This Privacy Policy explains how SameHook ("we", "us", or "our") collects, uses, and shares information when you use our website at www.samehook.com and our creative tools. It also explains how to contact us about your data.
Information we collect
- Account information: your name, email address, verification status, and account identifiers. If you use Google or GitHub, we receive your basic profile, profile picture URL, and provider account identifier. For email and password accounts, we store a salted password hash rather than your password in plain text. We also process verification and password reset requests.
- Creative inputs: reference links, product descriptions, structure cards, audience and angle settings, and other text you submit to create a preview. Reference images and videos selected in the current studio are read in your browser; their file contents are not uploaded by that feature. A filename may be used as product text and then submitted as part of a structure card.
- Billing information: your plan, credit usage, payment status, and Stripe customer, subscription, checkout, and invoice identifiers. Stripe collects payment details directly on its hosted pages. SameHook does not receive or store your full card number or card security code.
- Technical and usage information: session identifiers, page visits, feature interactions, and information needed to operate and protect the website. Our hosting and infrastructure providers may process IP addresses, browser information, and request logs.
- Support information: information you choose to send when you contact us. Please do not email passwords, verification codes, or full payment card details.
How we use information
Where applicable law requires a legal basis, we process information to perform our agreement with you, for legitimate interests such as service security and improvement, to comply with legal obligations, or with your consent where required.
- Create and authenticate accounts, maintain sessions, and let you access your account across devices.
- Process the inputs you submit, retrieve a reference page when you request it, and generate structure cards, scripts, and preview storyboards.
- Process payments, maintain subscriptions and credit balances, and provide billing support.
- Send verification and password reset emails, respond to support requests, and communicate account or service information.
- Understand aggregate usage, troubleshoot problems, prevent abuse, and meet applicable legal obligations.
Creative content and AI processing
When AI-assisted copy generation is enabled, the structure card, creative settings, and storyboard instructions you submit are sent through Vercel AI Gateway to the configured model provider. The application does not automatically add your sign-in profile or email address to these AI prompts. Information you include in the creative text itself will be processed with that text.
The current application does not save your creative inputs or generated previews in its account database; the studio keeps the working content in the current browser page. This does not mean all processing is local: submitted inputs are handled by our server and, when enabled, the AI services described above. Infrastructure and AI providers may retain information under their own policies and applicable service settings. Do not submit confidential or personal information you do not have permission to share.
Google user data and Limited Use
Google sign-in requests only basic identity, email, and profile information. We use it for user-facing account features, including sign-in, displaying your profile, and account communications. If you choose to purchase a subscription, your account name and email may also be provided to Stripe to create your billing customer. We do not request access to Gmail, Google Drive, or your contacts.
SameHook's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. Transfers are limited to what is permitted by that policy, including providing the user-facing features you request, security, legal obligations, or a business transfer with the required consent. Human access is limited to circumstances permitted by the policy, such as your consent, security investigations, legal requirements, or aggregated and anonymized internal operations.
Service providers and sharing
We do not sell your personal information. We share information with service providers as needed to provide the features you use. These providers handle information under their applicable terms and privacy policies.
We may also disclose information when required by law, to protect users and the service, or in connection with a business transfer subject to applicable safeguards and any required consent.
- Google and GitHub: authenticate your account when you select their sign-in options.
- Neon: store account records, authentication records, studio session and credit records, and billing records.
- Stripe: process subscriptions and payments and provide the customer billing portal. Your account name, email, and an internal account reference are sent when a billing customer is created.
- Resend: deliver account verification and password reset emails using your email address and the email contents.
- Vercel and related infrastructure: host the service and provide website analytics; Vercel AI Gateway and the selected model provider process creative inputs when AI features are enabled.
- Google Fonts: deliver the website's fonts, which involves a request from your browser to Google's font services.
Retention and security
We retain account, usage, and billing records for as long as needed to provide the service and for legitimate security, accounting, dispute-resolution, or legal purposes. Verification and reset credentials expire after a limited period; expiration does not necessarily mean their database records are immediately erased. Service-provider logs and backups follow their applicable retention schedules.
We use measures such as HTTPS in production, password hashing, and limited authentication token validity to protect information. No storage or transmission method is completely secure. If you believe your account has been compromised, contact us promptly.
Your rights and choices
Depending on your location, you may have rights to access, correct, receive a copy of, or request deletion of your personal information, and to object to or restrict certain processing. You may also have the right to withdraw consent or complain to your local data protection authority.
To request account deletion, a copy of your data, or another privacy action, email support@samehook.com from your account email address. We may need to verify your identity and retain records where legally required. The current service does not offer an automatic self-service account deletion or data export button.
You can revoke SameHook's authorization in Google or GitHub settings. Revoking authorization or signing out does not by itself delete your SameHook account or cancel a subscription. You can manage subscription renewal through the account billing portal, or contact support if you cannot access it.
International processing and children
Our providers may process information in countries other than your own, including the United States. Where applicable law requires it, appropriate safeguards must apply to international transfers.
SameHook is intended for people creating and managing advertising materials and is not directed at children. If you believe a child has provided personal information without any consent required by applicable law, contact us so we can review and address it.
Changes and contact
We may update this policy as the service changes. We will update the date on this page and provide additional notice or seek consent when required by law.
For questions about this policy or your personal information, contact SameHook at support@samehook.com.