BrainBite Video Privacy Notice

This overview maps the data actually used by Video to its purpose and recipients. Not every tool receives every category. The sections below explain the legal bases, retention, transfers and your rights.

BrainBite B.V., Koningsweg 101, 5211 BH 's-Hertogenbosch, the Netherlands, Dutch Chamber of Commerce number 42044611, is the controller for its own Video account administration, service operation, billing, security and support. For privacy questions and rights requests, email support@brainbite.ai and state that your request concerns Video. General company information: https://www.brainbite.ai. General contact: info@brainbite.ai.

A school or other organisation can be the controller for processing whose purposes it determines, with BrainBite acting as processor under an appropriate written agreement. That agreement and the school's notice explain its instructions and legal basis. We remain controller for our own administrative and legal obligations. An organisation account alone does not establish a processor arrangement.

Self-service accounts are for adults and must not contain identifiable pupil images, voices, records or pupil-identifying text. School processing of that material requires an appropriate arrangement with us first. If such data is supplied accidentally, stop further use and contact us so we can assess restriction and deletion with the appropriate controller.

We process your email, account identifier, login and verification data, name and profile information you supply, language and preferences, organisation membership and role, invitation information and account status. Google sign-in provides the identity information authorised in that flow. We do not receive your Google password.

We use this information to authenticate you, operate and personalise your account, manage organisation access and communicate about the service. The legal basis is performing our contract with you. Where an organisation is the contracting customer, necessary contact and membership administration relies on our legitimate interest in managing that relationship or the organisation's documented instructions, as applicable.

We retain records of affirmative terms acceptance and adult/organisation confirmation, including the account, document and acceptance-copy versions, language, entry flow and server timestamp. The privacy notice version records what information was presented, not blanket privacy consent. We use agreement evidence for contract administration and our legitimate interest in resolving disputes; legally required records are processed to comply with the relevant obligation.

Your prompts, lesson settings, document text and files, reference images and associated metadata can contain personal data. Drafts, scripts, images, audio, video, subtitles, thumbnails and project or generation identifiers may also contain personal data. We process the material needed to create, save, edit, deliver and export the work you request, including necessary safety checks and provider requests.

For your own permitted personal data, this processing is necessary to provide the requested service under our contract. Safety, abuse prevention and service reliability also rely on our legitimate interests in protecting users and the service, balanced against their rights. Where we process on a school's instructions, the school determines the legal basis and we act under its agreement. Your agreement with us is not by itself a legal basis for every third person's data in a file.

Only upload material you are permitted to use with the recipients described here. Remove personal data that is unnecessary for the lesson. Upload rights confirmations document your stated authority but do not verify it or turn sensitive information into ordinary data. We do not need pupil dossiers or special-category data for the self-service product.

If you choose own-voice narration, we process your voice recording, the text spoken, voice-feature request record, synthetic voice identifier and generated narration. The recording is sent to ElevenLabs to create and use a synthetic version of your voice for your videos. Only your own adult voice is permitted. You make a separate specific request before transfer; access to other Video features does not require it.

The legal basis for the optional creation and use of your own synthetic voice is your specific consent/request. You can withdraw consent and stop future use by contacting support@brainbite.ai; withdrawal does not make earlier lawful processing unlawful. We may retain limited evidence of the request where necessary for legal obligations or legitimate dispute-handling interests. Existing narration and copies already shared require separate consideration when you request erasure.

A voice recording is personal data. Voice characteristics may reveal other information about a speaker. Special-category biometric rules can apply where biometric processing is used to uniquely identify a person; this narration feature is not offered as an identity-verification service. Do not record another person or include sensitive information in your sample.

Stopping use or closing an account does not necessarily remove every provider-held clone, generated narration or recipient copy instantly. Ask us to delete the recording and clone, identifying your account and the voice. We assess and coordinate applicable provider deletion, tell you about any lawful retention or technical limitations, and handle the request within GDPR deadlines.

We process your plan, trial and subscription status, purchase and payment references, billing contact details, invoices, refunds, credit balances, reservations, usage and generation-settlement records. Stripe handles payment details through its checkout and payment services. BrainBite does not need your full payment-card number to provide Video.

We use these data to perform your purchase, allocate and reconcile credits, manage cancellation and refunds and answer billing questions under our contract. Keeping required tax and accounting records is a legal obligation. Fraud prevention and resolving payment disputes rely on our legitimate interests. Stripe also processes some information as an independent controller under its own privacy notice.

We process video identifiers, share settings, publication status, displayed creator or organisation information and access information needed to serve a video. A private video, an anyone-with-link video and a public or community video have different audiences. Before sharing, check the selected audience and displayed profile fields.

