This policy explains which personal data FrameNotion processes, why, and what rights you have under the GDPR.
1. Controller
The provider named in the imprint. Contact: [email protected]
2. What we process
- Account data — name, email address and a salted hash of your password (never the password itself), to provide your account (Art. 6(1)(b) GDPR).
- Ads you create — the link you submit, the brief, the generated code, test frames and the finished video, to deliver the service (Art. 6(1)(b) GDPR).
- Technical data — IP address and request data in server logs, and for rate limiting to prevent abuse (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days.
3. Cookies and browser storage
- fn_session — a strictly necessary cookie that keeps you logged in (30 days; § 25(2) TDDDG).
- In your browser's local storage we remember your cookie choice (fn:consent) and the ad language you last picked (fn:ad-language). Nothing of this is sent to us.
- Google Analytics cookies (_ga, _ga_…) are only set if you click “Accept” in the cookie banner — see section 4. We don't use advertising cookies.
4. Website statistics
Our own statistics (no cookies). We count which pages are viewed, the website you came from, campaign parameters in the link (utm_…), your country (derived by Cloudflare from the IP address), device type, browser, operating system and how long a page was visible. To tell visits apart without cookies, we compute a hash of your IP address and browser identifier with a random key that changes every day and is then deleted. The IP address itself is not stored, and visits can't be linked across days or to your account. Legal basis: our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR). Entries are deleted after 13 months.
Google Analytics 4 (only with your consent). If you click “Accept”, we use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records how the website is used (pages, device, approximate location, and actions such as starting an ad or signing up) and sets the cookies named above. Advertising features are switched off. Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google Analytics keeps this data for 14 months. You can withdraw your consent at any time via “Cookie settings” in the footer.
5. AI processing
To create an ad, the content of the public web page you submit (text and images) — plus any logo, images and notes you upload with it — is sent to our AI provider Anthropic PBC (USA), which processes it to write the brief and the ad. Data transfers to the USA are based on standard contractual clauses (Art. 46(2)(c) GDPR). Anthropic does not use this data to train its models. Please only submit pages and material you are allowed to use for advertising. Uploaded images are stored with the ad without their metadata (e.g. location).
6. Hosting
The service runs on servers of Hetzner Online GmbH in Nuremberg, Germany, which processes the data on our behalf (Art. 28 GDPR). The website is delivered through Cloudflare, Inc. (USA) as content delivery network and protection against attacks; Cloudflare processes connection data such as your IP address (Art. 6(1)(f) GDPR). Transfers to Cloudflare are based on the EU-U.S. Data Privacy Framework.
7. How long we keep data
Account data and the ads you create until you delete your account (you can do that anytime on the Account page). Ads made without an account stay available so their link keeps working — write to us to have one removed. The IP address stored with an ad to prevent abuse is removed after 30 days; web server logs are deleted after 14 days.
8. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to lodge a complaint with a supervisory authority. Contact: [email protected].