Privacy at unfill.io

Who we are

unfill.io is a product of Cloud Vertex LLC, a Florida limited liability company based in Jacksonville, FL, United States. When we say "we," "us," or "unfill" on this page, we mean Cloud Vertex LLC.

For any privacy question, email privacy@unfill.io. A real person reads it.

What we collect

Account information

If you create an account, we store your email address and a secure identifier from our authentication provider (AWS Cognito). We do NOT store your password — Cognito hashes and stores it on their infrastructure.

Recordings you upload

When you upload an audio or video file (or paste a URL to one), we temporarily store that file in an encrypted Amazon S3 bucket. We use it only to generate your transcript and deck. The file is automatically deleted about 24 hours after upload — a lifecycle rule enforces this at the storage layer. AWS runs these deletions once a day, so occasionally removal can take up to about 48 hours.

Transcripts

The transcript we generate from your recording is stored with your account so you can regenerate or refine decks later. Transcripts are text-only and much smaller than the recording. Transcript text is kept with your account until you ask us to delete it (privacy@unfill.io).

Generated decks

The PowerPoint file we build for you is stored in an encrypted S3 bucket and available for you to download. Decks are automatically deleted after 30 days. You can also delete them earlier at any time from My decks. After a file expires, the deck's entry and slide text stay in My decks until you delete them.

If you create a share link, anyone with the link can view the deck's slides until you stop sharing or delete the deck. Shared pages are not indexed by search engines. If you add frames from a video to a deck, those still images are stored as part of the deck until you delete it, even after the original recording is deleted.

Payments and plan usage

If you upgrade to Pro, payment is processed by Stripe. We store your plan, a Stripe customer ID, and your renewal date. We never see or store your card number. We also count the decks you download each month to apply your plan's limit.

Usage information

We keep basic technical records: which endpoint you hit, the response, and error logs. We use this to keep the service working and to fix bugs. We do not build advertising profiles from this data.

Cookies

When you sign in, we set HttpOnly, SameSite=Lax, Secure session cookies to keep you authenticated. These cannot be read by JavaScript, which protects them from cross-site attacks. We also use a small cookie to remember whether you've acknowledged our upload consent notice. We do not use advertising or analytics cookies. We use Plausible, a cookieless analytics service, to count page visits and actions like downloads; it stores no cookies and no personal data.

Third parties we use

To provide the service, some of your data passes through the following processors. We picked each of them because they have strong security practices.

• Amazon Web Services (AWS) — hosts our servers, storage (S3), database (RDS), authentication (Cognito), email (SES), and CDN (CloudFront). Connections use HTTPS (TLS). Files in storage are encrypted at rest with AES-256 (S3), and the database is encrypted at rest with AWS RDS encryption.
• Deepgram — processes audio to produce the transcript; see Deepgram's privacy policy for their data handling.
• Anthropic — turns your transcript into slide content using their Claude API. Anthropic's terms confirm they do not train models on API traffic.
• Stripe — processes payments for Pro plans. Card details go directly to Stripe and never touch our servers.
• Plausible — privacy-friendly website analytics. No cookies, no personal data, no cross-site tracking. Used only to count visits and actions like downloads.
• Zoho Mail — receives email sent to our unfill.io addresses. Used only for you contacting us; we don't share your email with Zoho unless you email us.

How long we keep things

Your rights

You have the right to know what we hold about you, to correct anything wrong, and to delete it. To exercise any of these, email privacy@unfill.io from the address on your account. We respond within 7 days.

You can also delete your decks at any time from My decks without emailing us. Account deletion is available on request — email us and we remove your account and all associated data within 7 days.

For users in the EU / UK

You have additional rights under GDPR (or the UK GDPR): the right to access, rectify, erase, restrict processing, object to processing, and data portability. To exercise any of these, email privacy@unfill.io. If you feel we haven't handled your request well, you can lodge a complaint with your local supervisory authority.

Security

We use industry-standard security practices: HTTPS (TLS) on all connections, AES-256 encryption at rest for files in storage (S3), AWS RDS encryption at rest for the database, HttpOnly + SameSite session cookies, JWT-based authentication with token rotation, and least-privilege access controls on our infrastructure. No system is perfect, but we take this seriously. More detail, including the full list of subprocessors, is on our security page.

If you find a security issue, please email privacy@unfill.io with details. We'll respond within 48 hours.

Age minimum

unfill.io is intended for users aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email privacy@unfill.io and we will delete it.

Changes to this policy

If we materially change this policy, we'll email registered users at least 7 days before the change takes effect. For minor edits (typo fixes, clarifications), we update the date at the top and the change is effective immediately.

Governing law

This policy and any dispute related to it are governed by the laws of the State of Florida, United States, without regard to conflict-of-laws principles.