Privacy Policy

DRAFT — pending legal review. This text is a structural placeholder for the GDPR Art. 13/14 notice. It has not been written or approved by counsel and must not be relied on until it is replaced by a reviewed version.

1. Controller and contact

The controller for account data in the EU region is [legal entity name, address, registration number — to be confirmed by counsel]. Data protection contact: [DPO or privacy contact — to be confirmed by counsel].

For workspace content (your clients, projects, files), the workspace owner is usually the controller and we act as processor under the Data Processing Agreement.

2. Data we process

• Account data: name, e-mail address, password hash, sign-in sessions, language and display preferences.
• Workspace data: studio profile, members and roles, clients and contacts, leads, quotes, contracts, projects, tasks, calendar entries, invoices and expenses.
• Files and media: uploaded files, video deliverables, review comments and timestamps.
• Client portal activity: actions taken through portal and token links you share.
• Communications: e-mail and SMS notifications sent through the service.
• Usage analytics: product analytics events, only if you allow analytics cookies.
• Technical data: server logs and traces (pseudonymous workspace identifiers, truncated IP addresses), and error reports from the browser that carry no identifiers.
• Legal and consent records: which versions of our documents you accepted, and your cookie choices.

3. Purposes and legal bases

[Counsel: confirm each basis and the balancing tests.]

4. Recipients and sub-processors

We use the sub-processors listed in the sub-processor list, for hosting, storage, video delivery, e-mail, SMS, analytics, diagnostics, AI features and payments.

5. International transfers

Customer data of the EU region is stored in the European Union. Some sub-processors may process data outside the EEA, notably Cloudflare (video transcoding and delivery), HyperDX (pseudonymous service diagnostics) and AI model providers, depending on configuration. [Counsel: transfer mechanisms per provider, e.g. Standard Contractual Clauses or the EU-US Data Privacy Framework.]

6. Retention

• Workspace data: while the workspace exists, then deleted as described in the DPA.
• Account data: while the account exists.
• Legal acceptance records: while the account exists, plus the period counsel specifies. [Counsel]
• Backups and logs: for a limited operational period. [Counsel: periods]

7. Your rights

You can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Where processing relies on consent, you can withdraw it at any time, for example from "Cookie settings" in the footer. You can also lodge a complaint with a supervisory authority; in Romania this is the ANSPDCP. [Counsel: confirm the authority and contact details.]

8. Cookies

We describe cookies and similar storage in the Cookie Policy. Analytics loads only after you consent.

9. Security

We use access controls, row-level security, encrypted transport and encrypted storage of secrets. No system is perfectly secure. [Counsel: wording.]

10. Changes

We version this policy and show earlier versions on this page. We will ask you to review material changes.