Vidaset Privacy Policy

1. Controller

The controller of your personal data is Łukasz Radzikowski, doing business as Solvo Film Łukasz Radzikowski, ul. ks. Teofila Boguckiego 4/56, 01-502 Warsaw, Poland, tax ID (NIP) 9591691873, REGON 260344873. For anything about your data, write to support@vidaset.app.

2. Two roles: controller and processor

• As controller we process data about you as a User: your Account, plan, payments, usage statistics, the waitlist and correspondence. Section 3 describes it.
• As processor we store data about other people that you enter into Quotes, for example your client's contacts or your crew. You are their controller, and we process that data only on your instructions, under the data processing agreement (Annex 1 to the Terms). If a person whose data is in your Quote contacts us, we pass their request on to you.

3. What we process as controller, why, and on what basis

Your Account

• Data: email address, password (stored only as a hash), sign-up date, the version and time you accepted the Terms, your answer to the optional "How did you hear about us?" question, and the referral tag from the link you arrived with (ref or utm_source).
• Purpose and basis: creating your Account and providing the service (Art. 6(1)(b) GDPR); proof of accepting the Terms (Art. 6(1)(f), defence of claims); the referral tag tells us which channels bring users (Art. 6(1)(f)).

Quotes and settings, as far as they are your data

• Data: the content of your Quotes and brand settings (company name, logo, producer email and phone), rate card, clauses, item sets and option library.
• Purpose and basis: storing your work and syncing it across devices (Art. 6(1)(b) GDPR).
• We do not analyse the content of Quotes, use it for statistics or use it to train any models. The database technically allows only the owner to read a Quote (row level security).

Plan and payments

• Data held by us: your plan, the end date of the paid period, the number of Quotes counted towards the Free limit, and your Stripe customer and subscription IDs and status.
• Payment data (name, billing address, card details) is processed by Link (Sold through Link, LLC), a Stripe company that accepts payment as merchant of record, as a separate controller under its own privacy policy. We never receive card details.
• Purpose and basis: managing your subscription (Art. 6(1)(b) GDPR).

Usage statistics

• Data: a record that a PDF was generated from your Account, with the date and time. Nothing else: no Quote content, amounts, client names, IP address or device identifier.
• Purpose and basis: understanding whether the App is used and where users get stuck (Art. 6(1)(f) GDPR).
• Page views on the Website and the App are counted by Cloudflare Web Analytics, without cookies and without identifying people.

Waitlist on the Website

• Data: email address, the Website language, where you came from (link tag or the referring site's domain), and, if you tick it, your consent to news about Vidaset with the time it was given.
• Purpose and basis: contacting you about access to Vidaset (Art. 6(1)(b) GDPR, steps prior to a contract). We send news and offers only to those who ticked the separate, optional consent (Art. 6(1)(a) GDPR together with the rules on electronic communications). You can withdraw consent at any time by replying to a message or writing to support@vidaset.app; withdrawal does not affect earlier sending.

Service messages

• Messages needed to provide the service, such as account confirmation, password reset, a reminder that the trial is ending or notice of changes to the Terms, are sent under Art. 6(1)(b) GDPR. We do not send tips, newsletters or offers without your consent.

Tips, news and offers, and trial messages

• Account information, to everyone: a welcome with information about the trial, a reminder two days before it ends and one question after it ends (Art. 6(1)(b) GDPR).
• Tips, news and offers, only with consent: messages about using the App, new features and Vidaset offers, if you tick the box when creating your Account or later in Settings, on the Account tab (Art. 6(1)(a) GDPR and the consent to electronic direct marketing required by the Polish Electronic Communications Law). You can withdraw consent at any time, in the same place or with the link in any message, without affecting the lawfulness of earlier messages.
• Unsubscribing: every message has an unsubscribe link that stops the whole series and withdraws consent. Messages you need to sign in, like password resets, still arrive.
• Data: email address, language, Account creation date, the moments consent was given and withdrawn, whether you have counted your first quote and printed a PDF (so we don't write about what you've already done), plan status and a log of messages sent. The content of your Quotes never goes into them.

Correspondence

• Data: your message and the address you write from to support@vidaset.app.
• Purpose and basis: replying, handling complaints, refunds and withdrawals (Art. 6(1)(b) and (c) GDPR) and defending against claims (Art. 6(1)(f)).

Call sheet generator

What you type into the generator at vidaset.app/call-sheet stays in your browser. We do not send it to ourselves or anyone else.

4. Who processes data for us

Some of these companies are based in the United States. Transfers outside the European Economic Area rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

We do not sell your data or share it for advertising.

5. How long we keep data

6. Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time. You can save any Quote to a .vidaset file at any time, which makes taking your data elsewhere easy.

You can delete your Account with all its data yourself in the App (Settings, Account tab, "Delete account"). We then also remove your address from the waitlist. For your other rights, write to support@vidaset.app. We reply without undue delay and within one month of receiving the request; for complex requests this may be extended by two further months, and we will tell you. If we are unsure who is writing, we may ask you to confirm your identity, for example with a message from your Account's email.

You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or with the authority in your country.

Providing data when creating an Account is voluntary, but without an email address and password we cannot create one. We do not make decisions based solely on automated processing, including profiling.

7. Cookies and browser storage

We do not use advertising or tracking cookies. The App stores what it needs to work in your browser's storage (localStorage and IndexedDB):

• your sign-in session,
• the Quote you are working on and a queue of saves for when you are offline,
• tool, brand, rate card, clause, item set and option settings,
• the last known plan status, so the App keeps working briefly offline,
• the referral tag from your link, until you sign up,
• the key your browser uses to encrypt and read your Quotes, when encryption is on (section 8).

When you sign out or delete your Account, the App removes everything on this list from your browser except your chosen interface language. The call sheet generator stores your draft call sheet in your browser. While access is restricted during the beta, Cloudflare Access sets a session cookie on app.vidaset.app that is required to get in.

8. Security

Connections are encrypted. You can also turn on content encryption: the App asks once after you sign in, and you can turn it on or off at any time in your Account settings. When it is on, your Quotes, rate card and App settings are encrypted in your browser before they reach the server (AES-256). The key opens only with your password or your recovery code. We do not know your password: the server receives a secret derived from it in your browser, which can be used to recover neither the password nor the key. That is why neither we nor our providers can read the content of your Quotes. When you turn encryption on, Quotes saved earlier are encrypted too; when you turn it off, they are decrypted in your browser and the key is deleted.

Without content encryption, Quotes are stored in the database as they are, protected by your Account password and the safeguards described below.

Either way, we see what we need to run your Account: email address, plan, number of Quotes, save dates and interface language.

If encryption is on and you lose both your password and your recovery code, we cannot recover your Quotes, because we do not have their key. We show the recovery code once, when you turn encryption on, and you can create a new one at any time in your Account settings.

Only the Account owner can access the Account's data, which the database itself enforces. Keys to the database and to payments are kept on the server side only.

9. Changes

We notify you by email of significant changes before they take effect. The current version is always at vidaset.app/privacy. This policy exists in Polish and English; in case of discrepancy the Polish version prevails.