Privacy Policy
Who is responsible
[Legal name — not set yet] (ViduciaStudio), [Business address — not set yet], KvK [KvK number — not set yet], is the controller of the personal data described here. Questions or requests: [email protected].
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, display name, password (stored only as a one-way hash), the email codes we send you | Your account, signing in, security notices | Contract |
| Phone number, if you verify one (kept only as a keyed hash and the last digits) | One free trial per person | Legitimate interest (preventing abuse) |
| A hashed identifier of your computer, its name, Windows version and app version | Rendering on your computer, signed-in devices, one free trial per computer | Contract; legitimate interest |
| Your plan, payments, invoices and refunds (card details stay with Stripe; we keep a keyed hash of the card’s fingerprint) | Billing, tax records, one free trial per card | Contract; legal obligation; legitimate interest |
| What you make: templates you add, topics, scripts, voice-overs, project files and videos, and the tasks you run and their cost | Providing the service; showing your usage and allowance | Contract |
| Public YouTube data of channels you ask us to analyse | Analytics and video planning | Contract |
| Free channel audit checks: keyed hashes of your email address, account, computer, browser and the network you connect from (an IPv4 address, or the first half of an IPv6 address) | One free audit per person every 3 days | Legitimate interest (preventing abuse) |
| On the website: a sign-in cookie, a random identifier for your browser (a cookie), and the result of the Cloudflare Turnstile security check | Signing in on the website; telling people from automated sign-ups; one free audit per browser | Contract; legitimate interest (preventing abuse) |
| Technical records: which features are used, request timings and errors (IP addresses are used only briefly for rate limits and stored as keyed hashes) | Security, reliability, improving the service | Legitimate interest |
| Messages you send us, and withdrawal or deletion requests | Answering you; proving we handled them | Contract; legal obligation |
We do not sell your data, use it for advertising, or train AI models on it.
Who processes it for us
- Google Cloud (Vertex AI / Gemini, Text-to-Speech): topics, scripts and pictures are sent to generate scripts, voices and picture checks. Google acts as our processor under its data processing terms for paid services, which do not allow it to use this data to train its models.
- Stripe: payments and subscriptions. Stripe is also an independent controller for fraud prevention and legal duties: stripe.com/privacy.
- Email providers (Resend, Brevo): delivering account emails.
- Firebase Authentication (Google), only if phone verification is used: sending the SMS code.
- YouTube API Services: reading public channel and video information.
- Cloudflare: serves the website, carries the connection between the website or app and our servers and protects it from attacks, stores project files, and runs the Turnstile security check on sign-up, password reset and free audits on the website.
- Our hosting provider, which runs the ViduciaStudio servers, and our backup storage provider, which keeps encrypted copies of the database.
Some of these companies are in the United States. Transfers are covered by the EU–U.S. Data Privacy Framework and, where needed, the European Commission’s standard contractual clauses.
YouTube
ViduciaStudio uses YouTube API Services. YouTube’s Terms of Service (youtube.com/t/terms) and Google’s Privacy Policy (policies.google.com/privacy) apply to that data. We read public channel and video statistics for the channels you choose, refresh them at least every 30 days (or delete them if they could not be refreshed), and delete them when you remove the channel. You only enter a channel’s public handle: you never sign in to YouTube through ViduciaStudio.
How long we keep it
- Account data and what you make: until you delete your account, then deleted.
- Files of a project you discard, or of one whose render failed and was refunded: deleted 14 days after the project closed. The project’s record (its title, cost and history) stays in your account.
- Database backups: kept for up to 30 days, then overwritten; deleted data leaves the backups within that time.
- Payment, invoice and refund records: 7 years, because Dutch tax law requires it (without your other data).
- Offer checks (keyed hashes of an email, computer, phone or card, which cannot be read back): kept to stop repeat free trials.
- Free audit checks: deleted a week after your next free audit becomes available.
- Sign-in sessions: 30 days after last use, at most 90 days.
- Technical records: request records 2 to 90 days depending on the kind; product usage events up to a year. Records of each AI and voice call made for your tasks (cost, timing, errors) and of payment notifications are kept with the payment records. Server logs contain no IP addresses.
- Public YouTube data: refreshed or deleted within 30 days; deleted at once when you remove the channel. Figures worked out from it that you applied to a video (for example a typical view count) stay with that video’s project until you delete it.
Your rights
You may see, correct, download, or delete your data, restrict or object to its use, and withdraw consent you gave. Most of this is in the app: Settings → Your data → Download my data and Delete account. For anything else email [email protected]; we answer within one month. You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
On the website
The website uses no tracking and no advertising cookies. When you sign in there it sets two cookies that only our servers can read: __Host-vs_rt keeps you signed in (until you sign out; without “Remember me”, until you close the browser; otherwise 30 days after your last visit, at most 90 days), and __Host-vs_dev holds a random identifier for your browser (400 days) so a free audit is counted once per browser. Both are needed for what you asked the website to do. Signing up, resetting a password and starting a free audit include the Cloudflare Turnstile check, which looks at technical signals from your browser to tell people from automated programs.
On your computer
The app sets no cookies and no tracking. If you choose “Remember me”, a sign-in key (never your password) is kept in Windows Credential Manager on your computer; signing out removes it. Your videos and project files are stored in your Windows user folder until you remove them.
Security
Connections are encrypted; passwords are hashed with Argon2; secrets stored in our database are encrypted and server keys are kept in access-restricted configuration; administrators sign in with two-factor authentication; access is logged. If a breach puts your data at risk we tell you and the authority as the law requires.
Children
ViduciaStudio is for people aged 18 and over. We close accounts we learn belong to someone younger.
Changes
We may update this policy and will tell you about important changes by email or in the app.