Gance
Polityka prywatności

Ten dokument jest dostępny wyłącznie w języku angielskim.

Privacy Policy — Gance (DRAFT)

DRAFT / template. Placeholders in <...> must be completed and the whole document reviewed by a lawyer before publication. This is not legal advice.

Last updated: <DATE> Controller: <COMPANY LEGAL NAME>, <ADDRESS>, <REGISTRATION No.> Contact: <privacy@yourdomain>

1. Scope — and which half of it applies to you

This policy covers the Gance desktop application and the Gance account/AI backend service ("the Service"). Which parts apply to you depends on your plan, because our role under the GDPR is not the same in both cases.

Consumer plans (Free, Hobby, Pro). You use a finished product for your own purposes, and we decide how the Service processes what you upload. We are the controller, this policy governs, and you exercise your rights (Section 7) directly with us.

Business plans (Enterprise, and any account used to process footage on behalf of someone else — clients, employees, event attendees). You decide why that footage is processed and instruct us to do it. For that footage we are a processor and you are the controller. In that case:

  • the data processing agreement you sign with us governs, not this policy;
  • retention, deletion and disclosure follow *your* instructions, within what the Service technically supports;
  • people appearing in your footage exercise their rights with you, not with us; if they contact us we will refer them to you and assist you as the agreement requires;
  • the providers listed in Section 4 become sub-processors under that agreement, and changes to them are notified to you.

Our own handling of your account, billing and usage data makes us the controller in both cases, so Sections 2–10 apply to those regardless of plan.

[TO DECIDE] This split assumes the dual-role model recorded in processing-record.md. It requires the customer-facing DPA template to exist before Enterprise is sold. Confirm with counsel.

2. Data we process

  • Account data: e-mail address, display name, avatar URL, password hash (bcrypt — we never store your plaintext password), and, for social sign-in, your Google/Facebook user identifier.
  • Subscription/billing data: plan, subscription status, and a Stripe customer identifier. Card data is handled solely by Stripe — we never see or store it.
  • Media you process with AI: when you use cloud AI features, the relevant audio/video (or frames) are uploaded to the backend for processing. Files are retained for at most 72 hours and then deleted.
  • Technical data: IP address and request metadata, for security and rate limiting. When you create an account we also keep a one-way, keyed hash of the address it was created from, so that a limited number of free accounts can be opened from the same connection. We do not store the address itself, the hash cannot be turned back into it or into a location, and it is erased after 30 days.
  • AI usage records: one row per AI job you run (which feature, how many seconds of source media, when), used to enforce your plan's quota and to attribute cost. It is linked to your account.
  • Diagnostic reports — only if you send them. When the application fails, it writes a report on your own computer and, next time you start it, shows you the full contents and asks whether to send it. Nothing is transmitted unless you press Send; declining deletes the report. A report contains the error and its stack trace, the application version and operating system, and can include file paths and project names. It never contains your recordings, audio or transcripts. If you are signed in it is linked to your account, and deleted with it.
  • Website counters. Pages on this website report that they were opened, and buttons report that they were pressed, to our own server. We keep one record per page view and per button press: the time, the page, the button, where you arrived from (the *site* you came from, never the page on it), and a pseudonym — a one-way hash of your address and browser identification under a secret key held only on our server. Your IP address itself is not stored unless an operator deliberately turns that on, and this installation does not.

The pseudonym is stable, and that is deliberate: it is what lets us count how many *people* visited in a month rather than how many times a page was opened. It cannot be reversed into your address, it is ours alone — a different site's numbers cannot be joined to it — and it is not a cookie: nothing is stored in your browser and no profile follows you anywhere else. Counting honours Do Not Track. Legal basis: legitimate interest (Art. 6(1)(f)) in knowing whether this site is read. Records are deleted after 400 days; the full description, including what changes if addresses are ever stored, is in our processing record.

We do not collect product analytics or usage telemetry from the application itself, and it does no automatic background reporting.

