Privacy policy

1. Controller

Responsible

mTw.Solutions Inh. Marcel Weber

Address

Pfarrer-Settele-Straße 6
86554 Pöttmes
Deutschland

Email

[email protected]

Phone

08253 995 69 31

No data protection officer is appointed (not required by law); requests should be directed to the contact address given.

2. What this is about

The application is used to upload videos, cut them in the browser and create subtitles from them by transcription and translation. Only the data necessary for this is processed. There are no analytics or advertising cookies and no profiling for advertising.

To measure reach we count page views and unique visitors without cookies and without third-party identifiers: for this, the IP address and browser identifier are processed only briefly and condensed with a key that changes daily into an anonymous counter value. Recognition across days or across other websites is therefore ruled out; the raw data is deleted after six months at the latest.

3. Account and sign-in

An account can be created by yourself (email address and a password of your choosing); accounts can additionally be created by the operator. To confirm the address, a one-time link is sent by email. Stored are: email address, password hash (not plain text), role, the chosen interface language (for emails and the payment page), time of creation, time of email confirmation and - if needed - a timestamp for an account lock after failed sign-ins.

Short-lived, single-use tokens are generated for sign-in, confirmation and password reset and recorded in the account; they lose their validity on expiry or use. Passwords are stored exclusively hashed and are not readable by us either.

The legal basis is Art. 6(1)(b) GDPR (performance of the usage contract) and Art. 6(1)(f) GDPR for abuse prevention (account lock, logs).

4. Videos, subtitles and translations

Uploaded videos, generated output files, subtitles and cost records are stored assigned to the respective account. For subtitling, the audio track of the video is transmitted to a transcription service and the result is translated.

Editing and the preview run in the user’s browser: the work itself happens on your own device and no additional data is transmitted to us for it. Optionally, the required media can be preloaded into browser storage; that storage can be released again in the application at any time and disappears when browser data is cleared.

The files are thereby transmitted to the processors named under item 8 and processed there on our behalf. Use for other purposes (such as training models) is not agreed.

Legal basis: Art. 6(1)(b) GDPR. The user is responsible for the video content itself - they may only upload material for which they hold the necessary rights.

5. Sign-in with Google, Apple or Microsoft

If enabled, sign-in can happen via one of these providers. Transmitted are the account identifier at the provider, the email address and - if the provider supplies it - the displayed name. An account in this application is not created automatically: sign-in only works if an account already exists for the email address, and only if the provider reports the address as confirmed.

Legal basis: Art. 6(1)(b) GDPR. Sign-in with password remains available at any time; the link is then no longer used.

6. Cookies and local storage

Without your consent, two cookies are set. The session cookie (name payload-token) - httpOnly, SameSite and, when running over HTTPS, Secure - is required to operate sign-in (§ 25 (2) no. 2 TDDDG). In addition, NEXT_LOCALE stores exclusively the chosen interface language so that the page appears in the same language on the next visit. Both are required for the service you explicitly requested; nothing is read out or analysed.

For the short duration of an OAuth sign-in, an additional one-time cookie is set that only secures the return and is deleted immediately afterwards.

Voluntarily, and only at the push of a button, the browser stores media for the offline preview in its own storage (Cache Storage) so that editing stays smooth even on a slow connection. This data does not leave the device and can be removed in the application via “Release” or by clearing browser data.

Your choice in the cookie banner is stored in the browser’s local storage (localStorage, entry mtw.consent). This is required for the service you expressly requested (§ 25 (2) no. 2 TDDDG) and contains only the category and a timestamp. You can change it at any time via “Cookie settings” in the footer.

Google Analytics 4 is loaded only once you have agreed in the banner. Only then are the usual identifiers (_ga, _ga_<ID>, _gcl_au) set and data transferred to Google Ireland Limited (shortened IP address, page visited, referrer, device and browser). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can revoke it at any time via “Cookie settings” in the footer; measurement then stops immediately and the identifiers are deleted.

The error reporting in the browser also stores a technical entry in the session storage (sessionStorage) which links related requests to one another. It contains no identifier that recognises you and disappears when the tab is closed.

7. Logs

Operating the service produces technical logs (time, function called, result, error text, shortened IP address if the server logs it). They serve troubleshooting and security (Art. 6(1)(f) GDPR) and are deleted regularly.

For troubleshooting we additionally run our own error reporting: short reports about program errors (time, error message, program version, page called, type of browser and device) go to a self-operated service under our own address (error.mtw-solutions.de). The application forwards the reports on the server side - the error store therefore sees our server address, not the address of your device. The content of your videos and subtitles, account data and cookies are not transmitted.

8. Recipients and processors

• Hetzner Online GmbH- Operation of the application, storage of accounts, projects and videos
• Cloudflare, Inc.- Storage of uploaded and generated video files (R2) and delivery of the error reports at our error address (CDN/proxy)
• OpenAI, L.L.C.- Transcription of the audio track and translation of the subtitles (processing under a DPA)
• Resend, Inc.- Sending invitations, password resets and notifications
• Google Ireland Limited- Reach measurement with Google Analytics 4 – only after your consent (see item 6)
• Stripe Payments Europe, Ltd.- Payment processing, subscription management and invoicing (own responsibility for payment data)

A transfer to third countries (such as the USA) only takes place on the basis of the EU standard contractual clauses or a valid adequacy decision.

9. Retention period

Account data and videos remain stored as long as the account exists. Deleted projects and media are removed; technical backups expire after a short time. Sessions expire automatically (twelve hours).

When a paid access ends (cancellation, expiry of the free trial, failed payment), the content is kept for 14 days - reactivation is possible within that time without data loss. After that, projects, videos and media are deleted together with their files. Account and invoice data are additionally kept for as long as commercial and tax law requires (§ 147 AO, § 257 HGB).

9a. Billing and payment data

For concluding and managing subscriptions we use the payment service provider Stripe. Payment processing, including the collection and storage of payment data (e.g. card or account details), is carried out exclusively by Stripe as an independent controller; we neither receive nor store complete payment data. From Stripe we only receive the information required for contract management (customer identifier, subscription status, terms, invoice numbers and amounts).

Processed are: email address, subscription and payment status, term and invoice data. The legal basis is contract performance (Art. 6(1)(b) GDPR) as well as compliance with legal obligations (Art. 6(1)(c) GDPR).

10. Rights of data subjects

You have the rights to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consent given can be withdrawn at any time. Complaints can be addressed to a data protection supervisory authority, usually the one at your place of residence.

11. Changes

If processing changes (new services, new features), this statement is updated. The version published here is decisive; the date is shown at the top.