Data processing agreement

1. Who does what

You (the business using FrameCutter) are the controller of the personal data in the footage, images and audio you upload. Kairen AI Consulting (KvK 98386212), trading as FrameCutter is your processor for that data. For your own account data (your email address, plan and billing), we are the controller, as our Privacy policy says.

2. The processing

• Subject matter and purpose: editing the videos you ask for, storing your footage and videos, and showing them to you.
• Nature: storing, transcribing, analysing a few still frames, cutting, rendering and deleting.
• Kinds of data: images and video of people, their voices and what they say (transcripts), and anything else visible or audible in what you upload.
• People concerned: anyone who appears or is heard in your footage, images and audio.
• Duration: as long as your account has the content: originals are deleted 3 days after upload (14 on Pro), the rest when you delete it, delete your account, or 30 days after a paid plan ends. Edit plans, chat messages, preferences and styles stay while your account is active; earlier versions of a video are kept 24 hours, except the current, newest and exported versions, which stay while your account is active. needs Vlad's check
• We don't use this data to identify people, build face or voice profiles, or train AI.

3. Our commitments

• We process the data only on your documented instructions: your uploads, prompts and edits, and these terms. If we think an instruction breaks the law, we tell you.
• Everyone who works on FrameCutter is bound to confidentiality.
• We keep the data secure with the measures in the annex below. needs Vlad's check
• We help you answer requests from the people in your footage (access, deletion and so on), mainly through the tools in the app: you can delete any clip or video, or everything, yourself.
• We help you with security, breach notifications and data protection impact assessments where you need information only we have.
• We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we're doing about it. needs Vlad's check
• When our service ends for you, we delete the data as in section 2; you can download your videos before that.
• We give you the information you need to show this agreement is kept, and answer reasonable audit questions in writing (an on-site audit only if a supervisory authority requires it, with notice).

4. Our sub-processors

You authorise us to use the kinds of providers listed in section 7 of our Privacy policy (hosting, database, file storage, AI, transcription, email and the others there; not our payment partner, which acts as an independent controller). Each is bound by data protection terms at least as protective as these. The names are available on request at privacy@framecutter.com. We tell you at least 30 days before adding or replacing any provider that processes your data, by email or in the app; if you object on reasonable data protection grounds and we can't resolve it, you can end your plan and get a refund of the prepaid, unused period. needs Vlad's check

5. Transfers outside the EU

Your footage and videos are stored in the EU. Where a provider processes data outside the EEA (for example AI providers reading transcripts and a few still frames), we rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. Your commitments

You have a legal basis for the footage you upload, have told the people in it what you'll do with it as the law requires, and only ask us to process what you're allowed to.

7. Liability and precedence

Liability under this agreement follows our Terms. If this agreement and the Terms disagree about personal data, this agreement wins. If you need a signed copy for your records, email privacy@framecutter.com.

8. Contact

Annex: security measures

• Encryption: all traffic to and from FrameCutter is encrypted in transit; your files and database are encrypted at rest by our storage and database providers.
• Per-account isolation: every account sees only its own footage, videos and data; files are served only to their owner through short-lived signed links.
• Access control: the keys to the database and storage stay on our servers; admin tools are limited to named team accounts.
• EU storage: your footage, videos and database are stored in the EU.
• Logging: errors and security-relevant events are logged and alert the team.
• Deletion: as in section 2, and at once when you use “Delete my data” or delete your account. needs Vlad's check