Privacy policy
Last updated:
What we collect, why, where it lives and for how long. Three things worth knowing straight away: your files stay in France, on our own machines rather than with a cloud provider; we set no trackers, for advertising or for analytics; and a rendered video can be viewed by anyone who knows its address.
01Who processes your data
The data controller is the publisher identified in the legal notice: Alexandre Devaux (EI), 26 rue Joseph Bara, 34500 Béziers, France.
For anything about your data, or to exercise your rights: zictovid@alexandre-devaux.com.
We have not appointed a data protection officer: this processing falls into none of the cases where Article 37 of the General Data Protection Regulation requires one.
02The data we process
It all starts with the Google sign-in. We ask you for no form, no password, and nothing Google does not pass on to us.
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Google identifier | Google, at sign-in | To recognise you from one session to the next. Your address can change at Google; this identifier cannot. | Performance of the contract |
| Email address | To tell you a video is ready or a render has failed, and to answer you. | Performance of the contract | |
| Display name | To name you in the interface, and to compose the watermark on paid plans. | Performance of the contract | |
| Profile picture | To show it in your workspace. | Performance of the contract | |
| Stripe identifiers (customer, subscription) | Stripe, at first payment | To attach the subscription to the account and apply the quota of the plan paid for. | Performance of the contract |
| Plan, quota used, period end | Our service | To apply what you have bought. | Performance of the contract |
| Uploaded audio files | You | To render the video. | Performance of the contract |
| Rendered videos, file name, length, render status | Our engine | To hand you the video and show progress. | Performance of the contract |
| Server logs | Automatic | To diagnose failures and detect abuse. They may contain your email address. | Legitimate interest |
03What we do not collect
No password — there is none — no card details, no date of birth, no postal address, no telephone number, no location data.
We build no advertising profile and take no automated decision producing legal effects concerning you.
04Your audio files and your videos
The file you upload is written to the disk of a machine we operate in France, in a folder of its own for your account. The rendered video is written to the same machine. Neither is entrusted to a third-party storage provider.
We do not listen to your tracks. They are analysed only automatically, to extract the moments where the beats fall: no analysis attempts to identify the track, the artist or you.
On paid plans, your Google account name is burned into the video as a watermark. It is therefore visible to everyone you show the video to, and it cannot be taken out afterwards — the video has to be rendered again. On the free plan the watermark reads “@zictovid” rather than your name.
05Access to rendered videos — please read
A rendered video is served at an address containing a long, unguessable identifier. That address is protected by no session check: anyone who knows it can watch the video, with or without a zictovid account.
This is a deliberate technical trade-off rather than an oversight: a video player sends no session cookie when it asks for a byte range of a file, and requiring a session would break playback.
What that means for you: do not circulate the address of a video you would not want passed around. An address, once shared, cannot be taken back.
We know this is not good enough. The proper answer is a signed, time-limited address; it is not in place yet.
07Who your data is passed to
We neither sell nor rent your data. It is passed only to the providers the service needs to run, each bound by a processing agreement under Article 28 of the General Data Protection Regulation:
| Provider | What it does for us | Data involved | Where |
|---|---|---|---|
| Google Ireland Limited | Authentication: it is Google that identifies you. | Google identifier, email address, name, picture | Ireland, with transfers to the United States |
| Stripe Payments Europe, Limited | Collecting subscription payments and issuing invoices. | Email address, name, customer and subscription identifiers, payment details it collects itself | Ireland, with transfers to the United States |
| Vercel Inc. | Hosting the site and the application. | IP address and technical connection data | United States, delivered over a global network |
| Cloudflare, Inc. | Domain name and the tunnel exposing the API. | IP address and connection metadata | United States, global points of presence |
| Resend | Sending transactional email — video ready, render failed. | Email address, name of the rendered file | European Union (Ireland) |
| The publisher, on its own machines | API, database, rendering and storage of the videos. | All of the data above, plus your audio files and your videos | France |
08Transfers outside the European Union
Four of our providers are United States companies, or transfer data to the United States: Google, Stripe, Vercel and Cloudflare.
Those transfers rest on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) where the provider is certified under it, and otherwise on the standard contractual clauses adopted by the Commission.
What never leaves France: your audio files, your rendered videos and the service database. They live on machines we operate ourselves.
09How long we keep what
- Account — Google identifier, email address, name, picture: for as long as the account exists, then erased on request.
- Uploaded audio files and rendered videos: TO BE COMPLETED: retention period, to be decided and then implemented
- Render and quota history: for as long as the account exists. It is what evidences what you were charged for.
- Invoices and accounting records: ten years, as the law requires (Article L123-22 of the French Commercial Code). Kept by Stripe and by us.
- Server logs: TO BE COMPLETED: log retention period
As things stand, no automatic purge is in place. Your files remain on our disks until you ask for them to be deleted, or until we implement the periods stated above. We would rather tell you that than let you believe in an erasure that is not happening.
10Your rights
The General Data Protection Regulation gives you, over the data concerning you:
- the right of access: to know what we hold, and to obtain a copy of it;
- the right to rectification: to have inaccurate data corrected;
- the right to erasure: to have your account and your files deleted, subject to what the law requires us to keep;
- the right to restriction of processing;
- the right to object, for processing based on our legitimate interest;
- the right to portability: to receive your data in a machine-readable format;
- the right to give directions as to what becomes of your data after your death (Article 85 of the French Data Protection Act).
How to exercise them: write to zictovid@alexandre-devaux.com from the email address on your account. We answer within one month, extendable by two months where the request is a complex one — in which case we tell you so.
There is no “delete my account” button in the application yet. Deletion is done by hand today, on written request, within the same time limit.
11Security
Traffic between your browser and the service is encrypted. The session token is out of reach of page JavaScript, which puts it beyond an injected script.
We keep no passwords — there are none — and no card details: Stripe collects those directly.
The machines holding the database and the files are operated by us, in France, and are not exposed directly to the internet: the API is reached through a tunnel.
No measure is absolute. Should a data breach be likely to result in a high risk to your rights, we tell you and we notify the CNIL, as Articles 33 and 34 of the Regulation require.
12Minors
The service is not intended for anyone under 15, and we do not knowingly collect their data.
If you are the legal guardian of a minor who has created an account, write to zictovid@alexandre-devaux.com: we delete the account and its files.
13Changes to this policy
We update this policy as the service changes. The date of the last revision is at the top of the page.
Any change to the nature of a processing operation, to its purposes or to its recipients is notified to you by email before it takes effect.
14Complaints
Write to us first at zictovid@alexandre-devaux.com: we would much rather sort the problem out directly.
If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French data protection authority:
- online: cnil.fr/fr/plaintes;
- by post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.