1. Who we are
MwareX is an AI video editing and publishing service for creators, operated from India by its founder, Samay Samrat (“MwareX”, “we”, “us”). We decide how and why your personal data is processed, so we are responsible for it (the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, and the “controller” under laws such as the GDPR).
This policy covers mwarex.in, the MwareX web app and the emails we send. “You” means anyone who visits or uses them. “Content” means the videos, audio, images and text you upload, import or create in MwareX.
The short version
- We use your data only to provide MwareX to you. We do not sell it or use it for advertising.
- Data from Google APIs is handled under Google’s Limited Use requirements (section 5).
- We do not use your Content to train AI models.
- You can disconnect YouTube or Instagram at any time, and ask us to delete all your data.
2. Information we collect
Information you give us
- Account details
- Your name and email address, and a password if you sign up with email (stored only as a secure hash). If you sign in with Google, your Google name, email address and profile picture.
- Content
- Videos you upload or import from a link, and what MwareX makes from them: transcripts, clips, captions, edits, renders, Motion Design projects, post text and thumbnails.
- Settings and messages
- Your preferences (such as caption styles and reminder settings), what you type or say to the assistant, and messages you send to support.
- Payments
- When you buy a plan, Razorpay processes the payment. We receive and keep the order and payment IDs, plan, amount, currency, status and date. Your card, UPI or bank details go to Razorpay and are never stored by MwareX.
Information from connected accounts
If you connect YouTube or Instagram, we receive the data described in Google and YouTube data and Instagram data, and only with your permission.
Information collected automatically
- Usage records
- What you do in the app that counts towards your plan (analysis minutes, clips, exports, AI actions, publishes), processing jobs and their status, and records of each AI request (feature, size and cost) for billing, fair use and abuse prevention.
- Device identifier
- A random identifier stored in your browser (see Cookies and local storage), used to keep the Free plan and trial to one per person.
- IP address
- Used when you visit to decide whether prices are shown in INR or USD (looked up on our own servers), and to protect the Free plan and trial from abuse. We do not store your IP address in readable form: abuse checks keep only a keyed hash of it.
- Technical logs
- Server logs of requests and errors, used to keep the Service running and secure.
3. How we use your information
We use your data only to provide and protect MwareX:
- to create your account and sign you in, including with Google Sign-In;
- to transcribe, analyse and edit your videos with AI (transcripts, scenes, clips, captions, B-roll, translations);
- to upload videos you choose to publish to your YouTube channel or Instagram account, with the title, description, privacy and other settings you pick;
- to show your channel insights (CreatorDNA) and run the assistant;
- to process payments, apply your plan and measure usage against your allowance;
- to send service emails: password reset codes, trial notices, the Consistency Challenge reminders you set up, and replies to support requests;
- to prevent abuse and fraud, keep the Free plan to one per person, and keep the Service secure;
- to comply with the law.
We do not sell your personal data, we do not use it for advertising, and we do not use your Content to train AI models.
4. Legal bases
Where data protection law asks for a legal basis (for example the GDPR, or India’s DPDP Act, which relies mainly on consent and certain legitimate uses), we rely on:
- Contract
- Processing needed to provide the Service you signed up for, such as storing and editing your videos and applying your plan.
- Consent
- Connecting Google, YouTube or Instagram, using the microphone with the assistant, and optional emails. You can withdraw consent at any time (see Your rights and choices).
- Legitimate interests
- Keeping MwareX secure, preventing abuse of the Free plan and trial, and fixing problems, balanced against your rights.
- Legal obligation
- Keeping payment records for tax and accounting, and responding to lawful requests.
5. Google and YouTube data
MwareX uses YouTube API Services. By connecting your YouTube account to MwareX you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.
Limited Use disclosure
MwareX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Permissions we ask for
When you sign in with Google, MwareX asks only for your name, email address and profile picture. When you connect your YouTube channel (to publish from MwareX, or for CreatorDNA), it also asks for the two YouTube permissions below. You can untick either of them; only the matching feature stops working.
