Privacy Policy

This Privacy Policy explains how Manic Nova Games Oy, operating as Manic Nova Software, Voudinkatu 5 B 21, 20780 Kaarina, Finland ("VideoAskable", "we", "us", or "our") processes personal data when you use VideoAskable.

Contact and data protection contact: contact@manicnovasoftware.com .

Controller: Manic Nova Games Oy, operating as Manic Nova Software, Voudinkatu 5 B 21, 20780 Kaarina, Finland.

Business ID: FI32975945.

Effective date: 18 October 2026.

For individual users and most account, billing, security, support, analytics, and product operations, we act as controller.

If a Business User submits personal data and independently determines why it is processed, we may act as processor or subprocessor under an applicable Data Processing Addendum.

Some activities involve both roles. We may process Input as a processor to provide results to a business customer while processing account, billing, fraud-prevention, and service-security data as a controller.

Depending on how you use the Service, we may process and, where necessary, store:

• Account data: name, email, authentication identifiers, settings, account status, and contact preferences. For email sign-in, we pass your password to our sign-in provider. We do not receive your Google or Apple password.
• Billing data: plan, subscription, credits, top-ups, invoices, receipts, payment status, Stripe or customer IDs, tax details, billing address, refunds, and chargebacks. We do not store full card numbers.
• Usage data: feature use, credit reservations, debits and refunds, quotas, error states, request status, timestamps, and limited diagnostics.
• Service input and output data: prompts, search queries, YouTube links, generated Outputs, and feedback. We process this data to answer your requests. Searches, results, and follow-up conversations are saved automatically so you can return to them in your history.
• Technical data: IP address, approximate location, device and browser data, user agent, session IDs, logs, essential cookies, security events, and performance metrics.
• Support data: messages, attachments, troubleshooting information, call notes, and communications.
• Fraud and abuse signals: rate-limit events, failed payments, suspicious activity, coarse network signals, and similar risk signals if enabled.
• Marketing data: newsletter preferences, campaign source, referral data, consent, and opt-out records.

We do not store copies of YouTube video files as part of the production Service. We may temporarily process information made available through a YouTube link as needed to answer a request.

Information you submit or request may contain personal data about you or others. You are responsible for having the rights, notices, permissions, and lawful basis needed to submit or request it.

We collect personal data:

• directly from you;
• automatically from your device and use of the Service;
• from providers involved in account access, payments, support, security, analytics, and Service functionality;
• from third-party platforms or external sources you submit, request, or authorize, such as YouTube-related services.

The Service uses YouTube API Services for certain search and information features. At launch, we may receive public video and channel identifiers, titles, descriptions, thumbnails, availability information, and related metadata. We do not request private YouTube account data or channel actions at launch. YouTube-related features are also subject to the Google Privacy Policy .

Information requested through a YouTube link may concern people who are not Service users. Where GDPR Article 14 applies, we assess notice requirements and exceptions. Affected people may contact us to exercise their rights.

Where GDPR applies, we process personal data under these legal bases:

• Contract: when processing data about the contracting user is objectively necessary for account access, requested searches and Outputs, subscriptions, credits, support, and paid features.
• Legal obligation: for billing records, invoices, tax, accounting, payment compliance, authority requests, and other legal requirements.
• Legitimate interests: to provide requested analysis involving publicly available source information, secure and operate the Service, prevent fraud and abuse, manage quotas, diagnose errors, improve reliability, and establish or defend legal claims. You may object as described below.
• Consent: when required for non-essential cookies, certain marketing communications, or optional use of private user content for shared AI model training.

We do not use private user content to train shared AI models unless you opt in or separately agree.

The Service is not designed to identify or infer sensitive traits. Requested source material may incidentally reveal special-category data. Where GDPR applies, we process it only when both an Article 6 basis and an applicable Article 9 condition exist. We may refuse or limit a request when no appropriate condition is available.

We may share personal data with:

• hosting, database, storage, and infrastructure providers;
• authentication and identity providers;
• payment processors, billing and tax providers, fraud-prevention services, and banks;
• AI-related, search, and content-processing providers;
• monitoring, logging, security, email, customer-support, and communication providers;
• professional advisors, auditors, insurers, and legal counsel;
• business transferees in a merger, acquisition, financing, restructuring, or sale of assets;
• authorities, courts, regulators, or rights holders where legally required or necessary to protect rights, safety, security, or compliance;
• account administrators and users you authorize if account-sharing features are offered;
• third-party platforms you connect or instruct us to use.

We require providers to process personal data under contractual and confidentiality obligations appropriate to their role. We do not identify a provider as current until its production use and applicable terms have been verified.

We may send your prompt, search query, and context needed to answer your request to AI-related providers. We select settings and contracts intended to prohibit shared-model training and limit unauthorized use and retention.