3. Purposes and legal bases (GDPR Art. 6)

  • Providing the Service and your account — performance of a contract (Art. 6(1)(b)).
  • Billing and subscriptions — contract + legal obligation (tax/accounting).
  • Enforcing plan quotas and attributing cost — performance of a contract.
  • Security, abuse prevention, rate limiting — legitimate interest (Art. 6(1)(f)).
  • Diagnosing failures from a report you chose to send — consent (Art. 6(1)(a)), given per report, in the dialog that shows you what it contains. You can refuse any individual report, and refusing deletes it.

4. Processors / sub-processors

  • Scaleway (France) — AI montage and frame description, when the hosted AI backend is enabled. Your transcript and sampled frames are processed in Paris/Warsaw data centres; the full video is never sent.
  • ElevenLabs (United States) — speech-to-text on the audio of your footage.
  • Stripe (payments, invoicing, tax) — <region>.
  • Google / Meta (Facebook) — only if you choose social sign-in.
  • <Hosting provider> — backend hosting and storage.
  • <E-mail provider> — transactional e-mail (verification, password reset).

Some deployments run the AI models on their own hardware, in which case no third party receives your media at all.

The current list, with regions and transfer bases, is maintained in subprocessors.md and published at <URL>.

5. International transfers

The AI montage and frame-description features run either on our own hardware or in Scaleway's EU data centres — in both cases inside the EU.

Transcription is performed by ElevenLabs in the United States. That transfer relies on ElevenLabs' certification under the EU–US Data Privacy Framework, the European Commission's adequacy decision for certified US organisations. You can verify the certification at dataprivacyframework.gov.

For any other provider outside the EEA we rely on <Standard Contractual Clauses / adequacy decision>. <Complete per your providers.>

6. Retention

  • Account data: for the life of your account, deleted on account deletion.
  • Uploaded media, and any working copies derived from it (such as the audio extracted for transcription): ≤ 72 h.
  • AI usage records: 400 days, then deleted automatically. Deleted immediately if you delete your account.
  • AI job records (status and progress of a job you started): one hour after the job finishes. Deleted immediately if you delete your account.
  • Diagnostic reports you chose to send: 90 days. Deleted immediately if you delete your account.
  • Descriptions the AI produced of your footage (what is on screen, a one-line gist of what is said), kept so that editing the same material again does not spend your AI allowance on the same analysis twice: 180 days from the last time we used them. No images or audio are kept — only the text and a hash of the frame that cannot be turned back into a picture. Deleted immediately if you delete your account.
  • Billing records: as required by tax law (typically <N> years). These survive account deletion, because retaining them is a legal obligation rather than our choice.

7. Your rights (GDPR Arts. 15–22)

Access, rectification, erasure ("delete account" in the app removes your account, your uploaded media, your usage and job records, the AI's descriptions of your footage, any diagnostic reports you sent, and asks Stripe to close your customer record, which ends the subscription; if that last step fails we complete it manually — tell us if you are still billed), restriction, portability, and objection. To exercise them, contact <privacy@yourdomain>. You may lodge a complaint with your supervisory authority (in Poland: UODO).

8. Security

Passwords are hashed with bcrypt and transport is encrypted with TLS. Your session token is stored in your operating system's keystore (GNOME Keyring / Windows DPAPI / macOS Keychain); on a system where no keystore is available, the application falls back to its ordinary settings storage so that staying signed in still works — on such a system the token is not encrypted at rest.

Access to the content of your material inside our systems is limited to what is needed to operate and debug the Service: an internal diagnostic view can show fragments of transcripts and the instructions sent to the AI models. It is held in memory only, is not part of any permanent record, and is unavailable unless an administrator token is configured.

No system is perfectly secure, but we apply industry-standard safeguards.

9. Children

The Service is not directed to children under <16>.

10. Changes

We will post updates here and, for material changes, notify you by e-mail.