- Your name, email and profile picture
openid,userinfo.profile,userinfo.email: to create and sign in to your MwareX account.- Upload videos
youtube.upload: to upload a clip or video to your channel only when you press Publish or schedule a post in MwareX.- View YouTube Analytics reports
yt-analytics.readonly: to read watch time, retention (including the moments viewers stop watching), traffic sources, the search terms that find your videos, and subscribers gained and lost, for CreatorDNA insights, and to tell which YouTube channel is yours (the videos your own Analytics lists). Read only.
MwareX does not ask to view or manage your YouTube account. For CreatorDNA it reads your channel’s public information (its name, picture and subscriber count, your public videos’ titles, descriptions, thumbnails, durations, publish dates and public view, like and comment counts, and the top public comments on your latest videos) through the YouTube Data API with MwareX’s own API key, exactly as anyone can see it on YouTube. If MwareX can’t tell your channel from YouTube Analytics yet (a new channel), it asks you for your channel link once and checks it against your Analytics.
How we use, store and share it
- Google user data is used only to provide the features above to you, which you can see in the app.
- Google access and refresh tokens are stored encrypted (AES-256-GCM) on our servers and are never shown to anyone, logged or sold.
- Channel and video data is stored with your account to draw your CreatorDNA dashboard. While your channel is connected it is refreshed automatically about once a day (and whenever you press Sync), and anything that has not been refreshed for 30 days is deleted automatically.
- Comments are read only to summarise what your audience asks for. We do not store the comments themselves or who wrote them: we keep the grouped themes with at most two short example comments each, and delete them within 30 days.
- We do not share YouTube data with third parties, except that CreatorDNA sends what it summarises (statistics, retention moments, transcript lines of your own videos and comment text, never your tokens or commenters’ names) to our AI provider, Anthropic, to write your report and insights. Under its commercial terms Anthropic does not train models on it.
- We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalised AI or machine-learning models.
- People at MwareX do not read your Google user data, except with your permission (for example when you ask for support), when needed for security or to comply with the law.
Revoking access and deleting your data
You can remove MwareX’s access to your Google account at any time on the Google security settings page (Third-party apps with account access), also reachable at security.google.com/settings/security/permissions. Once access is revoked, MwareX can no longer read or refresh your YouTube data. When MwareX finds that its access has stopped working, it deletes the YouTube data it stored for you within 7 days, unless you reconnect, and removes the connection itself after 30 days.
You can also disconnect your channel in MwareX (CreatorDNA, then Disconnect). This revokes MwareX’s access and deletes the channel data we stored straight away. To have all of your data deleted, email us at founder.samay@gmail.com; we delete it within 7 days of your request.
6. Instagram data
If you connect an Instagram professional (Business or Creator) account, MwareX uses the Instagram API with Instagram Login with two permissions:
instagram_business_basic- Your username, name, account type, profile picture, follower and post counts, and a list of your recent posts (post ID, type, link, time and the start of the caption). We use it to show which account is connected and to mark the days you posted in the Consistency Challenge.
instagram_business_content_publish- To publish a Reel to your account only when you press Publish in MwareX, with the caption, cover frame and feed setting you chose.
Your Instagram access token is stored encrypted and is never shared. We do not sell Instagram data or use it for advertising.
Deleting Instagram data
- Disconnect Instagram in Settings, then Integrations: we delete the token and the posts we read immediately.
- Or remove MwareX in Instagram under Settings, Website permissions, Apps and websites. Meta then sends us a deletion request, and we delete all Instagram data we hold for your account and give you a confirmation code.
- You can also email us at founder.samay@gmail.com to request deletion.
7. Voice assistant
The in-app assistant, Demi, can listen when you press its microphone button (or hold Space while it is open). Your recording is sent to our speech-to-text provider, Groq, to turn it into text, and is not stored by MwareX: it is held only in memory for that request and then discarded. Your browser may also show a live preview of your words using its own speech recognition.
The text of what you say or type, with the page you are on and the names and details of your own videos and clips that the assistant looks up, is sent to our AI provider, Anthropic, to understand the request and reply. Under its commercial terms Anthropic does not train models on it. The last few messages of a conversation are kept for up to 30 minutes so follow-up questions work, then deleted.
Spoken replies are generated from the reply text by our own voice engine on our servers (or, where we have switched it on, by ElevenLabs); no audio of you is sent for this, and you can mute spoken replies. The assistant never uses more of your plan, publishes or schedules anything without your confirmation.
