Privacy Policy

Controller and choices

Orian operates CAP and is responsible for its processing. Privacy contact: orianjlevari@gmail.com. Legal review status: unreviewed. CAP does not claim legal compliance. Providing information to this voluntary beta is not a legal obligation. Without an approved Google email/identifier we cannot provide account access; without a video link and its necessary contents we cannot perform a check. You may decline new processing and still contact us about your rights.

Information and purposes

We receive your verified Google email and stable Google account identifier to authenticate you, enforce invitations and assign results. We store hashed session tokens, CSRF tokens, expiring login state and policy-acceptance time/version/document hash. We do not request Google contacts, Drive, Gmail, password, date of birth or profile photo.

For a check we process the submitted URL, downloaded video/audio, transcript, description, selected frames when needed, extracted claims, search terms, retrieved source text, citations, intermediate AI requests/responses, errors and the final result. These may include information about people appearing or discussed in the material. We use them to perform and troubleshoot that check. Requests you choose to send are used for support, correction, rights handling and disputes, not AI training. Do not include unnecessary identifying or sensitive information in a video or support message.

Providers and international processing

Oracle hosts the deployed server and storage in Oracle Cloud Israel/Jerusalem (il-jerusalem-1). Google handles sign-in and receives ordinary sign-in connection information. OpenAI receives necessary transcript/description/claims, source passages and sometimes selected video frames through the Chat Completions API; when cloud transcription is enabled it receives the audio through its transcription API. CAP does not deliberately include your Google account identity in model prompts.

Tavily receives claim-derived search queries, which may contain names mentioned in a claim, and may use other search-index providers. Source websites and video platforms receive the server's requests and network information. Software/model distribution hosts may receive public dependency/model downloads; CAP does not intentionally send them video material. The contact mailbox provider receives correspondence you send there.

These services can process data outside Israel. A local Oracle region does not imply that all AI/search processing remains in Israel. The operator must confirm provider agreements, applicable safeguards and lawful transfer arrangements before launch. We do not promise all suppliers are Israeli or that a user checkbox alone satisfies transfer requirements.

OpenAI-specific controls

CAP uses direct Chat Completions with store=false, not stored Responses, assistants, fine-tuning, batches or the Files API. OpenAI states that API data is not used for training by default unless the customer opts in. Default Chat Completions abuse-monitoring retention can be up to 30 days, subject to documented exceptions; audio transcription has a different retention table. Image inputs and model prompt caching can have additional documented treatment. CAP has not verified a special zero-data-retention or regional-processing arrangement for this account. store=false and local deletion do not mean zero provider retention. Current details: https://developers.openai.com/api/docs/guides/your-data . The operator must keep optional account-level data sharing disabled unless separately reviewed and disclosed.

Visibility, cookies and logs

Other testers cannot access your results or job history. Authorized operator personnel may access necessary records for support, security and lawful requests. We do not sell personal information, use advertising analytics or add marketing cookies. Essential short-lived login and session cookies support security; local browser storage keeps the most recent job reference, and is cleared on sign-out. It is not an advertising identifier.

CAP's production console logs omit message/exception contents and record only operational metadata. A restricted security table records event time, a hashed account reference, route/action category and outcome, without raw IP addresses, browser fingerprints, transcript text or video URLs. Hashed references can still be personal data. Short-lived hashed-IP sign-in counters limit abuse; they expire. Hosting, provider and mailbox systems may keep their own logs under their arrangements.

Retention and deletion

Managed raw media and debug files expire after 24 hours. New managed reports and job-linked material expire after 30 days. Inactive accounts are scheduled for deletion after 365 days. Closed support requests expire after 180 days; unresolved requests require human follow-up. Essential security events are retained for 730 days under the beta's conservative security setting, subject to reviewed legal classification. See the Retention Policy for exact exceptions, backups, historic files and deletion timing.

Access, correction, deletion and complaints

Under applicable Israeli law you may request access to personal information and correction of information that is incomplete, unclear, inaccurate or outdated. Deletion rights depend on the circumstances and law; CAP also offers voluntary account/job deletion controls. These rights extend beyond registered users where applicable. Use account privacy controls, the request form, or orianjlevari@gmail.com. The account export includes your account metadata, jobs, acceptances and requests; ask for review of additional personal information if needed. We may verify identity proportionately and protect others' rights. Do not send an identity document unless reasonably requested through an agreed secure channel.

We aim to acknowledge within seven days and address a request within 30 days; these are service targets, not a substitute for a shorter applicable legal deadline. We will explain a lawful refusal, restriction or retention hold. You can raise concerns with Israel's Privacy Protection Authority or exercise available court rights. Foreign rights are assessed where applicable; we do not claim that the beta targets EU/UK users or that every request creates an unconditional right to erase all records.

Contact and requests

Report an incorrect or harmful result · Privacy, access or deletion · Copyright or removal

You do not need an account to email the operator. Do not send unnecessary sensitive information or identity documents.