ScriptGrab

Privacy Policy

Last updated: 2026-10-12

ScriptGrab ("we", "us", "our") respects and protects your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use ScriptGrab — a tool that extracts spoken scripts and subtitles from public videos on TikTok, Instagram, Facebook and YouTube (the "Service") — and the rights you have under applicable law.

Please read this Policy carefully before using the Service. By using the Service, you acknowledge that you have read and agree to this Policy. We may update this Policy from time to time; material changes will be announced in advance on this page.

1. Data Controller

The data controller for the Service is:

2. Information We Collect

2.1 Information you provide

  • Account information: name, email address, and profile picture (via Google sign-in).
  • Payment information: transaction amount, payment status, and order records. We do not store full card numbers — card data is processed by our payment processor (see Section 5).
  • Communications: emails, support tickets, and feedback you send us.
  • Service inputs: the video URLs you submit and the transcripts/subtitle files generated for you (your task history).

2.2 Information we collect automatically

  • Device & network: IP address, device model, operating system, browser type, time zone.
  • Usage behavior: pages visited, features used, action logs, session duration.
  • Log data: request times, error logs, performance data.

2.3 Third-party sign-in

When you sign in with Google, we receive the basic profile information you authorize (name, email, profile picture) from Google.

2.4 Google user data (Limited Use)

If you choose to sign in with Google, the only Google data the Service accesses is your basic profile — your name, email address and profile picture — via the openid, email and profile OAuth scopes.

  • How we use it: solely to create your account, authenticate you on return visits, and display your name/avatar in your console.
  • What we never do: we do not access your Gmail, Drive, YouTube or any other Google service data; we do not sell Google user data; we do not use it for advertising; we do not use it to train AI/ML models; and no human reads it.
  • Sharing: Google user data is never transferred to third parties except as strictly required to provide the sign-in functionality itself, or where required by law.
  • Retention & deletion: retained while your account exists; deleted or anonymized within 90 days of account deletion, which you can request at any time via support@scriptgrab.com.

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

| Purpose | Legal basis | |---|---| | Provide and maintain the Service | Performance of contract | | Billing and payment processing | Performance of contract | | Customer support | Performance of contract / Legitimate interest | | Service notices (billing, security, policy updates) | Legitimate interest | | Security and fraud prevention | Legitimate interest | | Product improvement (based on server-side logs) | Legitimate interest | | Legal compliance | Legal obligation | | Marketing communications (if you opt in) | Your consent |

We may aggregate or de-identify data for statistical analysis. Such data cannot identify any individual.

4. Cookies & Tracking Technologies

| Type | Purpose | Can be disabled | |---|---|---| | Strictly necessary | Sign-in sessions, core functionality | No | | Functional | Language preference, personalization | Yes | | Analytics | Google Analytics usage measurement (_ga, _ga_*) | Yes |

We use Google Analytics 4 to understand aggregate site usage (pages visited, approximate region, device type). Google Analytics sets first-party cookies and processes data under Google's Privacy Policy and the Google Analytics terms; you can opt out with Google's browser add-on or by blocking analytics cookies. We do not use advertising trackers or sell usage data, and analytics data is never combined with your task inputs. You can adjust your cookie preferences through your browser settings, including blocking or deleting cookies.

5. Sharing & Disclosure

We do not sell your personal information, including any "sale" as defined by applicable law (such as the CCPA). We share your information only in the following circumstances:

  • Service providers: cloud hosting, payment, and customer support vendors bound by confidentiality obligations. Specifically:
    • Payment card data is processed exclusively by our PCI-DSS-compliant payment processor Waffo Pancake and is never stored on our servers.
    • Cloudflare provides hosting and content delivery.
    • Google provides sign-in (OAuth).
    • Groq processes audio for speech recognition when a transcript must be generated.
  • Legal and regulatory requirements: in response to law, court orders, or lawful requests from competent authorities.
  • Business transactions: in the event of a merger or acquisition, with prior notice and continuity of protection obligations.
  • With your consent: for other purposes with your explicit prior consent.

6. Data Security

  • Encryption in transit: TLS / HTTPS.
  • Storage security: we use third-party sign-in (Google OAuth) and do not store account passwords; sensitive data is encrypted where applicable.
  • Access control: least-privilege principle.
  • Infrastructure: hosted on Cloudflare with industry-standard protections.

If a security incident affecting your rights occurs, we will notify you and the relevant regulators within 72 hours of discovery, as required by law. Please keep your account credentials safe and do not share them.

7. Data Retention

| Data type | Retention period | Upon expiry | |---|---|---| | Account information | Duration of the account; 90 days after deletion | Deleted or anonymized | | Transaction records | As required by tax/accounting laws | Deleted or archived | | Support correspondence | 2 years | Securely deleted | | Security & audit logs | 12 months | Securely deleted | | Task history (URLs, transcripts) | Duration of the account | Deleted with the account |

8. Your Data Rights

To exercise any of the following rights, contact us at support@scriptgrab.com. We will respond within 30 calendar days.

| Right | Description | |---|---| | Right to be informed | Know what data we collect and how we use it | | Right of access | Obtain a copy of your personal information | | Right to rectification | Correct inaccurate or incomplete information | | Right to erasure | Request deletion of your data under certain conditions | | Right to restriction | Suspend processing in certain circumstances | | Right to data portability | Receive your data in a machine-readable format | | Right to object | Object to processing based on legitimate interest or for marketing | | Right to withdraw consent | Withdraw consent-based processing authorization |

If you believe we have not handled your request properly, you have the right to lodge a complaint with your local data protection authority.

9. Marketing Communications & Opt-out

With your consent, we may send you marketing information about product updates and offers by email. You may opt out at any time: click the "unsubscribe" link in any email, or contact us. Opting out does not affect essential service notices (such as billing and security alerts).

10. Cross-border Data Transfers

Our infrastructure and vendors are located in the United States and other jurisdictions (Cloudflare's global network, Google, Groq, Waffo Pancake). For cross-border transfers, we rely on safeguards such as:

  • Data processing agreements incorporating EU Standard Contractual Clauses (SCCs) where required.
  • Transfers only to recipients offering an equivalent level of protection.

11. Protection of Minors

The Service is intended for users aged 18 and above. We do not knowingly collect information from minors below that age. If you believe your child has provided us with information, please contact us immediately and we will delete it as soon as possible.

12. Third-party Links & Services

The Service may contain links to third-party sites or integrate with third-party services (including the video platforms you submit links from). This Policy applies only to information we collect directly. We are not responsible for the data practices of third parties; please review their policies before use.

13. Changes to This Policy

For material changes, we will notify you at least 15 days in advance via a notice on the Service, and update the "Last updated" date at the top of this page. Continued use after the effective date constitutes acceptance.

14. Contact Us

ScriptGrab · scriptgrab.com