Privacy Policy
We hold your email address, the videos you asked us to read, and the notes that came back. That is close to all of it, and this page is the long version.
Who is responsible for your data?
The company named above. We decide how the data described here is used, so in the language of the UK and EU data protection rules we are the controller of it, and the address above is where you write about any of it.
What do you collect about me?
- Your email address, because it is how you sign in and how we send you your notes. It is the only thing we ask for.
- The videos you submit: the URL, the video's id and title, when you sent it, whether it worked, and how many video-minutes it used.
- What came back: the notes, the transcript, and the text read off the screen, stored as files so you can download them again.
- Your IP address, when you ask for a sign-in link. It is stored with the request and used only to limit how many links can be requested from one place in an hour, which is what stops our domain being used to mail strangers. It is deleted with the rest of the sign-in record after 24 hours.
- Billing details, held by Stripe rather than by us. If you subscribe, we keep the Stripe customer reference and the state of the subscription. We never see or store your card number.
- Measurements of each run: how long the video was, how many frames were analysed, how much processing it took. This is what sets the prices, and it is about the video rather than about you.
We do not run analytics, advertising or tracking cookies. The only cookie the site sets is the one that keeps you signed in.
Why are you allowed to hold it?
Because we need it to do the thing you asked for, which is the contract basis in the UK and EU rules, and for keeping the service secure and our accounts straight, which is the legitimate interests and legal obligation bases. We do not rely on consent for any of it, because there is nothing here you could withdraw consent from and still have a working account.
Who else sees it?
Only the companies we need to run the service. None of them are permitted to use your data for their own purposes.
- Cloudflare hosts the site, the database and the stored files.
- Google Cloud runs the processing itself, in Belgium.
- Anthropic writes the notes, from the transcript and the on-screen text. This is the one step where material from your video leaves our own infrastructure, and under the terms we use it is not used to train models.
- Stripe takes payments and holds the card details.
- Resend sends the email telling you a run has finished.
- A commercial network provider is used to fetch the video itself. It carries the video traffic and nothing about your account. We will name it if you ask.
The processing runs in the EU. Sending the transcript to Anthropic, and taking payment through Stripe, means some data reaches the United States, under the contractual protections those providers offer for exactly that.
How long do you keep it?
- Sign-in links: valid for 15 minutes, and the record of the request is deleted after 24 hours.
- Signed-in sessions: 30 days, then deleted automatically.
- Your account, your jobs and your notes: kept while your account exists, so you can come back to them. They are removed when you ask us to remove them, and we do not currently delete them on a timer. If that matters to you, write to the address above and we will do it.
- Billing records: kept for as long as tax and company law requires us to keep them, which is typically six to seven years, and that part we cannot delete on request.
What are my rights?
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop a particular use of it, or object to a use. Write to the address above. We will answer within a month and we will not charge you for it, and we will not treat you differently for asking.
Deleting your account deletes your jobs and your notes with it, and that cannot be undone. If you would like a copy of your notes first, download them or say so and we will send them.
If you think we have got this wrong you can complain to a regulator: the ICO in the UK, your national data protection authority in the EU, or the equivalent where you live. We would appreciate the chance to fix it first.
Do you make automated decisions about me?
No. Nothing about your account is decided by a machine profiling you. Your notes are written by machines, and the AI disclosure covers that in detail, but that is the service doing what you asked rather than a decision being taken about you.
How is it kept safe?
Sign-in links are stored only as a one-way digest, so a copy of our database contains nothing anybody could sign in with, and each link works once. Session cookies are restricted to this site and cannot be read by scripts. Everything travels over an encrypted connection. Access to the production systems is limited to the operator of the service.
If something goes wrong in a way that puts your data at risk, we will tell you and the relevant regulator within the time the law allows, and we will tell you what actually happened rather than a sanitised version of it.
Does this policy change?
Yes, when the system changes. The date it last changed is printed above. If a change matters to you we will email you before it takes effect, the same way we do for the Terms of Service.