropriate confidentiality and data-protection terms. Every third party our systems send anything to is named below, with what it is for, including the one that receives no personal data or media at all, so that the list is complete rather than flattering:

• Convex: database and backend that stores your account, projects, workflow data and logs. Privacy policy
• Vercel: application hosting, content delivery, and the server-side functions that process your media. Where cloud rendering is available to your account and you choose it, an export can also run in a Vercel Sandbox, which reads your project's media and passes the finished video through private Vercel Blob storage on its way to our own storage. Privacy policy
• Cloudflare: object storage and CDN delivery for uploaded, clip and VOD media. Privacy policy
• Twitch: optional Twitch sign-in, and the source platform for the features that work with Twitch clips and VODs; we call Twitch on your behalf as you direct. Privacy notice
• Resend: delivery of account verification and password-reset emails. Privacy policy
• Deepgram: speech-to-text transcription of the audio of your videos for subtitles. Privacy policy
• OpenRouter: routes most of our AI requests (transcript text and video frames) to the model providers that run them. Privacy policy
• Google: optional Google sign-in, and AI-assisted editing features using Gemini models (reached through OpenRouter). Privacy policy
• Anthropic: AI-assisted clip selection using Claude models, called directly rather than through OpenRouter. Privacy policy
• OpenAI: AI-assisted editing features, including the camera detection that sends frames from your clip (reached through OpenRouter), and fallback speech-to-text transcription. Privacy policy
• Apify: resolves download links for third-party video URLs you paste (TikTok, Instagram, YouTube). Privacy policy
• Remotion: the video-rendering toolkit used to export your videos. No media is sent to Remotion: an export in your browser renders on your device, and a cloud render runs on our own render hosts listed here (Vercel, Amazon Web Services, Modal), not on Remotion's servers. Their toolkit sends them one usage event per browser export (see section 6), and a cloud render can send one from our render host once we use a paid licence key. Privacy policy
• PostHog: product analytics, in its EU region: page and feature usage only with your consent (cookie settings), and, reported by our servers, the settings, duration and outcome of each export, linked to your account id. Privacy policy
• Sentry: error monitoring, in its EU region: when something breaks, a report of the error, the page, your IP address, browser details and, if you are signed in, your account id, email and name. It sets no cookie. Privacy policy
• Amazon Web Services: AWS Lambda and Amazon S3 in the EU (Ireland), used for cloud rendering. Where cloud rendering is available to your account and you choose it, an export can run there: it reads your project's media, and the finished video is kept in a private bucket for at most one day while it is copied to our own storage. Privacy policy
• Modal: compute hosting for cloud rendering. Where cloud rendering is available to your account and you choose it, an export can run there: it reads your project's media and writes the finished video straight to our own storage. Modal also hosts an optional camera-detection model, which is currently disabled. Privacy policy

Business transfers. If YUKARI LABS SRL, or the part of its business that runs the Service, is merged, acquired or transferred, personal data may be transferred to the successor. The successor must keep protecting it as this Privacy Policy describes, and we will tell you before your data becomes subject to a different privacy policy.

