Privacy Policy – Captions Tool

Captions Tool ("we", "us", "our") is committed to protecting your personal data and respecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable Danish law. This policy explains what we collect, why, and what rights you have.

1. Data Controller

The data controller for your personal data is Captions Tool (Business registration number: 46656873). If you have any questions about how we handle your data, please contact us at support@captionstool.com.

2. Data We Collect

We collect only what is necessary to deliver the Service:

Account data

Your email address collected when you sign in via Supabase Auth. We use this to identify your account and communicate important service updates with you.

Payment metadata

When you subscribe to the Pro plan, Stripe processes your payment card directly. We receive only non-sensitive metadata: your Stripe customer ID, subscription status, and billing period dates. We never see or store your full card number, CVV, or bank details.

Uploaded video content

Videos you upload are temporarily stored in our secure cloud storage (Cloudflare R2) solely to generate your captions and are automatically and permanently deleted within a maximum of 24 hours. We do not retain your video files permanently or use them to train AI models.

Usage & technical data

Standard server logs may capture your IP address, browser type, and the pages you visit. This data is used only for security monitoring and debugging and is retained for a maximum of 30 days.

3. Legal Basis for Processing

Purpose	Legal basis (GDPR Art. 6)
Providing the Service & managing your account	Performance of a contract (Art. 6(1)(b))
Processing subscription payments via Stripe	Performance of a contract (Art. 6(1)(b))
Security monitoring & abuse prevention	Legitimate interest (Art. 6(1)(f))
Sending service-critical emails (e.g., billing)	Performance of a contract (Art. 6(1)(b))

4. Third-Party Processors

We share your data only with the following sub-processors. Each is engaged on the basis of a GDPR-compliant data processing agreement and is only given access to the data strictly necessary for the service it provides. We do not sell your data to third parties.

Supabase — authentication and database hosting (account data, subscription metadata). Data is stored in an EU region. Supabase maintains its own DPA available at supabase.com/privacy
Cloudflare (Turnstile) — bot and spam protection. When you submit forms (such as signing in), Cloudflare Turnstile processes minimal technical signals (such as IP address and browser signals) to verify that you are a human and block automated abuse. Cloudflare's privacy policy and Turnstile addendum are available at cloudflare.com/en-gb/turnstile-privacy-policy/.
Stripe — payment processing. Stripe is certified PCI-DSS Level 1 and processes your card data directly. We receive only non-sensitive metadata (customer ID, subscription status, billing dates). Stripe's privacy policy is available at stripe.com/en-dk/privacy
OpenAI (Whisper API) — AI transcription. The audio extracted from your uploaded video is sent to OpenAI's API for speech-to-text processing. We strictly ensure that your data is never used to train OpenAI's models; by default, OpenAI does not use API data for model training, and we would never permit otherwise. See openai.com/policies/api-data-usage.
Resend — transactional email delivery (e.g. verification sign-up emails). Resend receives your email address for the purpose of delivering authentication and billing notifications. View Resend's privacy policy at resend.com/legal/privacy-policy.
Hetzner — cloud server infrastructure. Our application servers (frontend, API, and reverse proxy) are hosted by Hetzner in the EU. Hetzner's privacy policy is at hetzner.com/legal/privacy-policy. view Hetzner's privacy policy at hetzner.com/legal/privacy-policy.
Google Cloud (Cloud Run) — serverless video processing. When you export a video, the FFmpeg rendering job runs on Google Cloud Run. The worker fetches your video from Cloudflare R2, processes it, and writes the output back to R2. Google Cloud Run does not permanently retain your video data. Google's privacy policy is available at cloud.google.com/terms/cloud-privacy-notice.
Upstash — managed serverless Redis. We use Upstash's Redis service to coordinate background export jobs via BullMQ. Queue entries contain job identifiers and export parameters (such as user ID and styling options) but not video content. Data is stored in the EU region and is short-lived by design. Upstash's privacy policy is available at upstash.com/trust/privacy.pdf.
Umami — privacy-friendly, cookie-free website analytics. Umami collects anonymised page-view and event data (pages visited, browser language, approximate country). It does not use cookies and does not collect personally identifiable information. Analytics data is self-hosted on our own Hetzner server and is not shared with third parties.
Sentry — application error monitoring. Sentry captures technical error events and stack traces to help us diagnose and fix bugs. Error events may incidentally include contextual information such as a user ID or, in some cases, an email address. Sentry's privacy policy is at sentry.io/privacy.

The following infrastructure components run entirely within our own Hetzner servers and do not transmit personal data to external parties: Next.js (frontend & API), DrizzleORM (database schema management), Docker (containerisation), Traefik (reverse proxy & TLS termination).

5. Data Retention

Account data is retained as long as your account is active.
Uploaded videos and extracted audio are temporarily stored in our cloud storage (Cloudflare R2) solely for processing and are automatically and permanently deleted within a maximum of 24 hours. We do not retain your video files permanently.
Payment metadata is retained for as long as required by applicable accounting and tax law (typically 5 years).
Server logs are purged after 30 days.

6. Your Rights

Under the GDPR you have the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure ("right to be forgotten") — request deletion of your account and all associated personal data.
Restriction — ask us to restrict processing of your data in certain circumstances.
Data portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interest.

To exercise any of these rights, email us at support@captionstool.com. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at dt.dk.

7. Cookies & Analytics

We use strictly necessary session tokens and cookies required for authentication, set by Supabase. These are essential to keep you signed in and cannot be disabled.

We also use Umami for anonymous, cookie-free website analytics. Umami does not set any cookies and does not collect any personally identifiable information. It records only anonymous data such as which pages were visited, browser language, and approximate country. This analytics instance is self-hosted on our own servers and no data is shared with third-party analytics services.

To protect our site against bots and automated abuse, we use Cloudflare Turnstile. Turnstile processes minimal technical signals to distinguish between humans and bots. For more details, please refer to the Cloudflare Turnstile Privacy Addendum.

We do not use advertising or cross-site tracking cookies of any kind.

8. Security

All data is transmitted over TLS (HTTPS). Access to production systems is restricted and logged. Passwords are never stored — authentication is handled exclusively via Supabase's secure magic-link or OAuth flow.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notice at least 14 days before they take effect.

10. Contact

For any privacy-related questions or requests, contact us at support@captionstool.com.