Back to Home

Privacy Policy

Last Updated: July 9, 2026

Introduction

This Privacy Policy explains how Melda ("we," "us," or "our") collects, uses, and protects your information when you use our website, Chrome extension, and services.

By using Melda, you agree to this Privacy Policy. If you don't agree, please don't use our Service.

Information We Collect

Information You Provide

Account Information

  • Your name and email address

Connected Social Media Accounts

When you connect YouTube, TikTok, or Instagram, we access:

  • Your profile information (username, profile picture)
  • Your posted content (videos, captions, descriptions)
  • Performance metrics (views, likes, comments, shares)

Content You Save

  • Video URLs and transcripts
  • Notes, tags, and organizational data
  • Content generated through Melda

Payment Information

Our payment processor (Stripe) handles your payment information. We don't store your full credit card number.

Information Collected Automatically

  • Device Info: Browser type, operating system
  • Log Data: IP address, access times, pages viewed
  • Usage Data: Features used, actions taken
  • Cookies: Session cookies for authentication and preferences

How We Use Your Information

We use your information to:

  • Operate Melda: Provide transcription, content organization, and AI-powered features
  • Process Payments: Handle subscriptions and billing
  • Communicate: Send account updates and respond to inquiries
  • Improve: Analyze usage patterns to make Melda better
  • Comply: Meet legal obligations

AI Processing

Melda uses external AI providers to power its features. Depending on the feature, your content — source transcripts, coaching conversations, notes, and generated scripts — may be processed by:

  • OpenAI (United States) — transcription, analysis, and script generation
  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China) — content analysis and quality review. Content sent to DeepSeek is processed and stored in China under DeepSeek's own privacy policy and platform terms, which permit DeepSeek to use inputs and outputs to maintain and improve its services and underlying models.
  • Google Gemini (United States) — quality-review and evaluation workflows, where configured
  • Tavily (United States) — when you use research features, search queries derived from your draft content are sent to Tavily to retrieve supporting web sources

These providers power:

  • Transcription
  • NuggetHook templateVibeextraction
  • Script generation

Important:

  • Your content is processed only to provide Melda's features
  • Melda does not train its own AI models on your content
  • Each provider processes your content under its own terms. Where a provider's terms permit broader use of submitted data (see DeepSeek above), that use is governed by the provider's policies rather than ours.

How We Share Your Information

We do not sell your personal information.

We share information only with:

  • Service Providers: Cloud hosting (enterprise providers with SOC 2 certification), database infrastructure, payment processing (Stripe), email delivery (Resend), error telemetry (Sentry), analytics and privacy-masked session replay after consent (Google Analytics and PostHog), internal operational notifications (Slack), and AI providers - all solely to operate the Service. Slack notifications may include account contact details, signup location metadata supplied by our edge provider, subscription state, and operational failure context.
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: If Melda is acquired or merged, your information may transfer as part of that transaction

Connected Social Media Accounts

When you connect your accounts:

  • We access only data necessary to provide our Service
  • We don't post on your behalf without your explicit action
  • We don't share your social media data with other users
  • We don't sell your social media data

Revoking Access:

Disconnect anytime through Melda Settings > Connected Accounts, or directly on each platform:

When you disconnect, we delete that account's data within 30 days.

Chrome Extension

Our Chrome extension collects only:

  • Video URLs you choose to save
  • Transcripts generated from saved videos
  • Notes and tags you create

The extension does not:

  • Track your browsing history
  • Monitor websites you don't interact with through the extension
  • Access data beyond what you explicitly save

Data Retention

  • Active Accounts: Data retained while your account is active
  • Deleted Content: Workspace content is removed when you delete it or delete your account
  • Closed Accounts: Account deletion removes user-owned workspace rows, clears active sessions, and scrubs plaintext name and email from the user record. We retain a synthetic deleted-account marker, email hash, Stripe customer and subscription identifiers, and payment records where needed for billing, security, fraud prevention, legal compliance, and trial-eligibility controls.
  • Payment Records: Retained as required by law
  • Stripe Webhook Payloads: Event IDs are retained for idempotency and replay protection. Raw webhook payload bodies are redacted by an operational retention pruner after the processed-payload retention window.
  • Operational Records and Backups: Completed or failed background-job records are removed after the operational retention window. Restricted logical database backup artifacts may be retained for up to 90 days for recovery purposes.

Data Security

We protect your information with:

  • Encryption in transit (TLS) and at rest
  • Secure cloud infrastructure with SOC 2 certified providers
  • Access controls limiting employee access
  • Regular security assessments

No system is 100% secure. If you believe your account is compromised, contact us immediately.

Your Rights

All users can:

  • Access a copy of your data
  • Correct inaccurate information
  • Delete your account and data
  • Disconnect social media accounts
  • Opt out of marketing emails

For EEA/UK Residents (GDPR)

You also have rights to data portability, restriction, objection, and withdrawal of consent. You may lodge complaints with your local data protection authority.

Legal Basis: We process data based on contract (to provide the Service), consent (for marketing), and legitimate interests (to improve and protect the Service).

For California Residents (CCPA)

You have the right to know what we collect, request deletion, and opt out of data sales. We do not sell personal information.

To exercise any rights, email info@melda.co

International Data Transfers

We're based in the United States and process data here. For users in the EEA, UK, or Switzerland, we use Standard Contractual Clauses and other appropriate safeguards.

Children's Privacy

Melda is not for users under 16. We don't knowingly collect information from children under 16. If we discover we have, we'll delete it promptly.

Cookies

We use:

  • Essential Cookies: Required for authentication and security
  • Analytics Cookies: Google Analytics and PostHog analytics/session replay load only after you accept analytics cookies. PostHog replay masks text and form inputs and excludes request bodies and headers.
  • Preference Cookies: To remember your settings

You can control cookies through the banner or your browser. Declining analytics cookies prevents Google Analytics and PostHog analytics/session replay from loading. You can change the authenticated-app preference from Account at any time. Disabling essential cookies may affect functionality.

Opt out of Google Analytics: tools.google.com/dlpage/gaoptout

Third-Party Platform Disclosures

YouTube API Services

Melda uses YouTube API Services and adheres to the Google API Services User Data Policy, including Limited Use requirements: developers.google.com/terms/api-services-user-data-policy

Google Privacy Policy: policies.google.com/privacy

Meta Platform (Instagram)

We comply with Meta's Platform Terms: developers.facebook.com/terms

Meta Privacy Policy: facebook.com/privacy/policy

TikTok API

We comply with TikTok's Developer Terms: developers.tiktok.com/terms

TikTok Privacy Policy: tiktok.com/legal/privacy-policy

Changes to This Policy

We may update this Privacy Policy. We'll notify you of material changes by:

  • Posting the update with a new date
  • Emailing you for significant changes

Continued use after changes means you accept the updated policy.

Contact Us

Questions about this Privacy Policy? Email us at info@melda.co

Effective as of June 23, 2026