goa ← Back to Goa

Legal

Privacy Policy

Last updated: 29 July 2026

Who we are

Goa ("Goa", "we", "us") provides an AI video studio at app.getgoa.io and this marketing site at getgoa.io. Goa is the data controller for the personal data described here. For any privacy question, email support@getgoa.io.

What we collect and why

We keep data collection to the minimum needed to run an invite-only early-access product.

  • Account details. You sign in either with Google or with an email address and password. If you use Google, Google shares your email address, name, and profile picture with us to create and identify your account, and we never receive your Google password. If you use a password, we store it only as a salted hash. Legal basis: performance of a contract (providing the service you request).
  • What you make in Goa. Running the studio means storing your work: project names and notes, the prompts and instructions you write, anything you upload, the images, voiceovers, video and transcripts our engines produce for you, and the timelines and compositions you assemble. We process this to provide the service and to show it back to you. Legal basis: performance of a contract.
  • Product analytics. With your consent, we use PostHog (EU-hosted) to understand which plans and pages resonate - for example, page views and which plan buttons are clicked. Analytics cookies are set only after you accept the cookie banner. Legal basis: consent. You can decline and still use the site.
  • Support messages. If you email us, we keep your message and contact details to reply and improve the product. Legal basis: legitimate interest.

We do not sell your data or run third-party ad tracking. We do not use your work to train our own models. Generating anything means sending your prompts and input media to the model provider that runs that engine - see Who we share with - where their own terms govern what happens to it.

Cookies

The site sets no analytics or tracking cookies until you accept the banner. If you accept, PostHog stores a first-party identifier (scoped to .getgoa.io) so your visit can be understood across our marketing site and app. If you decline, no analytics cookie is stored. You can clear cookies or change your choice at any time by clearing site data in your browser.

Who we share with

  • AI model providers - Goa does not train or run its own generative models. When you generate something, the prompt and any input media for that step go to the provider running the engine you chose: Replicate (image and video models), ElevenLabs (voice), and OpenAI (transcription). We send only what that step needs for that step, and each provider then handles it under its own terms and privacy policy.
  • Google - authentication, if you sign in with Google.
  • PostHog - product analytics, EU-hosted, only with your consent.
  • Amazon Web Services (AWS) - cloud hosting and infrastructure; this site is served from AWS S3 and CloudFront.
  • An AI client you connect yourself - only if you choose to. See Connected agents.

We may disclose information if required by law. If we ever transfer data outside your region, we rely on appropriate safeguards such as Standard Contractual Clauses.

Connected agents (MCP)

Goa can be driven by an AI agent instead of by you clicking - Claude Code, ChatGPT, Codex, Cursor, or any other client that speaks MCP. This only happens if you set it up.

  • What a connected client can reach. A client you authorise acts as you: it can read and change what is in your Goa projects - assets, transcripts, timelines and compositions - and it can spend your credits on generation. Whatever it reads leaves Goa for that client and is then handled under that provider's privacy policy, not this one.
  • How you authorise it. Either a browser sign-in and consent screen (ChatGPT, Claude on the web), or an access token you generate in the app. Both are per-client, and you can revoke either at any time - from your client's own settings, or from Goa.
  • Bounds. Paid steps quote their cost before they run, and spend stays capped by your credit balance and a daily limit you set on the connection.

Setup guides and the security notes for every client are public at github.com/OmriGanor/goa-mcp.

How long we keep it

We retain your account details while your account is active and for a reasonable period afterwards, then delete or anonymise them. Your projects and everything in them are kept while your account is active so you can come back to them, and are deleted with your account - ask us and we will delete a project sooner. Because access is invite-only, sign-ups are held on our access list until we onboard you; you can ask us to remove you at any time. Analytics data is retained for up to 12 months.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent for analytics. To exercise any of these, email support@getgoa.io and we will respond within the time your law requires. You may also complain to your local data-protection authority.

Changes

We will update this policy as the product evolves and note the date at the top. Material changes will be communicated before they take effect.

Contact

Questions about privacy? Email support@getgoa.io.