Privacy notice

This notice explains how TiG Talents in Germany UG (haftungsbeschränkt) handles personal data when you visit or use VideoMason.

Controller

Data we process

• Account and billing data: email address, password hash, email-verification status, plan, subscription status, billing-provider identifiers, and account timestamps.
• Workspace content: projects, scripts, template choices, brand settings, schedules, uploaded images and audio, generated videos and thumbnails, and render logs.
• Technical and security data: essential session identifiers, IP address for authentication and abuse prevention, request timing, storage usage, and error or security events.
• Aggregate website analytics: date, public page path, referrer domain, campaign labels supplied in the link, coarse device category, and whether the request identifies itself as a named search or AI crawler. Public examples also count edit, Studio continuation and starter-download actions, without collecting the content you type. VideoMason’s analytics table does not store the visitor’s IP address, full referrer URL, full browser identifier, fingerprint, or a persistent visitor ID.
• Support data: messages and any information you include when asking for help or reporting content.

Please avoid uploading personal data that is not needed for your video. If your content concerns another person, you are responsible for having the rights and permissions required to use it.

Purposes and legal bases

• We process account, workspace, and render data to create and deliver the service you request and to manage subscriptions (Article 6(1)(b) GDPR).
• We process technical, security, and limited diagnostic data to protect accounts, prevent abuse, maintain reliability, and defend legal claims (Article 6(1)(f) GDPR). Our legitimate interests are operating a secure and dependable service.
• We count aggregate public-page requests to understand which pages are useful, whether search engines can reach them, and where the service needs improvement (Article 6(1)(f) GDPR). Our legitimate interest is measuring and improving the public website with a data-minimising, first-party system.
• We process billing and business records where necessary to meet tax, accounting, and other legal duties (Article 6(1)(c) GDPR).
• Where an optional feature legally requires consent, we ask before processing and rely on Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting earlier processing.

Service providers and recipients

We disclose only the data needed for the relevant service:

• Render provides application hosting and persistent storage. The production service is configured for the Frankfurt region.
• Resend delivers account-verification, password-reset, and service emails.
• Polar provides hosted checkout, subscription management, and the customer portal when you use a paid plan. Payment-card details are entered with and handled by Polar, not stored by VideoMason.
• Optional voice or AI providers receive the relevant script, text, audio, and request metadata only when such a provider is enabled and you ask to use that feature. Available providers are shown in the product.
• Professional advisers, courts, regulators, or public authorities may receive data where disclosure is legally required or necessary to establish, exercise, or defend legal claims.

We do not sell personal data, use advertising trackers, or share visitor profiles. The aggregate visitor analytics described above runs within the VideoMason application and is not sent to an analytics provider.

International transfers

Some service providers may process data outside Germany or the European Economic Area. Where GDPR transfer restrictions apply, transfers are made only using a recognised safeguard, such as an adequacy decision or the European Commission’s standard contractual clauses. You may ask us for more information about the safeguard relevant to your data.

Retention

• Sign-in sessions normally expire after 72 hours and can end earlier when you sign out.
• Generated exports are deleted after the configured retention period, currently seven days by default.
• Aggregate website analytics are kept for 90 days by default and then deleted. Because these records contain no persistent visitor identifier, they cannot be used to reconstruct an individual browsing history.
• Projects, uploads, brand settings, and schedules remain until you remove them or use the workspace-deletion control.
• Daily operational backups are kept on a rolling basis; the current default keeps 14 copies. Deleted data may remain in a protected backup until that copy rotates out.
• Account, subscription, transaction, and business records are kept for the life of the account and afterwards only as long as needed for statutory retention, dispute, fraud-prevention, or security purposes.

Cookies and local storage

VideoMason uses an essential sign-in cookie named vm_session. It is HTTP-only, uses SameSite=Lax, and is marked Secure in production. The Studio may also keep interface preferences and drafts in your browser. If you choose Continue in Studio on a public example, its edited content is stored on that device and can be restored for seven days to complete the handoff. Studio drafts can be restored for 30 days. Expired local content may remain in browser storage until you clear it. Visitor analytics do not set an analytics cookie or write an analytics identifier to local storage. None of these technologies is used for advertising or cross-site tracking.

Your rights

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction, portability, or a copy of your personal data, and may object to processing based on legitimate interests. You can delete individual projects and assets in the Studio and remove workspace content from the Account page. Contact us to exercise any other right or to request account deletion.

You may also lodge a complaint with a supervisory authority. The authority for our establishment is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI). You may also contact the authority where you live or work.

Automated decisions and security

VideoMason automatically applies storage, render, rate, and safety limits, but does not use solely automated decision-making that produces legal or similarly significant effects. We use access controls, hashed credentials and tokens, signed downloads, private workspaces, and other technical and organisational measures designed to protect data. No online service can guarantee absolute security.

Changes and contact

We may update this notice when the service or legal requirements change. The date above identifies the current version. Privacy questions and requests can be sent to shiyun.hu@talentsingermany.de. Our complete provider details are in the Legal notice (Impressum).