Privacy Policy
Last updated: September 28, 2026
Short version: we collect the minimum needed to provide Caption Plug, Motion Plug, and the browser studio: account details, purchase and credit records, license activations, short-lived caption-job results, verified review submissions, retained legacy Motion Plug beta applications, affiliate application and commission records, messages you choose to send through the feedback page, pseudonymous first-party site-usage and performance measurements, your purchase-source answer, and your optional marketing preference. Only if you accept advertising cookies, we also use the TikTok Pixel to measure which of our TikTok ads lead to visits and purchases. We never sell data.
1. Who is responsible
Data controller: Sarbaz Jan, trading as Caption Plug, an independent software business based in the United Kingdom. Contact: support@captionplug.com (our postal address is available on request for legal correspondence).
2. What we collect and why
| Data | Why (legal basis) |
|---|---|
| Pseudonymous visitor, session, page, funnel, referrer-domain, and campaign records | Measuring first-party site use and purchase drop-off without storing raw IP addresses, ad IDs, caption content, file names, or video data (legitimate interest). |
| Cookieless page, event, and Web Vitals measurements | Understanding public-page use, failures, conversions, and performance without recording captions, file names, or video content (legitimate interest). |
| TikTok Pixel and Events API: pages viewed, sign-up, checkout, download, and purchase events (product, price, order ID), TikTok cookie and ad-click IDs, browser user-agent, and a SHA-256 hash of your email and account ID | Measuring whether our TikTok ads lead to visits and sales (consent). Nothing loads or is sent unless you choose “Accept”; change your mind any time with “Cookie settings” in the footer. Caption text, file names, and video data are never included. |
| Verified review submission | Publishing your rating and review only with consent, and verifying product use against the same account (consent, legitimate interest). |
| Optional “how did you find us?” answer | Understanding which marketing channels help customers discover the product (legitimate interest). |
| Email + password (hashed) | Your account: login, download access, password resets (contract). |
| Purchase records | Delivering what you bought, refunds, tax/accounting obligations (contract, legal obligation). |
| Credit balance + immutable usage ledger | Delivering prepaid browser-studio credits and preventing double charging (contract). |
| Caption job timing + pseudonymous IP/audio hashes | Retry recovery, one-credit idempotency, fraud prevention and rate limiting (contract, legitimate interest). Raw IPs and source videos are not stored in the studio database. |
| License + machine activation hashes | Enforcing the 3-machine license and fighting piracy (legitimate interest). The hash is a fingerprint the plugin computes; we never see your files or hardware details. |
| Download log (IP, browser user-agent, time) | Abuse and fraud tracing on signed download links (legitimate interest). |
| Support emails and product-feedback messages | Answering you, fixing bugs, and improving the product (legitimate interest). Feedback message bodies are delivered to the developer inbox and are not stored in the website database. |
| Legacy Motion Plug beta application (account UUID, verified email, status, and timestamps) | Retaining the request you made before the public launch and the resulting access history (your request, legitimate interest). New beta applications are no longer collected. |
| Affiliate application, legal country, referral, commission, and payout records | Reviewing affiliate applications, opening the correct country-specific Stripe payout flow, calculating commission, preventing fraud, and paying affiliates (contract, legitimate interest, legal obligation). |
| Marketing-email preference | Recording your signup choice (legitimate interest). Marketing is sent only where consent or the product-and-service soft opt-in applies. You can unsubscribe at any time. |
Payment card, affiliate bank-account, identity-document, and verification data goes directly to Stripeand never touches our servers. Stripe acts as its own controller for payment and payout processing; see Stripe's privacy policy.
3. Plugin and browser-studio media
Caption Plug and Motion Plug run locally inside Premiere Pro. Caption Plug's bundled Whisper model transcribes on your device, so your selected audio does not leave your machine. If you deliberately select an optional OpenAI or Groq integration, the audio goes directly from your machine to that provider using your own API key and still does not pass through our servers. The software contacts our servers only when needed for account entitlement, license activation or validation, private downloads, and update checks. Motion Plug renders its transparent graphics locally; product footage is not uploaded to us.