Providing the audience and link you request is part of the service. Security and abuse monitoring for viewers rely on our legitimate interests. Where optional analytics are enabled, viewing and completion measurement relies on the separate choice described below. Watching a video does not by itself authorise unrelated marketing.

Anyone with a sharing link can forward it, and public videos may be indexed or viewed by people you do not know. Recipients can copy, record or take screenshots. Revoking a link or deleting the original cannot recall their copies. Contact support@brainbite.ai to report a privacy issue or request restriction of material you believe unlawfully identifies you.

When you contact us or report content, we process your contact information, message, attachments, relevant account or video details and the steps taken to resolve the matter. We use these data for requested assistance and our legitimate interests in handling complaints, enforcing proportionate rules, protecting rights and resolving disputes. Compliance with a valid legal demand or statutory duty relies on the relevant legal obligation.

Technical operation can involve IP addresses, timestamps, browser and device information, request and error identifiers, security events and diagnostic logs. Sentry supports error monitoring and diagnostics. These data are not all anonymous. We use necessary diagnostics and security information under our legitimate interest in operating a reliable and secure service, with access limited to what the purpose requires.

Do not send passwords, full card details, unnecessary pupil information or sensitive records in support messages. We may ask for proportionate identity or authority verification before disclosing account data or carrying out a sensitive request.

Functional cookies and browser storage provide sign-in, authorised playback, consent choices, local drafts and display/accessibility settings you request. These are distinct from optional measurement. Reject all does not erase drafts or disable sign-in. Shared devices can retain local information; sign out and clear local copies where appropriate.

Statistics loads Google Analytics for page and product events. Finished videos is a narrower Google Analytics choice for video_start and video_complete with viewing context, scene count and rounded duration, without the full page-view mode. Both can still involve browser identifiers, device and connection information. Statistics includes finished-video measurement. Neither enables Microsoft Clarity or Sentry recordings.

Session recordings is a separate opt-in for Microsoft Clarity and Sentry to analyse screen/DOM changes, clicks, scrolls, page and device information and session identifiers. It is off by default and is not inferred from an older Statistics choice. Sentry masks all text and inputs, blocks media and disables network-body capture; Video explicitly masks body content for Clarity; its provider masking configuration also applies. Masking is not guaranteed anonymisation. Avoid entering sensitive information while recording is enabled.

Necessary Sentry error monitoring is separate from recordings: screen replay, performance sampling and general console log collection are not enabled by default. Error messages, stack traces, page/request information and browser context can still contain personal data and support our legitimate interest in service reliability. Hosting and security logs also operate independently of optional measurement.

Use Manage cookies in the footer or the controls below to refuse, grant or withdraw optional choices. New choices store this browser’s flags, consent-copy version and time and are renewed after 180 days. We stop future optional collection, signal withdrawal to loaded tools, stop Sentry without flushing its pending replay segment and reload if needed. We attempt to remove accessible first-party Analytics/Clarity cookies; provider-domain or HttpOnly storage requires the provider or browser controls. Withdrawal cannot recall data already sent. You may separately request erasure or object to legitimate-interest processing.

Video does not treat cookie consent as marketing, own-voice or research consent. We disable Google advertising signals/personalisation in the app configuration and send Microsoft advertising-storage consent as denied. Actual provider dashboard settings, retention and onward processing still need to match these purposes. Provider notices and the inventory below identify relevant tools and storage.

Google Fonts requests the site’s typefaces independently of Google Analytics. Google’s font endpoints can receive IP and request/browser information. We use this connection for consistent, readable presentation under our legitimate interest in providing the interface.

Names and lifetimes below describe the app and documented provider defaults. Browser restrictions, hosted checkout/login and actual provider configuration can differ. Cookie lifetime does not equal server-side data retention.

We disclose the data needed for each operation to the providers supporting it: Supabase for authentication, database and storage; Google Cloud for server and media infrastructure and Gemini/Veo for AI generation; ElevenLabs for speech and optional own-voice generation; Cloudflare and Lovable for hosting and application delivery; Resend for service email; Stripe for checkout and billing; and Sentry for diagnostics. Google Analytics receives optional measurement data; Microsoft Clarity and Sentry receive optional recordings only under their separate choice. Google Fonts receives the browser requests described above.

AI operations can send prompts, necessary source text, images or audio and generation metadata to the relevant provider. A voice recording goes to the voice provider when you specifically request that feature. Not every provider receives every file. Authorised staff or contractors may access relevant data for support, security, administration or responding to a rights request, subject to access controls and applicable confidentiality duties.