8. Data Retention

• Account and workflow data: kept for the life of your account. In Settings, you can choose “Erase now” to start permanent erasure without a recovery period, or explicitly choose a 30-day recovery period. Both choices deactivate access and stop new account-based editing and processing immediately. During recovery, the recoverable account copy is retained only to restore your account. Sign in and select “Restore account” before the displayed deadline; signing in alone does not cancel closure. Erasure starts automatically when that deadline passes. Any separate research samples or published or prepared presentation and marketing materials follow the limited rules below. A surviving content licence does not authorise retaining personal data contrary to an applicable erasure request or another data-protection obligation.
• Clip / VOD media: stored or cached for as long as needed to provide the features you use, and kept no longer than necessary for those purposes.
• Subtitle audio: clip audio extracted for transcription is deleted once the transcript is produced. The audio-only copy of a full VOD is media, and follows the media rule above (currently up to 30 days after you last use it, and sooner if you never do).
• Technical / diagnostic logs: typically retained for around 90 days.
• Product-usage and auto-reframe logs: retained in pseudonymized form to improve the Service.
• Free-plan research and training samples, if the programme is introduced: kept only as long as needed for the disclosed research, training or evaluation purpose. Upgrading to a paid plan or closing an account does not automatically revoke the licence for earlier eligible Free-plan content or extend its necessary retention period. After a separate revocation, affected source samples are removed from active datasets within 30 days, subject to shorter legal deadlines and statutory rights. Genuinely anonymous aggregate statistics and model improvements may be retained only if they no longer identify anyone or allow source content or personal data to be recovered; pseudonymized samples remain personal data.
• Creations used in presentations, events and marketing: kept while the applicable permission and lawful basis remain valid. Upgrading or closing an account does not automatically revoke the licence for earlier eligible Free-plan content. After a separate revocation, we stop new uses and remove affected content from materials under our control within 30 days, except that already released publications and materials already prepared or contractually committed may remain for the originally planned publication, event or campaign until it is discontinued or completed, as explained in section 3.1. This exception is subject to data-protection, image and other statutory rights; shorter legal deadlines take priority. Printed materials already distributed and copies independently shared by others may be outside our control.
• Private migration archive: the copy of the previous Subtile platform's data (section 2.7) is kept only as long as needed to check and correct the move, and never longer than 12 months after it. It is then deleted. Your part of it is erased sooner if you ask us (section 9).
• Payment records: if and when paid plans are introduced, retained as required by Belgian tax law (currently 7 years for accounting records).

9. Your Privacy Rights

Under the GDPR and applicable Belgian data-protection law, you have the right to:

• Access your personal data
• Correct inaccurate information
• Request erasure of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Opt out of marketing communications, and withdraw consent where processing is based on consent

How to exercise your rights: You can close your Subtile account from Settings, choosing optional 30-day recovery or “Erase now”. Permanent erasure runs in the background, including stored media and CDN copies; existing uploads and processing requests must finish or expire before the final cleanup. For erasure requests, other privacy rights, or help with a pending request, email contact@subtile.ai and we will respond without undue delay, normally within one month. You can opt out of non-essential marketing at any time via the unsubscribe link or the same email, and you can revoke the Service's access to your Twitch account at any time from Twitch's Connections settings.

Accounts moved from Subtile: the same rights apply. You can close an imported account from Settings as described above, which erases it from the Service. You can also ask for deletion by emailing contact@subtile.ai from the address on the account. When you ask by email, we erase your data from the Service and from the private migration archive, and we will not import it again.

Right to lodge a complaint: If you believe our processing of your personal data infringes the GDPR, you may lodge a complaint with the Belgian Data Protection Authority:

Autorité de protection des données (APD) / Gegevensbeschermingsautoriteit (GBA)
Rue de la Presse 35, 1000 Brussels, Belgium
Phone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Website: www.dataprotectionauthority.be

10. Data Security

• Encryption of data in transit and at rest
• Access controls and authentication
• Rate limiting and abuse prevention
• Monitoring for suspicious activity
• Least-privilege handling of Twitch OAuth tokens

11. International Data Transfers

We are based in Belgium and operate under EU law. Some of our service providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data.

12. Age Restrictions

Subtile is not directed to individuals under 18, and we do not knowingly collect data from them. If we learn we have, we will delete it.

13. Changes to This Policy

We may update this Privacy Policy for operational, legal or regulatory reasons. We will post the updated policy here and revise the "Last Updated" date. Material changes will be communicated through the Service where appropriate.

14. Contact Information

For privacy-related inquiries or to exercise your rights, contact:

YUKARI LABS SRL
Cantersteen 47, 1000 Brussels, Belgium
Enterprise/VAT number: BE1033402366
Email: contact@subtile.ai