Privacy Policy

Last Updated: April 23, 2026

It Just Works, Inc. (dba StarZero) ("StarZero," "we," "us," or "our") is an AI video intelligence company. Our platform understands every frame, word, and moment of your videos and turns that understanding into new content through multimodal search and agentic workflows ("Skills") such as vibe-based editing, ad remixing, and podcast clipping. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit starzero.ai, use our applications, APIs, browser extensions, and other services (together, the "Services"), or otherwise interact with us across our App (the smart media library), Agents (the chat and editor experience), Workflows (enterprise workflow management), and Mobile surfaces.

This policy works alongside our Terms of Service, Cookie Policy, Data Processing Addendum, Sub-Processors list, and Your Privacy Choices page. Capitalized terms not defined here have the meaning given in our Terms of Service. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

The Short Version

This summary is for convenience only and does not replace the full policy below.

What we collect. Account and profile details, billing information, the video, audio, and other content you submit ("Inputs"), the content our Services generate from it ("Outputs"), and information about how you use the Services.
Your content and AI choices. We process your Inputs and Outputs (together, "Materials") to provide and improve the Services. We do not sell your Materials. Subject to applicable law and your choices, we may use Materials to improve and develop our models, search, and agents. You can opt out by contacting us; separate consent or other valid authorization is required where we use biometric or other sensitive data for this purpose.
Who we work with. We share data with a short list of vetted infrastructure and AI providers (including Google Cloud, Google Gemini, OpenAI, Anthropic, Cloudflare, and Stripe), listed on our Sub-Processors page.
Your controls. You can access, correct, export, and delete your information, and exercise other rights described in the Your Privacy Rights section and on the Your Privacy Choices page.
Contact. Reach our privacy team at [email protected].

1. Our Role

How we handle personal information depends on the data in question.

As a business. For personal information we collect to run our business and our relationship with you, such as account details, billing information, website and product usage data, and support communications, we determine how and why it is processed, and this Privacy Policy governs that processing.
As a service provider. When we process the Materials you submit to the Services on your behalf, we act as a service provider. If you use the Services as, or on behalf of, an organization ("Customer"), that Customer directs the processing of the personal data in its Materials, governed by our Data Processing Addendum.

If your personal data appears in another party's Materials (for example, you were filmed in a video a Customer uploaded), that Customer is responsible for it. Please direct your request to them, and we will assist as required by law. The terms "business," "service provider," "controller," and "processor" carry the meanings given under the privacy laws that apply to you; EEA, UK, and Swiss users should also read the Notice in Section 13.

Where we use Materials for product or model development outside the processing needed to provide the Services, we do so only as permitted by the Agreement, your settings or request, and Applicable Data Protection Law. That use may make StarZero an independent controller or business for that limited purpose. We do not use Customer Materials for this purpose where the applicable agreement or settings prohibit it.

2. Information We Collect

2.1 Information You Provide to Us

Account and profile information. When you create an account, we collect your name, email address, and authentication details. We use passwordless sign-in (a "magic link" sent to your email), so we do not store account passwords. If you sign in through a third-party identity provider, we receive the information described in Section 2.3.
Billing information. If you purchase a paid plan, our payment processor (Stripe) collects and processes your payment and billing details and manages your subscription. We receive confirmation of your payments and your subscription status. We do not collect or store your payment card details.
Inputs and Materials. When you use the Services, you submit video files, audio, images, text, instructions, metadata, and configurations. These Inputs, and the Outputs generated from them, may contain personal information about you and about other individuals who appear or are mentioned in your content, including faces, voices, names, and on-screen text.
Communications and support. If you contact us, respond to a survey, or participate in research, we collect the information you choose to share, such as your name, email, the contents of your messages, and any attachments.

2.2 Information We Collect Automatically

Usage data. We collect information about how you interact with the Services, such as the features and Skills you use, searches you run, content you view or generate, and the frequency and duration of your activity.
Device and connection data. We collect your device type, operating system, browser type, language settings, IP address, and unique device or application identifiers.
Log data. Our servers automatically record information when you use the Services, including access times, pages and screens viewed, referring pages, and crash and diagnostic data.
Agent and activity logs. We log all of the instructions and prompts you send to our agents and AI models, and all of the actions you and the Services take on your behalf (such as edits, Skill runs, searches, and publishing), together with the resulting Outputs and related processing events. We use these logs to operate, secure, debug, benchmark, and improve the Services.
Cookies and similar technologies. We and our analytics providers use cookies, web beacons, local storage, and similar technologies as described in our Cookie Policy.
Account-linked analytics. If you consent to analytics, we use Mixpanel to associate your email address with website and account activity, including sign-in events and product-interaction events. We do not send these events to Mixpanel when you have not consented to analytics.
Approximate location. We may infer your approximate location (such as city or region) from your IP address. We do not collect precise geolocation from your device without your permission.