In the browser studio, your source video stays on your device. The browser extracts a mono audio track for a video of no more than 60 seconds and sends that audio through our authenticated server endpoint to Groq for transcription. We do not log or store the audio file. Groq returns transcript text and word timestamps; those results are available as a retry cache for 24 hours so a network retry cannot charge you twice. It is then made inaccessible and removed by the next daily cleanup (within 48 hours of creation). Caption rendering and final video export happen on your device.
If you start on the free online video captioner and sign in or pay partway through, your browser keeps the chosen video and your style settings in its own local storage so the video can finish when you come back. That copy never leaves your device. It is removed once the video is made and is ignored after 24 hours.
4. Cookies
Supabase uses strictly-necessary authentication cookies to keep you logged in. Caption Plug sets pseudonymous first-party visitor and session cookies to connect page, checkout, and purchase steps. Vercel Web Analytics and Speed Insights use no advertising cookies. Analytics never contains transcript text, file names, caption text, private video data, or raw IP addresses. Blocking necessary cookies means login will not work; clearing site data resets the anonymous visitor and session identifiers.
Advertising cookies are optional. A cp_ad_consent cookie remembers your choice for 180 days. Only if you accept, the TikTok Pixel sets its own cookies (such as _ttp) and we keep a TikTok ad-click ID in cp_ttclid for 30 days, so a purchase can be matched to the ad that led to it. If you decline or later withdraw consent through “Cookie settings” in the footer, the pixel does not load, those cookies are removed, and your purchases are not reported to TikTok.
5. Where data lives and who processes it
- Supabase - database, authentication, file storage (processor).
- Stripe - payments (independent controller for the transaction).
- Vercel - website hosting and request logs (processor).
- Groq - browser-studio audio transcription (processor).
- TikTok- advertising measurement, only with your consent (joint controller for the pixel data it collects; see TikTok's privacy policy).
- Cloudflare Turnstile - account abuse prevention (processor).
- YouTube - privacy-enhanced embedded product tutorials (independent controller).
- Google Gmail - SMTP delivery and the developer support and feedback inbox (processor).
Transfers outside the EEA/UK rely on the processors' Standard Contractual Clauses / Data Privacy Framework participation.
6. Retention
- Account data: until you delete your account.
- Purchase records: as long as tax law requires (typically 6-10 years).
- Download logs: 12 months.
- Browser-studio transcript retry cache: accessible up to 24 hours, deleted within 48 hours.
- Pseudonymous caption-job abuse records: up to 45 days.
- Welcome-credit identity hash: retained to prevent repeatedly deleting and recreating an account for free credits. It cannot be reversed into your email without our separate secret.
- Support emails and product-feedback messages: up to 24 months.
- Pseudonymous product-feedback abuse events: 30 days. Message bodies are not stored with these events.
- Pending or rejected review records: up to 24 months for moderation and abuse control; approved reviews remain until consent is withdrawn or the account is deleted, subject to legal retention needs.
- First-party marketing analytics: up to 13 months, then deleted or aggregated. Vercel performance records follow the configured Vercel retention period.
- Purchase-source answers: while the related purchase record is retained, or until you ask us to delete the answer.
- Legacy Motion Plug beta applications: until you withdraw the application or delete your account.
- Affiliate applications and financial ledgers: while the programme account is active and afterward for applicable tax, accounting, fraud-prevention, and legal retention periods.
- Marketing preference: until you withdraw it or delete your account. A keyed, non-reversible suppression hash may remain afterward so a withdrawn address is not accidentally re-added.
7. Your rights (GDPR / UK GDPR / CCPA)
You can ask for access, a copy (portability), correction, deletion, restriction, or object to processing - email support@captionplug.comand we'll act within 30 days. You can complain to your local data-protection authority. We don't sell personal information. We "share" it with TikTok for advertising measurement, as defined by the CCPA, only if you accept advertising cookies; declining or choosing "Cookie settings" then "Decline" opts you out. Deleting your account removes your personal data; purchase records we're legally required to keep are retained in minimized form.
8. Security
Row-level security on every table, transactional credit reservations, Stripe-signature and Price-ID validation, HMAC-pseudonymized abuse identifiers, signed 5-minute download URLs, layered rate limits, Turnstile, strict Content-Security-Policy and HSTS, and passwords hashed by Supabase Auth. No system is perfect; if we ever detect a breach affecting you, we'll notify you as required by law.
9. Changes
We'll update this page when anything changes and bump the date at the top. See also the Terms of Service.