Privacy Policy

Gabriel Pineda ("Gabriel," "we," "our," or "us") operates the Stash mobile application and web platform (collectively, the "Service"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights regarding that information.

By creating an account or using Stash, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use our Service.

For questions, please contact us at gabriel@creator-stash.com.

Gabriel Pineda is an individual based in the Philippines. Stash is a viral content research and organization tool for marketing professionals, content creators, and agencies. It allows users to save short-form videos from platforms such as TikTok and Instagram, automatically enriches saved content with AI-generated transcripts, analysis, and classifications, and enables teams to organize, study, and collaborate on that content.

Gabriel Pineda is the data controller for personal information processed through the Service. Our privacy contact is: gabriel@creator-stash.com.

We use the information we collect for the following purposes:

We do not use your personal information for targeted advertising, and we do not sell your personal information to any third party.

We do not sell your personal information. We share information only in the following limited circumstances:

We use the following third-party services to operate Stash. Each provider receives only the data necessary for their specific function and is subject to contractual data protection obligations.

Stash uses artificial intelligence to automatically enrich the content you save. This is a core feature of the Service. Specifically:

• OpenAI Whisper is used to transcribe audio extracted from saved videos. The audio file is transmitted to OpenAI's API over an encrypted connection for processing.
• OpenAI GPT-4o-mini (with vision) is used to extract text visible in video frames (OCR) and to classify video format and detect calls-to-action.
• OpenAI text-embedding-3-small is used to generate semantic vector representations of transcripts and captions to power search.

By using Stash's save feature, you consent to your saved video content (audio and frame data extracted from publicly accessible URLs you provide) being transmitted to OpenAI for processing. You should not use Stash to save videos containing sensitive personal information.

Gabriel does not use your saved content to train AI models. OpenAI's data usage for API calls is governed by the OpenAI Privacy Policy and its API data usage policies, which by default do not use API inputs to train OpenAI models.

We retain your personal information for as long as your account is active and as needed to provide the Service. Specific retention periods:

• Account data (email, display name, avatar): Retained until you delete your account.
• Workspace and reel data: Retained until you delete your account or, for workspace owners, until the workspace is deleted. Workspace members who leave a workspace lose access to that workspace's data but their account data is unaffected.
• Video and media files: Stored in Cloudflare R2 and retained until account deletion. Upon account deletion, a cleanup process is initiated to remove associated media files; however, due to the distributed nature of cloud storage, complete removal may take up to 30 days.
• AI-generated enrichment data (transcripts, embeddings, classifications): Retained alongside reel data and deleted when the reel or account is deleted.
• Billing data: Payment records and subscription history may be retained for up to 7 years as required by financial regulations, even after account deletion.
• Capture job logs and audit records: Retained for up to 90 days for debugging and reliability purposes, then deleted.
• Share link tokens: Expire per the configured expiration date or upon account deletion, whichever comes first.
• IP addresses and request logs: Retained for up to 30 days at the infrastructure level for security and abuse prevention.

We may retain anonymized, aggregated data (e.g., aggregate usage statistics that cannot identify individuals) indefinitely for product analytics.

Depending on your location, you may have various rights with respect to your personal information. We respect these rights regardless of where you are located.

You may delete your Stash account at any time from within the app: Settings → Account → Delete Account. You may also submit a deletion request by emailing gabriel@creator-stash.com.

When you delete your account:

• Your account record, display name, avatar, and authentication credentials are permanently deleted from our primary database within 7 business days.
• All workspace data, reel records, boards, tags, enrichment data, and share links associated with workspaces you own are permanently deleted on the same timeline.
• Media files (videos, thumbnails, clips) stored in Cloudflare R2 are queued for deletion and will be fully removed within 30 days.
• If you have an active paid subscription, it will be cancelled through Stripe at the time of account deletion. Any active subscription period will not be refunded, but you will not be charged again. You may cancel your subscription before deleting your account via Settings → Billing to manage your billing cycle.
• Billing records required by financial regulations may be retained for up to 7 years in accordance with legal obligations, but will be de-identified where feasible.
• If you are a member (not owner) of workspaces, your workspace membership is removed, but the workspace's content created by other members remains intact for those members.

Deletion is irreversible. We cannot recover deleted accounts or their associated content.

Stash is not directed to children under the age of 13 (or under 16 for users in the European Economic Area), and we do not knowingly collect personal information from children. The Service is intended for use by marketing professionals, content creators, and business teams.

