Privacy Policy
Last updated: 2026-10-26
This Privacy Policy explains how [FILL: razão social] (CNPJ [FILL: 00.000.000/0001-00], [FILL: street, number, city – state, ZIP, Brazil]) ("Hypothetically", "we", "us") collects, uses and shares personal information when you visit https://thehypothetically.shop or use our video creation service (the "Service"). We are the controller of your personal information.
1. Information we collect
Information you give us
- Account data: name, email address and password (stored as a hash).
- Inputs: the topics, text, images and preferences you submit to create videos, and your edits and approvals.
- Support messages: what you write to us and our replies.
- Waitlist: your email address and, if you choose one, the plan you are interested in.
Payment data
- Payments are handled by Stripe. Stripe collects your card details and billing address directly; we receive only limited information such as your name, the last four digits and brand of the card, the billing country and the status of payments.
Information collected automatically
- Usage data: pages visited, features used, credits consumed, and the date and time of actions.
- Device data: IP address, browser type, operating system and approximate location derived from the IP address.
- Cookies: see our Cookie Policy.
We do not knowingly collect sensitive personal information (such as health data, precise geolocation or government ID numbers), and we ask you not to include it in your Inputs.
2. How we use it
| Purpose | Legal basis (LGPD / GDPR) |
|---|---|
| Create and manage your account, generate your videos, and run the automated review | Performance of a contract |
| Process payments, renewals and refunds, and prevent fraud and abuse of free usage | Performance of a contract; legitimate interests |
| Send service emails (receipts, renewal notices, security alerts) | Performance of a contract; legal obligation |
| Answer support requests | Performance of a contract; legitimate interests |
| Improve the Service, fix errors and keep it secure | Legitimate interests |
| Send product news and offers, only if you agree; you can unsubscribe in any email | Consent |
| Comply with the law and respond to lawful requests | Legal obligation |
We do not use your Inputs or Outputs to train AI models, and where our AI providers offer it, we use settings that stop them from training on your data.
3. Who we share it with
We share personal information only with service providers that help us run the Service, under contracts that limit their use of the data:
| Provider | What it does |
|---|---|
| Stripe | Payment processing, fraud prevention |
| Anthropic | AI model that writes and reviews scripts |
| ElevenLabs | Voice narration |
| Cloud hosting and database providers | Run the Service and store data |
| Cloudflare | Content delivery and security |
| Transactional email provider | Sends account and billing emails |
We may also disclose information to comply with the law or a valid legal order, to protect the rights and safety of users or others, or as part of a merger, acquisition or sale of assets (in which case we will notify you).
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
4. International transfers
We are based in Brazil, and our providers may process data in Brazil, the United States, the European Union and other countries. When data is transferred across borders, we rely on safeguards recognized by applicable law, such as standard contractual clauses.
5. How long we keep it
- Account data and Inputs/Outputs: while your account is active. After you delete your account, we delete them within 30 days, except backups, which are overwritten within 90 days.
- Payment and tax records: for as long as tax and accounting laws require (generally 5 years in Brazil).
- Support messages: up to 2 years after the conversation ends.
- Waitlist: until you unsubscribe or we open your account.
6. Security
We use encryption in transit (HTTPS), access controls, hashed passwords and the security measures of our providers. No system is perfectly secure; if a breach affects your information, we will notify you and the authorities as required by law.
7. Your rights
Wherever you live, you can ask us to access, correct, delete or export your personal information, and you can withdraw consent at any time. Email [email protected] from the address on your account. We answer within 15 days (LGPD) and in any case within the period required by your local law. We will not discriminate against you for exercising your rights.
United States residents
California (CCPA/CPRA). In the last 12 months we collected these categories of personal information: identifiers (name, email, IP address); commercial information (plans and credits purchased); internet or network activity (usage data); approximate geolocation; and the content you submit. We collect them from you, your devices and Stripe, for the purposes in section 2, and disclose them to the service providers in section 3 for business purposes. We do not sell or share personal information, and we do not use or disclose sensitive personal information. California residents have the right to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information, and the right not to be discriminated against for using these rights.
Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Nebraska, Kentucky, Indiana, Rhode Island and other states with consumer privacy laws have similar rights to access, correct, delete and obtain a copy of their data, and to opt out of targeted advertising, sale and profiling. We do not engage in those activities. If we deny your request, you can appeal by replying to our answer; we will respond within the time your state law requires, and if you are not satisfied you can contact your state attorney general.
Global Privacy Control. We treat a GPC signal from your browser as a valid request to opt out of sale, sharing and optional cookies.
Authorized agents. You can use an authorized agent to make a request. We may ask the agent for proof of authorization and ask you to verify your identity.
Nevada. We do not sell covered information as defined under Nevada law.
Brazil (LGPD)
You have the rights in article 18 of Law 13.709/2018, including confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and revocation of consent. You can also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Our data protection officer (encarregado) can be reached at [email protected].
European Economic Area, United Kingdom and Switzerland
You have the rights to access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority.
8. Children
The Service is for people aged 18 and over. We do not knowingly collect personal information from children under 13 (or under 18). If you believe a child has given us information, email [email protected] and we will delete it.
9. Changes to this policy
We will post any changes on this page and update the date above. If a change is material, we will notify you by email or in the Service before it takes effect.
10. Contact
[FILL: razão social] · CNPJ [FILL: 00.000.000/0001-00]
[FILL: street, number, city – state, ZIP, Brazil]
Privacy requests and data protection officer: [email protected]
General support: [email protected]