We do not use private prompts, search activity, or related Service activity to train foundation or shared AI models unless you opt in or separately agree.

Our personnel do not routinely review private Service activity. Access is limited to people with a need to know for user-requested support, fraud, abuse, security, billing, copyright or legal matters, compliance, or a production failure that cannot reasonably be resolved otherwise.

We may process and store personal data outside your country. If personal data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, we use Standard Contractual Clauses or another lawful safeguard where required.

We keep personal data only as long as reasonably necessary for the purposes in this policy, unless law requires or permits longer retention.

• Account information is kept while your account is active. After deletion, account data is normally deleted or anonymized within 90 days unless needed for legal, billing, security, fraud-prevention, or dispute reasons.
• Billing, invoice, subscription, refund, tax, payment-status, and credit-ledger records are normally kept for up to 7 years where required for accounting, tax, payment, chargeback, and legal obligations.
• Search prompts, YouTube links, results, and associated conversations are saved automatically and are normally retained for up to 365 days. Deleting a search from history removes its history entry and Ask More conversations. The original search question and result remain until routine cleanup or account deletion. Records may be retained longer for support, security, fraud prevention, legal claims, or legal obligations.
• Support communications are normally kept for up to 3 years after closure unless needed longer for legal, security, fraud-prevention, or dispute reasons.
• Security, fraud-prevention, rate-limit, audit, and diagnostic logs are normally kept for up to 12 months unless needed longer for an investigation, legal claim, security incident, or compliance obligation.
• Marketing consent and opt-out records are kept as needed to honor your choices and legal requirements.
• Backups may retain deleted data for up to 90 days before overwrite unless preserved for disaster recovery, security, or legal hold.
• Aggregated or de-identified data may be kept indefinitely if it cannot reasonably identify anyone. Pseudonymized data remains personal data.

Depending on where you live, you may have rights to:

• access personal data;
• correct inaccurate personal data;
• delete personal data;
• restrict or object to processing;
• receive a portable copy of certain data;
• withdraw consent;
• opt out of direct marketing;
• lodge a complaint with a data protection authority;
• avoid certain solely automated decisions with legal or similarly significant effects.

To exercise rights, contact contact@manicnovasoftware.com . We may need to verify your identity. Rights may be limited by law, security, billing, legal claims, third-party rights, or our role as a processor.

You may complain to the Finnish Data Protection Ombudsman at tietosuoja.fi or another competent authority in your country of residence or work.

If we process data for a business customer, we may direct your request to that customer or follow its instructions.

The Service does not make solely automated decisions about you that produce legal or similarly significant effects. AI-assisted search and Output generation do not determine eligibility for high-impact entitlements.

To diagnose whether campaign links reach the website and receive an HTTP response, our server request logs include a fixed label for approved Google and YouTube campaigns, a coarse navigation, prefetch or known-bot category, HTTP status, timing and a per-request delivery identifier. These 14-day diagnostic logs do not contain IP addresses, full URLs, search parameters, referrers, user agents, account IDs or browser identifiers. This server-side diagnostic processing does not set or read cookies or browser storage and operates independently of your optional analytics choice. Reports count requests, not unique people, and do not link requests to consented visits or accounts.

We use essential cookies and browser storage for login, security, preferences, billing sessions, and core Service functionality.

We do not use non-essential analytics, advertising, or marketing cookies unless they are listed in the Cookie Policy and valid consent has been obtained where required.

Optional first-party site analytics is collected only with your consent. It measures site visits, search starts, successful searches, and result openings using fixed source categories, approved campaign labels, a random visit ID lasting up to 30 minutes, and a random browser ID lasting up to 30 days. The browser ID estimates returning browsers without linking to your account. Analytics records do not contain questions, video links, results, account IDs, full referrer URLs, IP addresses, or device fingerprints. Known bot user agents are filtered without storing them in analytics. Reports exclude event records after 30 days; hourly cleanup removes them, normally within one additional hour. Change or withdraw your choice through Privacy settings; withdrawal clears the visit and browser identifiers and does not affect access to the Service.

With analytics consent, your browser also keeps temporary references to newly completed searches until their original visit expires, for at most 30 minutes. These references let a first result opening remain associated with the original visit after reloading or reopening History, including in another tab. They stay in your browser, are not included in analytics requests, and are cleared when you withdraw consent. They contain no questions, video links or answer text.

We use administrative, technical, and organizational measures designed to protect personal data, including controls appropriate to the verified production environment. No internet service can be guaranteed to be fully secure.

If we become aware of a personal data breach, we assess it and notify affected users or regulators where required by law.

The Service is not intended for children under 16. Users under 18 need permission from a parent or legal guardian. Do not submit personal data of children unless you have legal authority and required consents.

We may update this Privacy Policy. If changes materially affect your rights or our processing, we provide reasonable notice.