← Back

Privacy Policy

Short, honest, concrete.

Controller

Ismet Beyazkus, Hinter den Gärten 4, 52388 Nörvenich, Ismet@douchkove.com

What data we process

• Your video: uploaded by you for processing. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Your account email & password (hashed): for login and billing. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Server logs: IP address and timestamps for operations (kept no longer than 14 days). Legal basis: our legitimate interest in the security and stable operation of the service (Art. 6(1)(f) GDPR).
• Anonymous reach statistics: we count how many people reach the site, open the app, register, upload, and buy, plus the referring site (e.g. "instagram", "google", "direct"). To avoid counting the same visit twice we store a short one-way hash of IP address and browser string that is salted with the current date and therefore changes every day. It cannot be reversed, cannot be linked across days, and is never joined with any advertising network. We do not store your IP address for this, and we set no cookie for it. Legal basis: our legitimate interest in knowing whether the service reaches anyone (Art. 6(1)(f) GDPR).
• Payment data: handled by Stripe (Stripe Payments Europe, Ltd., Ireland). We only see your email and the amount paid. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Fraud prevention (referral & free credits): when a referral bonus or a free credit (welcome / monthly free minutes) is granted, we store a one-way salted hash of the email address (never the address itself). This lets us grant each free benefit only once per person and prevent abuse such as delete-and-re-register farming. Legal basis: our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR). This pseudonymous hash is kept even after account deletion for the same reason.
• Purchase confirmations (withdrawal consent): when you purchase, we log your confirmation that you request immediate performance and acknowledge the loss of the withdrawal right, with a timestamp (§ 356 (4) BGB). Legal basis: legal obligation and defence of legal claims (Art. 6(1)(c) and (f) GDPR). Kept as long as claims can arise from the purchase (up to 3 years after the end of the year of purchase).
• Support requests: if you contact us via the in-app support form, we store your message, subject, and account email as a ticket and receive it by email, so we can answer you. Legal basis: performance of our contract (Art. 6(1)(b) GDPR). Tickets are deleted when you delete your account.
• Sign in with Google (optional): if you choose Google sign-in, we receive your Google account ID, email address, and display name from Google to create or sign in to your account (Art. 6(1)(b) GDPR). Google LLC (USA) learns about the sign-in; see Google's privacy policy. The transfer is based on Art. 44 ff. GDPR (Standard Contractual Clauses / EU-US Data Privacy Framework). Email + password login remains available; Google sign-in is never required.

What we do NOT do

• No Google Analytics, no Meta Pixel, no advertising tracker
• No cookies other than technically required ones (the session cookie; during an optional Google sign-in, two short-lived security cookies that expire after 10 minutes)
• No sharing of your videos with advertising partners

Transactional email (data processor)

System emails (email confirmation, password reset, purchase confirmation, support replies, expiry warnings) are sent through Resend (Resend, Inc., USA) as our processor. Resend processes your email address, name, and the content of the respective email. Legal basis: performance of our contract (Art. 6(1)(b) GDPR). A data processing agreement is in place; the transfer to the USA is based on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework (Art. 44 to 46 GDPR).

Sharing with our AI provider (data processor)

For transcription and AI direction we share the following with our AI provider (OpenAI, L.L.C., San Francisco, USA):

• The audio track of your video (for transcription)
• Individual video frames of the most important moments (for vision analysis)
• The recognized text (for the direction decision)

The provider is contractually bound not to use API data for model training and to delete it after 30 days. Details: privacy policy.

A data processing agreement (Art. 28 GDPR) is in place with the provider. As the provider is located in the USA, the transfer is based on the EU Standard Contractual Clauses and, where applicable, the provider's certification under the EU-US Data Privacy Framework (Art. 44 to 46 GDPR).

Retention

• Videos, transcripts, intermediate files: 7 days after upload, then automatic deletion
• Server logs: 14 days
• Anonymous reach statistics: 400 days (the daily hash is already unlinkable after 24 hours)
• Account and purchase history: until you delete your account
• Exception (tax law): booking records of purchases (amount, date, and the account email as part of the record) are kept for 10 years after account deletion to meet German retention duties (§ 147 AO / GoBD). This exception is permitted by Art. 17(3)(b) GDPR. Everything else is really deleted.

Your rights

You have the right to access, rectification, erasure, restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and to object. Contact: Ismet@douchkove.com. Right to complain to the responsible supervisory authority.

Hosting

Server is located at netcup GmbH, Karlsruhe, Germany. Personal data leaves the EU only for the processing steps described above (AI provider, transactional email, optional Google sign-in), each safeguarded under Art. 44 ff. GDPR.