Privacy Policy

InstaZap is a service that removes silent gaps from talking-head videos and, optionally, adds captions to them. It is operated by Ali Benhamamouch.

For the purposes of the EU General Data Protection Regulation — and the UK GDPR, for users in the United Kingdom — we are the data controller for the personal data described here. You can reach us at privacy@instazap.org.

When you create an account

• Your email address. Used to identify your account, send password resets, and contact you about your subscription.
• Your password — stored only as a scrypt hash. We cannot read it, and cannot tell you what it is if you forget it.
• If you sign in with Google, we store the account identifier Google gives us and your email address. We never receive your Google password.

When you use the service

• The video file you upload, temporarily. See the next section — this is the part most people want to know about.
• Basic facts about the file: its original filename, size in bytes, and duration in seconds. This metadata stays in your history after the video itself is gone.
• A record of each edit: when it started, whether it succeeded, and any error message if it failed.
• A ledger of your Zaps — how many you had, what each job used, and what was refunded. This exists so that if we ever disagree about your balance, there's a record to check.

If you subscribe

Payments run entirely through Stripe. Your card number is entered on Stripe’s systems and never reaches ours — we never see or store card details. What we keep is a Stripe customer ID and subscription ID, so we know which plan you are on.

Automatically

Our servers write ordinary technical logs, which include IP addresses and error traces. These are used to keep the service running and to investigate abuse, and are not combined into a profile of you.

We do not use analytics trackers, advertising pixels, or third-party cookies, and we do not sell personal data to anybody. There is no cookie banner on this site because there is nothing on it that would need your consent.

We don’t permanently store your videos. An upload is deleted within 2 hours at the latest, and the edited result is deleted 24 hours after it’s ready.

Concretely, here is the whole journey a file takes:

• You upload a video. It is written to a temporary directory on our server — not into a database, and not into any public bucket.
• We check it is a real video file and measure its true duration with FFprobe on the server. If it is invalid, it is deleted immediately and no Zap is used.
• The audio track is sent to OpenAI’s Whisper API to be transcribed with word-level timings. Your video’s picture is never sent anywhere.
• We work out where the silences are and cut them with FFmpeg, entirely on our own server. If you asked for captions, the same word timings are used to draw them onto the video here too.
• You download the result. The download link is signed and expires after 30 minutes; the file itself is deleted after 24 hours.
• The original upload is deleted as soon as the edit finishes, and in any case within 2 hours.

The transcript

The transcript of your speech is used to find the gaps, and — if you asked for captions — to build the subtitles. It is held for the length of the job and never written to our database. When you request captions, a subtitle file is written alongside your video and deleted with it after 24 hours; otherwise nothing of the transcript is kept at all.

What OpenAI does with the audio

We use OpenAI’s API, not ChatGPT. Under OpenAI’s API terms, data submitted through the API is not used to train their models, and is retained by them for up to 30 days for abuse monitoring before deletion. Their policy is at openai.com/policies.

If you are working with material you cannot share with a third-party processor — confidential, privileged, or otherwise restricted — InstaZap is not the right tool for it, because transcription necessarily involves sending the audio to OpenAI.

We don’t watch your videos

Nothing about the editing process involves a person viewing your content. We may open a file only if you ask us to investigate a specific problem with a specific job, or if we are legally required to.

Under the GDPR every use of personal data needs a lawful basis. Ours are:

• Performing our contract with you — holding your account, processing the videos you submit, taking payment, and giving you your files back. You cannot use InstaZap without this.
• Our legitimate interests — keeping the service secure, preventing people from farming unlimited free Zaps through duplicate accounts, and keeping the Zap ledger so billing disputes can be settled. We have considered your rights here and think these are unsurprising and proportionate.
• Complying with the law — keeping records of payments for the period tax law requires.

We use a small number of processors to run the service. Each acts on our instructions under a data processing agreement, and none of them may use your data for their own purposes.

Beyond these, we disclose data only where we are legally compelled to, or where it is necessary to establish or defend a legal claim. If InstaZap is ever sold or merged, your data may transfer to the buyer, who would be bound by this policy until they told you otherwise.

InstaZap runs on servers hosted by OVHcloud in the European Union. Your account data, your uploads, and the edited results all live there.

Two of our processors — OpenAI and Stripe — are based in the United States, so transcription and payment involve a transfer outside the EEA. These transfers are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

When you delete your account, we erase your account record and its history. Payment records are kept for the period above, because we are legally required to.

We set two cookies, both strictly necessary for the service to work. Neither is used for tracking or advertising.

• instazap_session — keeps you logged in. Expires after 30 days. Removed when you log out.
• instazap_anon — a random identifier that lets you upload a video before you have an account, so that only your browser can claim that upload afterwards. Expires after 24 hours.

Both are httpOnly, meaning JavaScript on the page cannot read them. Blocking them will stop InstaZap from working.

If you are in the UK or EU, you have the right to:

• Access the personal data we hold about you.
• Correct anything inaccurate.
• Delete your account and data.
• Export your data in a portable format.
• Restrict or object to how we process it.
• Withdraw consent where we relied on it.

Email privacy@instazap.org from the address on your account and we will respond within one month. There is no charge.

If you think we have handled your data badly, you can complain to the Spanish Data Protection Agency (AEPD), or to the authority in your own EU country. We would rather you told us first, but that is your right regardless.

• Everything travels over HTTPS. Plain HTTP is redirected.
• Passwords are hashed with scrypt, never stored in a form we could read.
• Session tokens are stored as hashes, so a copy of our database would not let anyone log in as you.
• Download links are individually signed and short-lived, so a leaked URL stops working quickly.
• The database is not reachable from the internet — only the application can talk to it.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your data, we will notify the relevant authority within 72 hours and tell you directly where the law requires it.

If you have found a security problem, please email support@instazap.org before disclosing it publicly.

InstaZap is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

If we change how we handle your data, we will update this page and move the date at the top. For changes that materially affect you, we will email you before they take effect. Continuing to use InstaZap after that means you accept the new version.

Privacy questions and data requests: privacy@instazap.org
Everything else: support@instazap.org

See also our Terms of Service.