Providers act as processors or subprocessors where they process on documented instructions. Some, particularly payment and identity providers, can also act as independent controllers for their own legal, security or account purposes. Their relevant notices explain those activities. We may disclose information to authorities where legally required or necessary to establish, exercise or defend legal claims. We do not sell your personal data.

The current service uses external AI providers. This notice does not promise that every provider has the same retention, training settings or confidentiality conditions. Our limited processing permission is not authority for unrelated training or advertising. Contact us about the arrangements relevant to your use; schools must agree their applicable processor and subprocessor terms before providing pupil data.

Providers and their support or subprocessors may process data outside the Netherlands or the European Economic Area, including in the United States. A service's EU-region option does not mean every category of data, support access or onward transfer stays in the EU. This notice makes no blanket EU-only residency claim.

Where an international transfer falls under GDPR transfer rules, it must have a valid mechanism, such as an applicable European Commission adequacy decision or standard contractual clauses with any necessary supplementary measures. The applicable mechanism depends on the actual recipient and processing arrangement, not merely the provider's brand. You can request information about the safeguards relevant to your data and a copy where available, with confidential terms or others' data appropriately protected.

Account and project data are kept while needed to provide your active service and resolve account matters. You can remove work, stop sharing, export available work and request closure. Generation media, uploaded sources and operational records can have different storage lifecycles. A failed generation, outstanding payment, report or legal claim can require limited records to remain after normal use ends.

Financial and invoice records are kept for applicable statutory accounting and tax periods. Agreement and consent/request evidence is kept as needed to show the relationship, honour withdrawal and resolve claims within applicable limitation periods. Support and security records are kept according to the incident, complaint, abuse-prevention and legal purpose, with shorter retention where the information is no longer needed.

Deletion of active data, provider copies, synthetic voices and backups is not necessarily simultaneous. Backup data is removed or overwritten through the relevant backup lifecycle and is restricted from ordinary use. Where a backup is restored, applicable deletion requests must be taken into account. Provider retention also depends on the operation, contractual settings, security duties and legal holds. Contact us for the retention criteria and status of a specific recording, project or request.

We do not promise a universal 30-day deletion deadline for every system. We handle erasure requests under the GDPR response deadlines below, assess any lawful exceptions and explain remaining data and the applicable reason or deletion criteria. Files you downloaded, recipient copies and storage controlled by your school or another independent party require action with that party as well.

We use technical and organisational measures appropriate to the processing, including access restrictions, authentication and protected service connections. No internet service can promise absolute confidentiality or security. You help protect information by controlling your account, uploads, share audience and local copies, but those responsibilities do not remove ours.

Automated checks may flag unsafe material or abusive activity. Reports and disputed restrictions can receive human review through support. Video is not intended to make solely automated decisions about you with legal or similarly significant effects. If you believe such a decision has occurred, contact us to request an explanation and applicable review rights.

Depending on the processing and applicable law, you can request access and a copy, correction, erasure, restriction and portability. You may object to processing based on legitimate interests, explaining your circumstances, and you can object to direct marketing at any time. Where processing relies on consent, you may withdraw it as easily as giving it without affecting earlier lawful processing. You also have applicable safeguards concerning automated decisions.

Email support@brainbite.ai to exercise a right. We respond without undue delay and normally within one month. Where GDPR permits an extension because of complexity or number of requests, we explain the extension and reasons within that first month; the extension can be up to two further months. Requests are normally free. Any exception, identity check or refusal must meet the law, and we explain the reason and available complaint rights.

Account export tools can offer only certain product data or formats. Their technical limits do not cap your statutory access or portability rights. Likewise, account closure and an erasure request are separate: you can request rights without accepting new terms, purchasing anything or waiting for account closure. Erasure may have lawful exceptions, such as necessary financial records or legal claims.

For data controlled by your school, contact the school or send us the request so we can direct it and assist under the applicable agreement. You may complain to the Dutch Autoriteit Persoonsgegevens at https://autoriteitpersoonsgegevens.nl or another competent supervisory authority, including the one for your habitual residence, workplace or alleged infringement. Contacting us first is helpful but not required.

We need an account identity and the information required to perform the operation or purchase you request. If you do not provide it, we may be unable to supply that operation. Own-voice creation, optional measurement, marketing and any separate research contribution are not required simply to agree to the Video terms. A choice for one purpose does not authorise another.

This notice describes the service rather than requesting blanket consent. A materially new processing purpose requires the applicable information and lawful basis before it begins. We do not treat earlier cookie acceptance, account age or a payment as consent to unrelated research or AI model training.

This notice is version 2026-10-20. We update it when processing or legal requirements change and provide appropriate information for material changes. Saved version links identify the text presented at that time; they do not claim the processing remains unchanged forever. You can print or download this notice and ask support about the processing that applies to your account.