This policy explains which personal data FrameNotion processes, why, and what rights you have under the GDPR.
1. Controller
The provider named in the imprint. Contact: [email protected]
2. What we process
- Account data — name, email address and a salted hash of your password (never the password itself), to provide your account (Art. 6(1)(b) GDPR).
- Sign in with Google — if you choose it, Google tells us your name, email address and a Google account ID so we can create or log in to your account (Art. 6(1)(b) GDPR). We receive no password and no other data from your Google account. Google's own privacy policy applies to the sign-in at Google.
- Ads you create — the link you submit, the brief, the generated code, test frames, the voiceover script and audio, the finished video, the changes you request and a reference video if you upload one, to deliver the service (Art. 6(1)(b) GDPR). Voiceover and music are produced on our own servers — no audio service receives your data.
- Brand kit — the logo, colours, notes and default options you save, to apply them to your ads (Art. 6(1)(b) GDPR), until you change them or delete your account.
- Invitations — if you sign up through someone's invite link, we note who invited you so both of you get the promised extra ads (Art. 6(1)(b) GDPR).
- Notifications — if you turn on browser notifications, your browser gives us a push address that is delivered through your browser maker's push service (e.g. Google, Mozilla, Apple). We only use it to tell you when your ad is ready, and delete it when it stops working (Art. 6(1)(a) GDPR — you can switch it off in your browser anytime). When an ad is ready or waits for your approval we also email you (Art. 6(1)(b) GDPR).
- Technical data — IP address and request data in server logs, and for rate limiting to prevent abuse (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days.
3. Cookies and browser storage
- fn_session — a strictly necessary cookie that keeps you logged in (30 days; § 25(2) TDDDG).
- In your browser's local storage we remember your cookie choice (fn:consent) and the ad language and options you last picked (fn:ad-language, fn:ad-options). Nothing of this is sent to us until you start an ad.
- fn_ref — set only when you open someone's invite link: it remembers the invite for 30 days so it counts when you sign up (§ 25(2) TDDDG, part of the service you asked for).
- Google Analytics cookies (_ga, _ga_…) are only set if you click “Accept” in the cookie banner — see section 4. We don't use advertising cookies.
4. Website statistics
Our own statistics (no cookies). We count which pages are viewed, the website you came from, campaign parameters in the link (utm_…), your country (derived by Cloudflare from the IP address), device type, browser, operating system and how long a page was visible. To tell visits apart without cookies, we compute a hash of your IP address and browser identifier with a random key that changes every day and is then deleted. The IP address itself is not stored, and visits can't be linked across days or to your account. Legal basis: our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR). Entries are deleted after 13 months.
Google Analytics 4 (only with your consent). If you click “Accept”, we use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records how the website is used (pages, device, approximate location, and actions such as starting an ad or signing up) and sets the cookies named above. Advertising features are switched off. Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google Analytics keeps this data for 14 months. You can withdraw your consent at any time via “Cookie settings” in the footer.
5. Payments
Plans are paid through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes your name, email address, billing address, VAT ID (if given) and payment details to take payments and issue invoices (Art. 6(1)(b) GDPR). We never see or store your full card details. Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Invoices and payment records are kept for 10 years as required by German tax law (Art. 6(1)(c) GDPR).
6. AI processing
To create an ad, the content of the public web page you submit (text and images) — plus any logo, images, notes, change requests and frames of a reference video you upload with it — is processed by a specialized AI service provider in the USA on our behalf (Art. 28 GDPR) to write the brief, the voiceover script and the ad. Data transfers to the USA are based on standard contractual clauses (Art. 46(2)(c) GDPR). The provider does not use this data to train its models. On request we tell you which provider this is. If a website blocks automated visits, we retrieve that public page through a specialized web-access provider, which only receives the link. Please only submit pages and material you are allowed to use for advertising. Uploaded images are stored with the ad without their metadata (e.g. location).
7. Hosting
The service runs on servers of Hetzner Online GmbH in Nuremberg, Germany, which processes the data on our behalf (Art. 28 GDPR). The website is delivered through Cloudflare, Inc. (USA) as content delivery network and protection against attacks; Cloudflare processes connection data such as your IP address (Art. 6(1)(f) GDPR). Transfers to Cloudflare are based on the EU-U.S. Data Privacy Framework.
8. How long we keep data
Account data and the ads you create until you delete your account (you can do that anytime on the Account page). Ads made without an account stay available so their link keeps working — write to us to have one removed. The IP address stored with an ad to prevent abuse is removed after 30 days; web server logs are deleted after 14 days.
9. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to lodge a complaint with a supervisory authority. Contact: [email protected].