Privacy Policy

This policy explains how BRoll King ("we", "us") handles personal data in the BRoll King iPhone app, on brollking.com, and in the web application when it launches (together, the "Service").

The data controller is Canberk Sezer, Türkiye. Contact: support@brollking.com.

1. What we collect and why

Contact information — your email address

Collected when you create an account, and used to sign you in, to tie your credit balance to you, and to reply if you write to support. If you join a waitlist on this website, your email is stored in our own database for that announcement only, together with the country you signed up from, the page you signed up on, the site that sent you there and any campaign tags in the link, so we can see which channels bring people. If your browser sends Global Privacy Control or Do Not Track, only the email is stored. Every message includes an unsubscribe link.

User content — audio, transcripts and prompts

To produce a transcript, the app extracts the audio from your video and uploads it. The resulting transcript is used to plan B-roll, and short text derived from it is sent to AI providers as the description of the media to generate. This is the functional core of the product; without it there is no transcript, no plan and no B-roll.

Before an AI image or AI video is generated, its prompt is checked automatically against our content rules (no sexualised or adult content); generated images are checked the same way before they are delivered. The check sees only that prompt or image — never your video. A blocked prompt is not charged; a generated image or video that fails a content check is not delivered and its credits are refunded.

If you report an AI result or a problem from the app (Settings → Support), we receive only what you choose to send: the reason, your note, your account identifier and email address (so we can reply), the model that made the result and, for an AI result, a copy of that one image or video so we can review it. We use it to review the report and answer you, and for nothing else.

Purchases

Subscriptions and credit packs are sold and billed by Apple. We never see your card details or your Apple Account. When you buy or restore, the app sends us Apple's signed record of the transaction, and Apple notifies our server when a subscription renews, changes, lapses or is refunded. From these we keep: the product (plan and billing period), the subscription status and the date access runs until, Apple's transaction identifiers, and a ledger of your credit balance and what each job spent. Purchases made in the app carry a random account identifier so Apple's notifications can be matched to your BRoll King account.

Free credits and your iPhone (Apple DeviceCheck)

New accounts get free credits once per iPhone. To check this, the app asks Apple's DeviceCheck service for a one-time token and our server uses it to read and set a flag that Apple keeps for your device — just two on/off bits per device. We never receive or store a device identifier, and the flag says nothing about you or your account. It stays with the device (also after you delete your account), so free credits can't be collected again on the same iPhone.

Website visits — counted in aggregate, without cookies

When a page on brollking.com loads, a small script on the page sends our server which page it is, the name of the site that linked you here (for example google.com — the site name only, never the full link) or the fact that you came from another page of this site, and any campaign tags in the address (utm_source, utm_medium, utm_campaign). Our server adds the country your connection comes from, as reported by our host Cloudflare, and adds one to a daily counter for that combination. That counter is all we keep: no IP address, no browser details, no cookie or other identifier, and nothing that links one page view to another or to you. If your browser sends Global Privacy Control or Do Not Track, nothing is sent at all.

Basic technical data

Our servers log the ordinary technical facts needed to run and secure a service — request time, status and error information — and we record which tool ran and numeric details such as duration or count so we can see what is used. File names, sequence names and transcript text are not sent in that record.

2. What happens to your video

• Your full-resolution video is never uploaded. It stays on your device. Silence and loudness analysis, the cuts, the B-roll placement, drawing the captions (animated styles included) and the final render all happen locally. The face detection that aims the zooms also runs on the device; no face data is sent to our servers.
• Animated captions are drawn on your device. To charge them once per video, the app sends our server a one-way video key — a hash of the video's file name, size and date that can't be turned back into the name — and the style you picked, never the video. The key is kept with that charge in your credit ledger so re-rendering the same video isn't charged again.
• Only the extracted audio is uploaded, and only for transcription. It is stored in temporary object storage under a random identifier and deleted as soon as the transcription job finishes. As a backstop for jobs that break off half-way, the storage bucket also carries a rule that deletes anything left behind within one day.
• Generated B-roll (AI images, AI video, motion graphics) is produced on our servers and downloaded to your device; the temporary server copy is subject to the same one-day rule.
• We do not keep a library of your projects on our servers. If you delete a video from your device, it is gone — we have no copy to give you back.

3. What we never do

• We do not track you across other apps or websites, and we do not use the App Tracking Transparency identifier. There is no tracking in this app.
• We show no advertising and include no third-party advertising or analytics SDKs.
• This website sets no cookies and keeps no visitor identifiers; visits are only counted in aggregate (see What we collect).
• We do not sell or rent personal data, and we do not share it for advertising.
• We do not use your video, audio or transcripts to train AI models, and our providers are engaged on terms that do not permit training on your content.
• We do not build advertising profiles or infer anything about you from your footage.