2.3 Information From Third Parties

Identity and login providers. If you sign in or connect an account through a third-party service, we receive basic profile information such as your name and email address, as permitted by that service and your settings.
Payment processor. We receive confirmation of your payments and your subscription status from Stripe.
Analytics and referral sources. We receive aggregated and event-level analytics about how the Services are used, and information about how you found us, from analytics providers and referral links.

2.4 Information Generated by the Services

To make your videos searchable and editable, our systems analyze and generate information from your Materials. Our analysis is multimodal and may cover essentially every element of the content you provide, including:

Outputs. Edited videos, clips, transcripts, remixed content, dubs, generated audio, search results, summaries, and other derivative content.
Transcripts and indexes. Speech-to-text transcripts and multimodal search indexes (including vector embeddings) that represent the visual, audio, and textual content of your videos.
Scene and shot analysis. Shot detection, scene-change and scene-understanding data, object and on-screen-text recognition, and similar signals used for search, selection, and reframing.
Face and speaker analysis. Within an individual video or processing job, face detection and active-speaker detection may help associate a visible speaker with diarized speech. We may transiently generate mathematical face representations to perform that processing; they are discarded when the job completes. See Section 6.
Proxies and previews. Lower-resolution copies, thumbnails, waveforms, and preview renders we create so you can stream, preview, and edit your content quickly.
Inferences. Conclusions our systems draw from your Materials and usage, such as the topics discussed or the moments likely to be of interest, used to operate features like clip selection and reframing.

3. How We Use Your Information

We use the information we collect to:

Provide the Services. Ingest, index, store, search, edit, clip, transcribe, remix, and publish your Materials; run Skills and Agents; create and manage your account; and process payments.
Operate and secure the Services. Monitor performance, troubleshoot, prevent fraud and abuse, enforce our Terms and Acceptable Use Policy, and protect the rights, property, and safety of StarZero, our users, and others.
Improve and develop the Services. Understand how the Services are used, debug and measure features, conduct research and development, and build new Skills and capabilities, subject to the limits in Section 4.
Communicate with you. Send service, security, and administrative messages, respond to your requests, and (where you have not opted out) send product updates and marketing.
Comply with law. Meet legal, regulatory, tax, and accounting obligations and respond to lawful requests.

4. AI, Automated Processing, and Model Training

4.1 How Our AI Features Work

The Services use machine learning and artificial intelligence to make your videos searchable and to generate Outputs. To do this, we process your Materials with our own systems and with trusted third-party AI model providers. Outputs are probabilistic and may be inaccurate or incomplete, and you are responsible for reviewing them before use, as described in our Terms of Service.

4.2 Third-Party AI Providers

We use AI model providers, including Google (Gemini), OpenAI, and Anthropic, to power chat-based interaction with your content, content analysis, and Skill execution. We send these providers the portions of your Materials needed to perform the requested task. We engage them under enterprise or API terms that do not permit them to use your Materials to train their own foundation models. The current list is maintained on our Sub-Processors page.

4.3 Our Use of Materials to Improve the Services and Train Our Models

We use your Materials, including the prompts, instructions, edits, chats, and media you provide, to operate, secure, evaluate, and improve the Services, and to develop, train, fine-tune, and evaluate the AI models, search systems, Skills, and agents that power StarZero (for example, to improve search quality and build domain-specific agents). For this purpose, we apply technical and organizational measures designed to minimize the use of personal information and prevent models from reproducing your content. We do not sell your Materials.

This use is enabled by default to the extent permitted by Applicable Data Protection Law. You may opt out by contacting us at [email protected]; we will apply the opt-out to future model-development processing within a commercially reasonable time. We do not use Face Embedding Data, voiceprints, voice models, or other biometric or sensitive data for model development unless we have obtained the consent or other lawful authorization required for that processing. Enterprise Customers may restrict or exclude model development use under their agreement, as described in Section 1 and our DPA. An opt-out does not affect models already trained or information that has been irreversibly anonymized or aggregated.

4.4 Automated Decision-Making

We do not use your personal information to make decisions that produce legal or similarly significant effects about you without human involvement. The Services generate Outputs and perform Actions at your direction, and you remain in control of reviewing, accepting, editing, and publishing them.

5. How We Share Your Information

We share personal information only as described below.

