Privacy policy

The controller is Quintessence Consulting Group LLC, 1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, United States. Privacy contact: grabaliastudio@iapacks.com.

We process only the data needed to provide, protect and charge for the service.

• Account: email address, user identifier and, when Google is used, the name and avatar available in your profile.
• Licence and device: plan, status, device identifier and label, activation and activity dates.
• Payment: Stripe references, amount, currency, subscription state, receipt, refund or dispute. GrabaliA does not receive your full card number.
• Legal acceptance: accepted versions, date, source and age confirmation.
• Support: information you choose to send by email or WhatsApp.

Videos, audio, images, projects, captions, scripts, thumbnails and editor preferences are processed and stored in your browser or device. They are not uploaded to GrabaliA servers.

When you connect the mobile teleprompter, the script and controls are encrypted on the devices and transmitted through Supabase Realtime. Supabase carries encrypted messages and connection metadata; GrabaliA does not store the remote script as content. The QR contains the access key: do not share it publicly. The reader tab keeps that key in sessionStorage for up to four hours to support reloading; Disconnect removes it.

Screen, camera and microphone are captured only after you grant the relevant permission. The desktop add-on may read pointer position and clicks while recording to create local effects; it does not record what you type.

We use account, licence and device data to perform the contract, grant access, apply plan rules and prevent abuse. Payment references are used to perform purchases and meet accounting, tax and legal-claim obligations. Service security and fraud prevention rely on legitimate interests that do not override your rights. Where processing relies on consent, you may withdraw it without affecting earlier processing.

Vercel hosts the application and server functions; Supabase provides authentication and account storage; Stripe processes payments and subscriptions; Google provides optional sign-in and on-demand fonts; Bunny CDN distributes installers.

If you enable AI with your own key, your browser sends caption text and instructions directly to OpenAI, Anthropic or Google Gemini, as selected by you. GrabaliA does not proxy that request.

The controller is based in the United States and some providers may process data outside the EEA. Where applicable, processing relies on an adequacy decision, valid provider participation in the EU-US Data Privacy Framework, Standard Contractual Clauses or another permitted mechanism. You may ask which mechanism applies by contacting us.

Account, licence and device data is retained while the account or relationship is active and afterwards for as long as necessary to settle contractual duties or claims. Billing references are retained for applicable tax and accounting periods. Acceptance evidence is retained for the contractual relationship and the period needed to prove the agreement.

Support messages are removed when no longer needed to handle the request or protect rights. Local content remains until you delete it, clear browser data or the system frees storage. Providers apply their own backup and log cycles under their terms.

Technical cookies keep the session active and remember the theme. The editor uses localStorage, sessionStorage and IndexedDB for projects, media, preferences, the device identifier and BYOK keys. Optional Free advertising (updated 21 October 2026): when the administrator enables AdSense, Google receives technical connections to display its consent manager. Ad requests wait for that manager’s signal. Google and its providers may process identifiers, cookies, IP addresses and device information according to the choices made. You can decline and change your choice through Advertising privacy in the account menu; editing and downloading remain available. The advertising integration does not attach project files or scripts to ad requests. Pro and Founder do not load advertising units. Google Analytics behavioural tracking has not been integrated.

Where applicable, you may request access, correction, deletion, restriction, objection or portability, and withdraw consent, by writing from your account email to grabaliastudio@iapacks.com. We may request reasonable identity verification.

EEA users may complain to their local supervisory authority; users in Spain may contact the Spanish Data Protection Agency at aepd.es. You may request account deletion, subject to records that must be retained by law.

GrabaliA Studio is intended only for people aged 18 or over. We do not knowingly create accounts for minors.

We use HTTPS, access controls, server-only private keys and database security rules. No system is infallible; report suspected incidents to grabaliastudio@iapacks.com.

Changes will be published here with a new version and date. When a change is material, we will request a new acceptance before continued use of features governed by the updated terms.