9. International transfers
MwareX is run from India. Our servers and database are in Sydney, Australia, uploaded media is stored in the United States, and several of our service providers process data in the United States and other countries. This means your data is transferred outside the country where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the providers’ standard contractual terms, and we follow any restrictions the Government of India places on transfers under the DPDP Act.
10. How long we keep data
We keep data only as long as needed to provide the features you use, then delete it.
- Account and Content
- For as long as your account exists. When you ask us to delete your account, we delete your account data, Content and files within 7 days of your request.
- Videos and clips you delete
- Deleting a video removes it, its clips and its analysis from your account. The uploaded and rendered files can remain in our private storage until you ask us to erase them, which we do within 7 days of your request.
- YouTube data and Google tokens
- Channel, video, analytics and comment-summary data is refreshed automatically about once a day while your channel is connected, and never kept for more than 30 days without a refresh: older data, and CreatorDNA reports older than 30 days, are deleted automatically. If MwareX’s access stops working (for example because you revoked it at Google), the data is deleted within 7 days and the connection, including its tokens, after 30 days. Disconnecting your channel in MwareX deletes all of it immediately.
- Instagram data
- Until you disconnect Instagram or Meta sends us a deletion request (deleted immediately). Records of Meta deletion requests (the confirmation code) are kept for 90 days.
- Assistant
- Voice recordings are not stored. The last few messages of a conversation are kept for up to 30 minutes.
- Abuse-prevention signals
- Hashed device, sign-in and email identifiers are kept for up to 12 months after they were last seen; hashed IP signals for up to 90 days.
- Payment records
- As long as tax and accounting laws require, even after your account is deleted.
- Backups
- Database backups are made daily and kept for 14 days, so deleted data can remain in a backup for up to 14 days before it is overwritten.
11. Security
We take the security of your data seriously and use industry-standard measures to protect it, including data accessed through Google APIs:
- Data is transmitted over secure HTTPS (TLS encryption).
- Google and Instagram access tokens are stored encrypted (AES-256-GCM) and used only for the features you use them for.
- Passwords are stored only as salted hashes (bcrypt), never in readable form.
- Media files are kept in private storage and can be opened only through time-limited, signed links for your account.
- Access to user data is restricted to authorised services only.
No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
12. Your rights and choices
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct inaccurate or incomplete data;
- have your data deleted;
- withdraw consent at any time, for example by disconnecting YouTube or Instagram or revoking access in your Google or Instagram settings (this does not affect processing that already happened);
- object to or restrict some processing, and receive your data in a portable format;
- nominate someone to exercise your rights if you die or become unable to (under India’s DPDP Act);
- complain to a data protection authority, such as the Data Protection Board of India or the authority in your country.
How to exercise them
Email us at founder.samay@gmail.com from the address on your account. We may need to confirm your identity before acting on a request. Deletion requests are completed within 7 days; other requests are answered as soon as we can and within the time the law requires.
Your choices in the app
- Delete videos and clips from your library at any time, and download your clips and caption files.
- Disconnect YouTube (CreatorDNA, then Disconnect) or Instagram (Settings, then Integrations).
- Turn email notifications off in Settings. Emails about your plan or trial, such as the notice before your trial ends, and password reset codes are still sent.
- Mute the assistant’s spoken replies, and use it without the microphone.
13. Children
MwareX is not intended for children under 13, and we do not knowingly collect personal data from them. Users under 18 (or under the age of majority where they live) may use MwareX only with the consent and supervision of a parent or legal guardian. If you believe a child under 13 has given us personal data, or that we hold a minor’s data without a guardian’s consent, contact us at founder.samay@gmail.com and we will delete it.
15. Changes to this policy
We may update this policy as MwareX changes or the law requires. We will change the “Last updated” date above, and if a change is significant we will tell you in the app or by email before it takes effect. If a change affects how we use data from Google APIs, we will ask for your consent where Google’s policies require it.
16. Contact
For questions about this policy, to exercise your rights or to raise a grievance about how we handle your data, email us at founder.samay@gmail.com. You can also reach us through the support page.
See also our Terms of Service.