Sub-processors and service providers. We share information with vendors who process data on our behalf to provide the Services, including cloud compute (Google Cloud), object storage and content delivery (Cloudflare R2 and CDN), AI and media providers (such as Google Gemini, OpenAI, Anthropic, OpenRouter, and ElevenLabs), and payment processing (Stripe). We enter into written agreements that require service providers to process personal information only to provide their contracted services and apply appropriate safeguards. The current list is published at starzero.ai/legal/sub-processors.
Within your organization. If you use the Services through an organizational or enterprise account, your administrators and other Authorized Users may access your account activity and Materials, and your administrator may monitor, control, or restrict your use.
At your direction. When you use a Skill or Action to publish, distribute, or share content (for example, posting a clip to a connected platform), we share the relevant content as instructed.
Legal and safety. We may disclose information if required by law or valid legal process, or where we reasonably believe it is necessary to protect rights, property, or safety, prevent fraud, or enforce our Terms.
Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in control or material change in how your information is handled.
With your consent. We share information with other third parties when you direct us to or otherwise consent.
Aggregated or de-identified data. We may share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you. We maintain such data without attempting to re-identify it, except to test our de-identification.

We do not sell your Materials, and we do not disclose the contents of your Materials to third parties for their own marketing. See Section 9 for how state laws define "sale" and "sharing" and the choices available to you.

6. Face and Speaker Analysis

The Services analyze the people who appear and speak in your videos. This includes face detection, active-speaker detection, and speech diarization within an individual video or processing job. We may transiently generate Face Embedding Data (mathematical vectors derived from face images) to help associate a visible speaker with diarized speech. We discard Face Embedding Data when the job completes.

We use these signals to improve transcription, search, and editing within the source video or project. For example, if a speaker identifies themself in content, the Services may change the corresponding transcript segments from a generic label such as "Speaker 1" to that name. We may retain these transcript and project labels while the associated video remains in your library. We do not currently retain face embeddings, face clusters, voiceprints, or voice models, and we do not use them to match people across videos or libraries.

Face- and voice-derived data may be biometric or sensitive personal data under Applicable Data Protection Law. We do not sell it, use it for advertising, compare it against a public identity database, use it to verify a person's identity, or use it to make eligibility decisions.

Your responsibility. Where you submit content on behalf of an organization, you are responsible for providing any notices and obtaining any consents required before submitting content that contains other people's faces or voices, or before using voice cloning or similar features on a person's voice. StarZero will obtain consent or another lawful authorization where we are required to do so as a controller.

7. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand usage through analytics providers (currently Google Analytics and Mixpanel). If you consent to analytics, Mixpanel may receive your email address and associate it with your website and account activity. For details about the categories of cookies we use and how to control them, including through your browser and Global Privacy Control, see our Cookie Policy and Your Privacy Choices page.

8. Data Retention

We retain personal information for as long as needed to provide the Services and for the legitimate and lawful purposes described in this policy.

Account information is retained while your account is active.
Materials (including transcripts, indexes, and project labels) are retained while they are in your library. When you delete them, we delete them from active systems within 90 days; backups containing the deleted data age out within the same period.
Usage and operational log data are retained for 180 days for security, troubleshooting, and service operation.
Analytics data is retained by Mixpanel for up to two years, subject to the settings and retention practices of that provider.
Account, billing, and compliance records are retained while your account is active and afterwards only for as long as needed to provide the Services, meet legal or accounting obligations, resolve disputes, or enforce our agreements.

When you close your account, we delete or de-identify the associated personal information within 90 days unless a longer retention period is necessary for the purposes described above or is required by law. Customers may have additional return and deletion rights under our DPA.

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information. Our safeguards address access management, confidentiality, data protection, network and application security, incident response, business continuity, and vendor management. A fuller description is set out in Annex 2 of our DPA. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. International Data Transfers

We are based in the United States and process personal information primarily in the United States. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as described in Section 10 of our DPA. You may request a copy of the relevant safeguards by contacting us.

11. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding personal information we hold as a controller: to access or know what we hold, to correct inaccurate information, to delete your information, to receive a portable copy, to opt out of certain uses, to object to or restrict certain processing, and to withdraw consent.

Some controls are built into the Services: you can download your media from your account, cancel your subscription from your account, and edit your profile at any time. To delete your account, email [email protected] for now (we are adding self-serve account deletion).

To exercise these rights, email [email protected] or use the controls on the Your Privacy Choices page. We will verify your request using the information associated with your account and respond within the timeframe required by applicable law. You may use an authorized agent to submit a request on your behalf, subject to verification. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our decision; we will respond to appeals as required by your jurisdiction.

If your personal data is contained in a Customer's Materials, we act as a processor and will refer your request to the relevant Customer, whom you should contact directly.

