Skip to content
DEMOVELA / 2026-10-11

Demovela privacy policy

Last updated: October 11, 2026. This policy explains how Demovela handles personal information on demovela.com, in the studio, and through its connected AI apps and MCP server. For privacy, access, correction or deletion requests, contact saeedmshdi@gmail.com.

Information we collect and why

  • Account and authentication information: your email address, account and workspace identifiers, sign-in verification records, session cookies and, when you choose Google sign-in, your Google account identifier. We use these to authenticate you, protect your workspace and associate saved work with your account.
  • Content you provide or create: website URLs, briefs, titles, template selections, chat instructions, uploaded files, screenshots, recordings, generated videos and related status, duration and timestamps. We use this information to prepare, store, display and revise the work you request.
  • Automated browser sessions: the public pages and product interfaces visited during a requested capture, screenshots and recordings, and temporary session email/login material needed for supported sign-in. A recording may contain information visible on the visited website. Use content and accounts you are authorised to share; avoid sensitive information in capture sessions.
  • Service and website usage: IP addresses and request metadata used by our hosting services, pages visited, referral and campaign information, interaction events, cookie/session identifiers, account or workspace identifiers, and verified email where our usage measurement is associated with a signed-in account. We use these to operate and secure the service, investigate failures, understand attribution and improve the product.
  • Billing and support: purchase references, credit balances and usage, payment status, contact details and messages you send us. These support payment fulfilment, accounting, support and abuse prevention. Card entry and payment processing take place with our payment provider.

Connected AI apps and MCP: inputs and outputs

Connecting ChatGPT, Claude or another MCP client creates a permission grant for that client. We store the client registration, requested scopes, account identifier and OAuth grant/token records to enforce your authorisation. The client receives only results available under the permissions you approve:

  • Account profile: your email address and workspace identifier.
  • Template catalogue: template identifiers, names, descriptions, supported formats and durations.
  • Saved videos and drafts: tool inputs include a video identifier or list offset. Outputs may include identifiers, titles, status, timestamps, draft briefs and template choices, duration, a studio URL and a private media URL. Private media links still require Demovela sign-in.
  • Save a draft: the client supplies a request identifier, title, brief and template identifier. We store these as a conversation in your workspace and return the draft identifier, status and review URL. This tool does not start recording, render a video, publish content or spend credits.

The connected client receives tool inputs and outputs as part of your conversation and handles them under its own privacy policy and account settings. Revoking access prevents future use of that grant; it does not erase copies already received by the client or delete drafts already saved in Demovela. We do not send your entire AI-client conversation to Demovela: we receive the arguments the client sends to our tools. MCP reads and draft saves do not call our video-generation providers.

Who receives information

Information is processed by Demovela and service providers needed for the features you use. These include Cloudflare for hosting, storage, authentication infrastructure and sign-in email; Daytona for temporary video-production execution; OpenRouter and the selected model providers for requested planning and generation; and Stripe for payments. Production requests can send website evidence, screenshots, briefs and relevant instructions to the planning/generation services. We do not intentionally include private login codes, raw sign-in emails, passwords or magic-link tokens in planning-model prompts.

We use Google Analytics, Matomo and DataFast for website and product measurement. Our email service handles account/onboarding messages and contact records; configured private Telegram notifications let the operator monitor registrations and purchases. These notifications can contain email, account identifiers and purchase details. Providers may process data in countries other than yours. Your chosen AI client, Google sign-in and websites you visit during a requested capture are separate services with their own privacy practices. Information may also be disclosed when necessary to comply with applicable law or address security incidents.

Storage and retention

Account records, saved conversations, draft briefs, original recordings and generated outputs currently remain stored without a fixed automatic deletion schedule so that you can reopen and revise your work. To request deletion, contact the address above and identify the account and work concerned. Billing, security or dispute records may need to be retained where applicable obligations require it; we do not promise immediate erasure of every provider log or backup.

Demovela account sessions expire after 30 days. Sign-in codes expire after five minutes. MCP consent requests expire after ten minutes, access tokens after one hour, and refresh tokens after 30 days; disconnection revokes the grant. Temporary capture login material is consumed or removed when its private inbox closes, and the temporary generated-password identity has a maximum two-hour expiry. Temporary execution environments are closed after their job. These limits do not delete your separately saved media or conversations.

The isolated marketplace-review account uses clearly labelled synthetic data and has no access to customer workspaces or production providers. Its sign-in session lasts one hour and its saved demo drafts expire after 24 hours.

Your choices and controls

Choose which clients to connect and which scopes to approve. View and revoke grants at connected MCP apps or connected automation apps. Sign out to end your browser session. You can ask us to provide, correct or delete information associated with your account, or object to a use of it, using the contact address above; we may need to verify ownership before acting. Your AI client's conversation deletion and data settings must be managed with that client. Browser privacy controls can limit measurement cookies and requests, although blocking essential session cookies can prevent sign-in.

Private content and public examples

Workspace media routes require account access. Copies intentionally published as public examples are accessible without sign-in. Saving a draft through an integration does not publish it. Review outputs before sharing them and do not put private credentials or third-party personal information into a public demo.

Policy changes

We update this page when our data practices change. The date above identifies this version. Contact us if a disclosure is unclear or you need help exercising a privacy request.