Privacy & GDPR Policy

• Account: your email address and a hashed (argon2id) password. Never stored in plaintext.
• Access requests: if you request access, the email (and any name/message you provide) until the request is approved or rejected.
• Usage content: the video identifiers you load, the in/out points and clips you create, clip metadata (title, timestamps, file size), your credit balance, and an audit log of key actions.
• Payment: handled by Stripe. We do not see or store your card details; we store only a Stripe event reference and the credits granted.
• Technical: a single strictly-necessary session cookie, and server/proxy logs (including IP address, via Cloudflare) used for security and abuse prevention.

• To provide the Service (load videos, suggest highlights, produce and store your clips, manage credits) — performance of a contract.
• Payments, invoicing & tax — contract and legal obligation.
• Security, abuse prevention, rate limiting — legitimate interests.
• Account & transactional emails (access invites, verification, password reset) — contract.

Clips are produced from videos you choose to load, which are hosted on Vimeo and catalogued via the GIEQsplatform. To suggest highlights and produce a clip we process the video’s identifier, its transcript and chapter data, and a rendition of the video file. Highlight suggestions are generated by a simple in-house heuristic over the transcript — no third-party AI model is used and your content is not sent to any AI service. Only load videos you are entitled to use.

• Vimeo (USA) — video hosting and source renditions for the clips you create.
• GIEQs — video catalogue, transcript and chapter data.
• Stripe (EU/USA) — payment processing (independent controller for card data).
• Resend — transactional email delivery.
• Hetzner (Germany, EU) — hosting and database.
• Cloudflare — CDN/edge, TLS, and DDoS protection (processes IP addresses).

Where a sub-processor is outside the EEA (e.g. Vimeo, Stripe, Cloudflare in the USA), transfers rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, with appropriate safeguards.

We keep account and usage data for as long as your account is active, and delete or anonymise it within a reasonable period after you close your account — except records we must keep for legal/accounting reasons (e.g. invoices, kept for the statutory period). Extracted clip files are transient and may be removed once delivered.

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. To exercise any of these, or to delete your account, email privacy@evideris.com and we will respond within one month.

We use a single strictly-necessary session cookie to keep you signed in. We use no advertising, analytics, or third-party tracking cookies, so no cookie-consent banner is required.

Passwords are hashed with argon2id; traffic is encrypted in transit (TLS); auth endpoints are rate-limited; and database backups are encrypted. No system is perfectly secure, but we take appropriate technical and organisational measures.

The Service is not directed at children and is intended for users aged 18 or over.

We may update this policy; material changes will be notified in-app or by email. You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Brussels) or your local supervisory authority.