12. United States State Privacy Rights

This section provides additional disclosures for residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws, as applicable.

12.1 Categories of Personal Information

In the past 12 months, we have collected the following categories of personal information (as defined under the California Consumer Privacy Act, as amended by the CPRA), disclosed them to the categories of recipients noted, and obtained them from the sources described in Section 2.

Category	Examples	Disclosed to
Identifiers	Name, email address, IP address, device and account identifiers	Infrastructure, AI, analytics, and payment providers
Commercial information	Plan, payments, and subscription status	Payment processor
Internet or network activity	Usage, log, and interaction data	Analytics and infrastructure providers
Audio, visual, and similar information	The video, audio, and images in your Inputs and Outputs	Infrastructure and AI providers (to provide the Services)
Sensitive personal information	Face Embedding Data and other biometric or sensitive data that may appear in your content	Infrastructure and AI providers (to provide the Services)
Inferences	Topics, highlights, and other conclusions drawn from your Materials and usage	Infrastructure and AI providers

We collect this information for the business and commercial purposes described in Section 3, and we retain it as described in Section 8.

12.2 Sensitive Personal Information

We do not use or disclose sensitive personal information for advertising, to infer characteristics about you, or to make eligibility decisions. We use face- and voice-derived data to provide requested face- and speaker-aware features. We use biometric or other sensitive data for model development only where we have the consent or other lawful authorization required for that processing.

12.3 Sale and Sharing of Personal Information

We do not sell your Materials, and we do not sell personal information in exchange for money. We do not knowingly sell or share the personal information of individuals under 16. We use analytics providers under agreements that restrict their use of personal information to providing services to us. You can opt out of non-essential analytics and exercise any applicable sale or sharing opt-out through our Your Privacy Choices page, and we honor Global Privacy Control signals.

12.4 Exercising Your Rights

California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other state residents may exercise the rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, sharing, and certain profiling, as provided by their state law. Submit a request at [email protected] or through the Your Privacy Choices page. Where your state provides an appeal process, you may appeal a denial by replying to our response.

13. Notice to EEA, UK, and Swiss Users

This section applies only to individuals in the European Economic Area, the United Kingdom, and Switzerland ("Europe") and supplements the rest of this Privacy Policy. Where it conflicts with another section, this section controls for European users. References to "personal information" should be read to include "personal data" as defined under the GDPR and UK GDPR.

13.1 Controller and Roles

It Just Works, Inc. (dba StarZero) is the controller of the personal data we process to operate our business, as described in Section 1. Where we process the Materials you submit on behalf of a Customer, that Customer is the controller and we act as the processor, as described in Section 1 and our Data Processing Addendum.

13.2 Legal Bases for Processing

We rely on the following legal bases when we process your personal data as a controller:

Purpose	Legal basis
Providing the Services and performing our contract with you	Performance of a contract (GDPR Art. 6(1)(b))
Securing the Services, preventing fraud and abuse, and improving and developing our products, including developing and training the AI models, search, and agents that power the Services	Our legitimate interests, balanced against your rights (Art. 6(1)(f)); for biometric or other special-category data, explicit consent or another valid Article 9 condition where required
Marketing communications and non-essential cookies	Your consent, which you may withdraw at any time (Art. 6(1)(a))
Meeting legal, tax, and regulatory obligations	Compliance with a legal obligation (Art. 6(1)(c))

Where we act as a processor on behalf of a Customer, that Customer is responsible for establishing a legal basis for the processing.

13.3 Your Rights

You have the rights to access, rectify, erase, restrict, and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time without affecting prior processing. To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with your local supervisory authority, though we would appreciate the chance to address your concerns first.

13.4 International Transfers

We transfer your personal data to the United States and other countries. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum, as described in Section 10 and our DPA. You may request a copy of the relevant safeguards by contacting us.

14. Children's Privacy

The Services are intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at [email protected] and we will take steps to delete it.

15. Third-Party Links and Services

The Services may link to or integrate with websites and services we do not control. We are not responsible for their privacy practices, and we encourage you to review their policies. Our use of information received through integrations is governed by this Privacy Policy.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above, and if the changes are material we will provide additional notice by email or through the Services. Your continued use of the Services after an update takes effect means you acknowledge the revised policy.

17. How to Contact Us

For any question about this Privacy Policy or our privacy practices, or to exercise your rights, contact our privacy team:

It Just Works, Inc. (dba StarZero)
51 Little Falls Drive
Wilmington, New Castle County, Delaware 19808
General privacy requests: [email protected]
Privacy contact: Paul Robert Cary, CEO — [email protected]