4. How long we keep things

• Uploaded audio and generated media: deleted as soon as the job completes; anything orphaned is removed within one day by an automatic storage rule.
• Transcripts: returned to your device and stored there. We do not retain a copy after the job.
• Generation records: so you can recover AI clips you paid for if they never reached your device, we keep a small record of each paid generation (its type, model, prompt and job identifier) for up to 4 days (a daily cleanup removes it once it is 3 days old). It is also deleted when you delete your account.
• Reports you send: kept for up to 12 months as a record that we reviewed and answered them, then deleted automatically.
• Account email, subscription status and credit ledger: kept while your account exists, and deleted when you delete your account.
• Apple transaction identifiers of a subscription: when you delete your account, the record of the subscription itself (Apple's original transaction identifier, product and status) is kept without any link to you, so that the same Apple subscription cannot be used to collect welcome credits again on a new account. It contains no name, email or payment details.
• Purchase records: Apple keeps its own records of purchases under Apple's policies, independently of us.
• Waitlist emails (with the country, page, referring site and campaign tags recorded at sign-up): kept until you unsubscribe or ask us to remove you.
• Website visit counts: daily totals per page, referring site, country and campaign tag. They contain no personal data and are kept as statistics.
• Server logs: short-lived operational logs, retained only as long as needed to diagnose problems and keep the Service secure.

5. Who else processes data

We use a small number of providers to run the Service. Each one only receives what that step needs.

• Cloudflare — website and API hosting (it also tells our server which country a connection comes from, used for the visit counts and waitlist sign-ups), and the temporary object storage (R2) that holds uploaded audio and generated media.
• Supabase — accounts, authentication, the credit ledger, the website waitlist and the aggregate visit counts. Hosted in the European Union (Frankfurt).
• ElevenLabs — speech-to-text, and the instrumental background music you can add before export. For speech-to-text it receives the audio extracted from your video (never the video itself); for music it receives only the short style description you chose.
• AssemblyAI — backup speech-to-text, used only when ElevenLabs is unavailable. It then receives the same audio (never the video itself).
• Google (AI Studio) and Anthropic — planning the B-roll and generating images, video and motion-graphics designs. These receive transcript text and the short prompts derived from it, not your video. If one AI provider is temporarily unavailable, an equivalent model from another provider listed here does that job instead and receives the same data (for example, caption review or stock checks may then run on Google or Anthropic instead of OpenAI).
• OpenAI — reviewing a transcript for repeated takes (AI retake review), fixing misheard names and terms in your captions (AI caption review), writing the prompt or search term for a single B-roll moment when you tap Generate prompt, checking which stock result fits a B-roll moment, writing motion-graphics designs with a GPT model (the default for motion graphics), and checking AI image and video prompts (and generated images) against our content rules with its moderation service and a GPT model. It receives transcript text, search terms, short prompts, stock preview images and generated images, not your video or audio. We ask OpenAI not to store the GPT model requests (its moderation service has no such option).
• fal.ai — generates AI video clips and most AI images (the default GPT Image model runs there). It receives the short prompt for that clip, never your video or audio.
• HeyGen — renders motion-graphics animations in the cloud. It receives the generated animation markup only, never your video or audio.
• Pexels — stock photos and footage. It receives a search term, not your content.
• Apple — processes in-app purchases, provides Sign in with Apple, and keeps the DeviceCheck flag for the free credits (two bits per device, no identity).
• Resend — sends account emails (sign-up confirmation, password reset) from noreply@brollking.com. It receives your email address and the message.

6. Where data is processed

Account data is stored in the European Union (Frankfurt). Requests are served by Cloudflare's global network, and the AI and transcription providers listed above operate primarily in the United States, so audio and transcript text may be processed there. Those transfers rely on the providers' standard contractual clauses and equivalent safeguards.

7. Legal bases

Where the GDPR or the Turkish Personal Data Protection Law (KVKK) applies, we rely on:

• Performance of a contract — running your account, transcribing your audio, generating B-roll and tracking credits.
• Legitimate interests — keeping the Service secure, preventing abuse, understanding which features are used (via numeric, non-identifying records), and counting website visits in aggregate.
• Consent — joining a waitlist. You can withdraw it at any time by unsubscribing.
• Legal obligation — where we must keep records of transactions.

8. Your rights and deleting your account

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, object to or restrict processing, and lodge a complaint with your data protection authority (in Türkiye, the KVKK authority; in the EU, your national supervisory authority).

If you cannot reach the app, write to support@brollking.com from the address on the account and we will handle it. We reply within 30 days.

9. Children's privacy

BRoll King is rated 12+ and is not directed at children under 12. We do not knowingly collect personal data from children under 12. If you believe a child has created an account, write to support@brollking.com and we will delete it.

10. Security

Traffic is encrypted in transit with HTTPS. Uploads are addressed by unguessable random identifiers. API access requires a signed token tied to your account, and provider API keys are held as server-side secrets that never reach the app. No system is perfectly secure, but we keep the amount of data we hold small on purpose — the most effective protection for your footage is that we never receive it.

11. Changes to this policy

If we change what we collect or who processes it, we will update this page and change the date at the top. Material changes will be announced in the app or by email before they take effect.

12. Contact

Privacy questions, data requests and help with the app: support@brollking.com or the support page. The rules of use are in the terms of use.

BRoll King — operated by Canberk Sezer, Türkiye.