Oxalume
DRAFT — not a final policy. This text is under owner and legal review. Items highlighted like this are still to be confirmed.

Oxalume — Privacy Policy

Status: Draft for owner and legal review

Effective date: [TO BE CONFIRMED]

Operator: Digital Alchemy LLC, a Delaware limited liability company (United States), operating under the name Oxalume.

Business postal address: 304 S. Jones Blvd #3461, Las Vegas, NV 89107, United States

Privacy contact: support@oxalume.com

Website: https://oxalume.com

1. Introduction

Digital Alchemy LLC ("Oxalume," "we," "us," or "our") operates Oxalume, an invite-only platform for planning, generating, managing and publishing AI-assisted short-form videos.

This Privacy Policy describes how we collect, use, store, disclose and protect personal information when you use our website, application and related services.

Oxalume is intended for users aged 18 or older.

2. Information We Collect

Depending on your use of the Service, we may process:

Access and contact information: The invitation access token you use to sign in, your email address when you receive an invitation or contact us, communications with support and beta-access records.

Project information: Video ideas, scripts, prompts, storyboards, scene descriptions, generated images, narration, subtitles, videos, project settings and production history.

Technical information: IP addresses, browser and device information, request timestamps, diagnostic logs, security events and service usage information.

AI usage information: Requests to AI providers, model identifiers, usage measurements, estimated or actual processing costs and generation outcomes.

Connected YouTube information: When you authorize a YouTube connection, we may access your YouTube channel ID, channel name, handle, profile image, authorization tokens and information needed to manage authorized uploads.

Publishing information: Videos selected for upload, titles, descriptions, privacy settings, scheduled publishing information, approval decisions, upload status and related operational history.

We do not ask for your Google or YouTube account password.

3. How We Use Information

We process information to:

We do not sell personal information or YouTube authorization data.

4. AI Processing

Oxalume uses third-party AI services, including OpenAI, to generate and process content.

Information sent to AI providers may include your prompts, scripts, scene descriptions, narration text and relevant reference images.

To maintain character consistency, Oxalume may send an earlier generated image from the same video as a reference when creating a later scene.

AI providers process this information according to their applicable contractual terms and privacy practices.

Users should not submit confidential or sensitive personal information unless necessary and authorized.

5. YouTube API Services

Oxalume uses YouTube API Services to connect your YouTube channel and support authorized video publishing.

When you connect YouTube, Oxalume requests permissions that allow it to:

Oxalume does not publish a video merely because you connected a channel.

Before an upload, you must approve the publishing action and the relevant settings, including the destination channel and video visibility.

Your use of YouTube through Oxalume is also subject to the YouTube Terms of Service.

You can review Google's privacy practices in the Google Privacy Policy.

You can revoke Oxalume's access to your Google account at any time through the Google security settings page (also reachable from Google's third-party connections settings).

You may also disconnect your YouTube channel from Oxalume. Use Google's settings to revoke authorization directly. [VERIFY DISCONNECT REVOCATION AND CLEANUP BEFORE PUBLICATION]

Oxalume's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Oxalume does not use information received from Google APIs to develop, improve or train AI models, does not sell it and does not use it for advertising.

The Limited Use statement above is a policy commitment. [VERIFY GOOGLE DATA FLOWS AND PROVIDER TERMS BEFORE PUBLICATION]

6. YouTube Data Storage and Deletion

Oxalume processes authorization tokens, connected channel details (ID, name, handle and profile image), and YouTube video IDs and links needed for authorized publishing.

You can disconnect a channel in the application under Channels → YouTube, revoke authorization through the Google security settings linked above, or request deletion of stored YouTube-related information at support@oxalume.com.

Required handling under review: Stored YouTube API data must be refreshed or deleted as required by the YouTube API Services policies. The YouTube Developer Policies require deletion of stored user data as soon as possible and within 7 calendar days of a deletion request; in-app consent revocation requires immediate token revocation and deletion of authorized data within 7 calendar days; revocation through Google settings requires associated API-data deletion within 30 calendar days. Other stored authorized data covered by section III.E.4.c must be refreshed or deleted within 30 calendar days. These are policy requirements, not a claim that the Candidate12.6 safeguards have been deployed. Implementation must be verified for each category. [VERIFY YOUTUBE DATA LIFECYCLE AND DELETION DEADLINES BEFORE PUBLICATION]

Disconnect behavior: Disconnecting ends use of the channel in Oxalume. The exact token revocation, metadata cleanup and treatment of queued uploads require backend verification. [VERIFY DISCONNECT IMPLEMENTATION BEFORE PUBLICATION]

Oxalume's own project and publishing records are retained until user deletion, subject to documented operational and legal retention. YouTube API data is subject to its separate policy requirements. The operational schedule is under review as described in section 9.

Deleting information from Oxalume does not delete videos or other information stored on YouTube. You must manage that content separately through YouTube.

7. Service Providers

Oxalume relies on service providers for infrastructure and functionality, which may include:

We disclose information to service providers only as reasonably necessary for the services they perform, subject to applicable agreements and safeguards.

Hosting location: United States — Boston 2 (Hostinger)

8. International Data Transfers

Because Oxalume is operated by a U.S. business and uses third-party infrastructure and AI providers, information may be processed in countries other than your country of residence.

Applicable transfer safeguards must be identified and verified before publication; this draft does not confirm that any particular mechanism or provider agreement is in place.

Specific transfer safeguards and applicable jurisdictions: [CONFIRM BEFORE PUBLICATION]

9. Data Retention

We retain project information and generated media until you delete the project in Oxalume or ask us to delete it, subject to the operational periods below and legal requirements.

Operational and legal retention: [DOCUMENT AND VERIFY RETENTION SCHEDULE BEFORE PUBLICATION]

10. Security

We use technical and organizational safeguards designed to protect information, including encrypted transport, access controls, restricted storage, token protection and operational monitoring. [VERIFY DEPLOYED SECURITY SAFEGUARDS BEFORE PUBLICATION]

No system is completely secure, and we cannot guarantee absolute security.

11. Your Privacy Rights

Depending on applicable law and your location, you may have rights to access, correct, delete, export or restrict the processing of your personal information, or to object to certain processing.

You may also have rights to withdraw consent and complain to an applicable data-protection authority.

To exercise your rights, contact support@oxalume.com.

We may need to verify your identity before processing a request.

12. Cookies and Similar Technologies

Oxalume may use cookies or similar technologies necessary for authentication, security and OAuth authorization. The frontend stores your access token in session storage for the current tab only if you select that option, and stores the last job ID in local storage on your device. The OAuth cookie inventory and expiry require verification. [VERIFY COOKIE INVENTORY BEFORE PUBLICATION]

We will separately disclose and obtain consent for any optional analytics, advertising or nonessential tracking technologies where required.

13. Children

Oxalume is intended only for individuals aged 18 or older.

Although users may create educational videos intended for children, children are not intended users of the Oxalume platform.

If we discover that an underage individual has provided personal information directly to us, we will take appropriate steps to remove it.

14. Changes to This Policy

We may update this Policy to reflect changes in our services, legal requirements or data practices.

Material changes will be communicated as required by applicable law. Where required, we will obtain renewed consent before processing data for materially different purposes.

15. Contact

Digital Alchemy LLC — Oxalume

Email: support@oxalume.com

Business postal address: 304 S. Jones Blvd #3461, Las Vegas, NV 89107, United States

Applicable privacy laws and supervisory authorities: [TO BE CONFIRMED]