Privacy policy (draft)

What we store

• Account data — your email address, your name, and your workspace roles.
• Workspace content — the process videos you upload, the audio tracks and transcripts derived from them, still frames and step photos, and the SOP drafts and PDFs built from that evidence. This content belongs to your business — see Your data & your know-how.
• Billing data — handled by Stripe. Card numbers never reach our servers; we store only the references Stripe gives us (customer, subscription, and purchase identifiers).

Where it lives

Your data is stored with Supabase in the European Union (Paris region), and the application runs on Vercel with its server functions pinned to Paris as well. Videos, photos, and PDFs sit in private storage buckets — access always goes through short-lived signed links, never public URLs.

Who processes it for us

• Supabase — database, file storage, and authentication (EU, Paris).
• OpenAI— transcription of your videos' audio and drafting of SOP steps from the transcript and selected frames, via the OpenAI API. OpenAI states that data submitted through its API is not used to train its models.
• Stripe — payments and subscriptions.
• Vercel — application hosting.

We never sell your data, and we never use your content to train AI models.

Cookies

We use only the authentication cookies required to keep you signed in. There are no advertising trackers on this site.

How long we keep things

Workspace content is kept while its SOP is alive — the source video is the evidence behind every step. You can ask us to delete a video, a SOP, or your entire workspace at any time; deletion requests are handled directly and promptly. Formal retention windows and a self-serve deletion flow are being finalized.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, or a portable export. Today these requests are handled directly rather than through a self-serve tool — contact us and we will act on them promptly. People appearing in your videos have these rights too; as their employer, informing them and getting their agreement before filming is your responsibility (see the FAQ for practical guidance).

Contact & formal points

Data controller identity, the dedicated privacy contact address, jurisdiction, and the data-processing agreement for business customers: To be confirmed — these are being finalized with management and will be published here.