If we become aware that we have collected personal information from a child without appropriate parental consent, we will take steps to delete that information as quickly as possible. If you believe we may have inadvertently collected information from a child, please contact us immediately at gabriel@creator-stash.com.

Stash does not use your data to track you across third-party apps and websites for advertising purposes. We do not use your Apple Advertising Identifier (IDFA) or engage in cross-app behavioral tracking.

If a future version of the app introduces features that require tracking under Apple's App Tracking Transparency (ATT) framework, we will request your explicit permission before doing so via the iOS ATT prompt. You may change your tracking preference at any time in iOS Settings → Privacy & Security → Tracking.

We implement industry-standard technical and organizational measures to protect your personal information:

• Encryption in transit — All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest — Data stored in our database and object storage is encrypted at rest.
• Row-level security — Our database enforces row-level security policies that prevent any user from accessing data outside their authorized workspaces, regardless of application-layer errors.
• Access controls — Internal access to production systems is restricted to authorized personnel on a need-to-know basis. Service-role database credentials used by backend workers are not exposed to end users.
• Authentication security — We use magic-link authentication (no passwords to breach) and support Apple Sign-In with PKCE flow for enhanced security.
• Private media storage — Video files and media assets are stored in private Cloudflare R2 buckets and served only via short-lived, signed URLs.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at gabriel@creator-stash.com.

Gabriel Pineda is based in the Philippines. When you use Stash, your data may be transferred to and processed in the Philippines and other countries where our service providers operate.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, such transfers are made pursuant to appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms. For questions about how we transfer your data internationally, contact us at gabriel@creator-stash.com.

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you additional rights:

• Right to Know — You may request disclosure of the categories and specific pieces of personal information we collect about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete — You may request deletion of personal information we have collected from you, subject to certain exceptions (e.g., information we must retain for legal compliance).
• Right to Correct — You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing — We do not sell or share your personal information as defined under CCPA/CPRA, and have not done so in the preceding 12 months. You therefore need not submit an opt-out request, but you may contact us to confirm.
• Right to Limit Use of Sensitive Personal Information— We do not collect sensitive personal information as defined by CPRA (e.g., racial or ethnic origin, biometric data, health information) in connection with providing the Service.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, contact us at gabriel@creator-stash.com with "California Privacy Rights Request" in the subject line. We will verify your identity before processing your request and respond within 45 days (extendable to 90 days with notice).

Categories of personal information collected in the last 12 months: Identifiers (email, user ID, device ID); Commercial information (subscription and billing data); Internet or other electronic network activity (usage data); Audio/visual information (video content you save, audio extracts, video frames); Inferences drawn from personal information (content classifications, transcript embeddings).

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent local laws:

• Right to be informed — This Privacy Policy fulfills our obligation to inform you about how we process your data.
• Right of access — Request a copy of personal data we hold about you.
• Right to rectification — Request correction of inaccurate data.
• Right to erasure ("right to be forgotten") — Request deletion of your data where we no longer have a legal basis to retain it.
• Right to restriction of processing — Request that we restrict processing of your data in certain circumstances.
• Right to data portability — Receive your data in a structured, commonly used, machine-readable format.
• Right to object — Object to processing based on legitimate interests.
• Rights related to automated decision-making — We do not make solely automated decisions that produce legal or similarly significant effects about you.

Legal bases for processing:

• Performance of a contract (Article 6(1)(b)) — Providing the Service you've subscribed to, including authentication, video enrichment, workspace collaboration, and billing.
• Legitimate interests (Article 6(1)(f)) — Security, fraud prevention, product improvement, and internal analytics, where these interests are not overridden by your rights.
• Consent (Article 6(1)(a)) — For AI processing of your saved content (as described in Section 6). You may withdraw consent by discontinuing use of the save feature or deleting your account.
• Legal obligation (Article 6(1)(c)) — Retaining billing records as required by financial regulations.

To exercise your GDPR rights, contact us at gabriel@creator-stash.com. You also have the right to lodge a complaint with your local data protection authority.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email to your registered address at least 30 days before material changes take effect.
• Display a prominent notice within the Service for at least 14 days following the change.

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the updated policy. If you do not agree to the revised policy, please delete your account before the effective date.

For privacy questions, rights requests, or concerns about this policy, please contact:

We are committed to working with you to obtain a fair resolution of any privacy concern. We will respond to verified requests within 30 days.