This policy says what Vidrotation at vidrotation.com does with your data. The service is run by Yann Kost, Switzerland, who is responsible for that data. Reach us at contact@vidrotation.com.
This policy explains how we use your data, including website analytics.
1. What we collect, and why
| Data | Why | How long |
|---|---|---|
| Your e-mail address and password | They are your account. The password is stored as a hash by our account provider; we never see it. If you sign in through Google or GitHub, that provider gives us your e-mail address and name instead. | As long as the account exists. |
| A sign-in session | To keep you signed in. It lives in one cookie. | Until you sign out, or the session expires. |
| Your projects: the template, the steps, the texts, colours and settings you chose | So you can come back to them and render them. | Until you delete the project or the account. |
| The clips, images and sound you upload | To preview and render your project. A copy stays on our server for that. | 48 hours after the upload. Media you mark as Keep stays in your library until you remove it. |
| The caption transcript (the words and their timings) of a clip, when you turn captions on | To draw the captions and to let you correct the text. | With the project. |
| The rendered videos | So you can download them. | 48 hours after rendering. |
| Your credit balance and its history: grants, renders and their cost, purchases | To charge renders and to show you where the credits went. | As long as the account exists. |
| Purchases: pack, amount, date and Stripe's reference for the payment | To credit your account and to keep the books. We never receive card numbers. | Ten years, as Swiss bookkeeping law requires. |
| API keys, if you create them | To let your own software use the service as you. Stored as a hash; the key itself is shown once. | Until you revoke them. |
| Notes we write about an account, such as why it was locked | To handle abuse and to explain a decision if you ask. | As long as the account exists. |
| Server logs: IP address, the page requested, time, browser type | To keep the service secure and find faults. | Thirty days. |
We use cookies to keep you signed in and, if you use the free editor without an account, to reopen your private draft and remember your free video allowance. The guest cookie and allowance record last 90 days. Stripe sets its own cookies on its payment page.
A guest draft, its uploads and its download are available for 48 hours from the start of the draft. We remove expired guest content during hourly cleanup. The allowance record contains a random identifier, dates and usage counts. Daily connection limits use a hash of the IP address and a secret server key. Signing in moves the project and its files into your account; the account storage rules above then apply.
Website analytics. We use Google Analytics, a web analytics service provided by Google, to understand visits to our public pages and clicks on the homepage buttons for opening the video editor and choosing a credit pack. We do not track interactions inside the editor. Visits by signed-in administrators are excluded.
With your consent, analytics measure public page visits, referral sources, browser and device information, which editor button you click on the homepage and which credit pack you select. A credit-pack click does not tell us that you completed a purchase. Google Analytics can use cookies and similar identifiers to distinguish visits. Our analytics exclude your e-mail address, project names, filenames, uploaded media, captions and other text you enter. We do not use it for personalized advertising.
You can accept or decline optional analytics and withdraw your consent through the site's privacy choices. Declining does not prevent you from using the editor. We remember your analytics choice for 180 days. Analytics cookies are configured to expire after 180 days without extending their lifetime on each visit; withdrawing consent removes these cookies. Google explains its practices in How Google uses information from sites or apps that use its services and its Privacy Policy.
2. Who processes it for us
We run the service on one server in Germany. A few things it cannot do alone, and for those we use providers who work under our instructions:
| Provider | Where | What it does with your data |
|---|---|---|
| Google (Google Analytics) | Global infrastructure; processing may take place outside Switzerland and the European Economic Area | Public page visits and homepage button clicks, with your consent, to help us understand and improve the service. |
| Hostinger International Ltd | Cyprus; the server is in Frankfurt am Main, Germany | Hosting of the site, your projects, uploaded media and rendered videos. |
| Supabase, Inc. | United States; the database is hosted in Frankfurt am Main, Germany | Accounts: your e-mail address, password hash, credit balance and API keys. Sends the sign-in and password-reset e-mails. |
| Mistral AI | Paris, France | Speech recognition, only when you turn captions on for a clip: the sound of the clip is sent to its transcription API and the words come back with their timings. |
| Very Good FFmpeg | verygoodffmpeg.com; the provider names no company or country on its site and says files may be processed outside your own country | Rendering: the clips, images and sound of a project are sent there, the finished video comes back. Each job runs on a dedicated machine, the files are deleted when the job completes, and the provider states it does not train on, inspect or share the media. |
| Stripe Payments Europe, Ltd. | Dublin, Ireland | Payment for credit packs. Card details go to Stripe directly and never reach our server. |
Rendering and analytics can involve a transfer outside Switzerland and the European Economic Area. Where that is the case, the transfer rests on the provider's standard contractual clauses or, for the United States, on the Swiss–US and EU–US Data Privacy Frameworks where the provider is certified.
Nobody at these providers reviews your media. We do not sell data, and we do not let anyone use your media or transcripts to train models.
3. The legal basis
Optional website analytics rely on your consent.
We process your data to provide the service you asked for (the contract), to meet legal duties such as bookkeeping, and, for the server logs and the account notes, in our legitimate interest of keeping the service safe. Swiss data protection law (the FADP) applies. If you are in the European Economic Area or the United Kingdom, the GDPR applies to you too, and the same reasons hold under it.
4. Your rights
You can ask us at any time what data we hold about you, have it corrected, have it deleted, or receive a copy of it. You can object to processing that rests on our legitimate interest. Write to contact@vidrotation.com from the address of your account, and we answer within thirty days. You can also delete the account yourself on the profile page; that deletes everything except the purchase records we must keep.
If you think we are handling your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner, or, in the EEA, to your own data protection authority.
5. Security
Everything travels over HTTPS. Passwords and API keys are stored hashed. Files are stored on a server only we can reach. Payment data never touches our server.
6. Children
The service is not for people under 18 without a parent or guardian, and we do not knowingly keep data about children.
7. Changes
If we change this policy, the date at the top changes with it. For a change that matters, we tell the accounts with unused credits by e-mail.