Privacy policy

Controllers

Responsible for data processing on screencurve.com are Sebastian Kehle and Felix von Rautenberg, Eva-Laube-Weg 5, 14473 Potsdam, Germany. Contact: mail@webvise.io.

What data we process

Account data: the email address and name taken from your Google or Microsoft account at sign-in, or the email address we send a one-time code to when you sign in with a code.

Sign-in service WorkOS: sign-in is handled by our provider WorkOS, with Google, Microsoft, or a code by email. WorkOS processes your email address, your name, and, for a Google or Microsoft sign-in, the identifier of that account, plus technical sign-in data such as IP address and time of sign-in.

Google sign-in: when you sign in with Google we receive your email address, name, and profile picture from Google. Only identity data is requested.

Microsoft sign-in: when you sign in with a Microsoft account we receive your email address, name, and profile picture from Microsoft. Only identity data is requested. If your account belongs to a Microsoft Entra organization, its administrator can approve or block sign-in to screencurve.

Google Drive: importing video files from Google Drive is planned but not yet enabled in the current version; nobody links a Drive account today. Once this feature is live, linking your account gives us read-only access to list and import the video files you select, and we do not read any other content of your Drive account.

Video material and analyses: episodes, scripts, and reference documents you upload, and the analysis results derived from them, are stored within your production company.

Technical logs: using the application produces technically necessary server logs (e.g. IP address, timestamp, requested resource).

Notifications: we send emails to your account address for events such as invitations, finished or failed analyses, shares, and quota warnings. You can turn off each kind of notification individually in your personal settings.

Purposes and legal bases

We process this data to provide the application and perform the usage contract (Art. 6(1)(b) GDPR) and to ensure security and stability based on our legitimate interest (Art. 6(1)(f) GDPR).

Once available, linking your Google Drive account is based on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by disconnecting Drive in the settings; the lawfulness of processing before the withdrawal remains unaffected.

Processors and recipients

We use the following processors: Vercel (hosting the application; serverless functions run in the Frankfurt region), Neon (database, Frankfurt region), Google Cloud (storing video material and stills, and the analysis service, in the Frankfurt region/europe-west3; the AI-based analysis itself runs on Vertex AI over the EU multi-region endpoint, for which Google guarantees that processing stays within the EU), Resend (transactional email), WorkOS (sign-in and user account management), Microsoft (sign-in with a Microsoft account), and Google (sign-in with a Google account and, once enabled, Drive import). Data processing agreements are in place with these providers; where data is processed outside the EU, this happens on the basis of EU standard contractual clauses (WorkOS: USA, EU standard contractual clauses and the Data Privacy Framework).

For error tracking we use PostHog (EU, Frankfurt region): only technical error reports from the application, no usage analytics, and no session recording.

For market checks, we use Exa for web search and Firecrawl for retrieving web pages as further processors. A market check sends search queries to Exa and the URLs of publicly accessible pages to Firecrawl.

Google API services

Once Google Drive import is enabled, screencurve's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Drive data will then be used solely to import the video files you select, not for advertising and not for disclosure to third parties.

Cookies

screencurve uses only technically necessary cookies: a session cookie for sign-in through WorkOS, a cookie for your language choice, and a cookie that remembers whether the sidebar is collapsed. There is no tracking and there are no analytics cookies.

Retention

We store account data until you delete your account in your personal settings.

Video material and analysis results belong to the production company. They persist until an admin of the production company deletes the respective project; that removes the video files, stills, and analysis results from the application. The underlying objects in storage can still be recovered for 30 days afterward, before they are permanently deleted. An admin can delete an entire production company only once it has no project left.

Technical logs are deleted automatically after a short period.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15-21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). To exercise these rights, contact mail@webvise.io.