Privacy policy

01Controller

Personal data processed by Hook It is under the responsibility of Enzo PITRE. For any question or to exercise your rights: enzo.pitre33@gmail.com.

02Data and purposes

Account (contract): email address, display name, optional profile picture, language, password (stored only as an Argon2id hash), invitation used.

Content (contract): uploaded videos — including the image and voice of the people in them —, transcripts, projects, clips, exports, notes you enter; for a link import, the video's address.

Security and abuse prevention (legitimate interest): sessions (browser, dates), non-reversible fingerprints of the IP address and email address, log of sensitive actions.

Invitations (legitimate interest, invitation-only beta): email address of the invited person, entered by the publisher, and an optional note, before any sign-up.

Support (contract): email address, category, subject and message of your requests.

Communications (contract): service emails (confirmation, security, exports); the sending history keeps the address, subject and status, the content being erased once sent.

Product statistics: technical events linked to the account id, without content or email address (legitimate interest); interface events only with your consent (consent).

Billing, once paid plans open (legal obligation and contract): Stripe customer id, subscription, invoices; card data is handled by Stripe.

03Automated decisions

Artificial intelligence is only used to suggest excerpts, titles and descriptions that you freely choose to keep or not; it produces no decision with legal effect on you.

04Recipients and processors

Your data is never sold or rented. Only the publisher and the technical providers processing it on our behalf can access it, as far as needed: hosting (OVHcloud, France), database (Supabase, Paris region), file storage (Cloudflare R2), video processing (Modal), AI analysis of transcript text (Anthropic), email (Resend) and, once paid plans open, payments (Stripe). The data sent to each is detailed on the “Subprocessors” page.

05Transfers outside the European Union

Modal, Resend and Cloudflare are based in the United States; Anthropic processes data in the United States; Supabase is based in Singapore. Some data may therefore be processed or accessible there. These transfers are covered by the data processing agreement concluded with each provider: the European Commission's standard contractual clauses for Modal, Anthropic and Supabase; the EU–US Data Privacy Framework, with standard contractual clauses as a fallback, for Cloudflare and Resend.

06Retention and erasure

Each category of data has a retention period, detailed on the “Data retention” page and enforced by a daily automatic deletion: for example 30 days for ended sessions, 90 days for the email history, 12 months for the security log.

When you delete your account, your content and account data are erased from the database immediately. They disappear from the encrypted backups at most 35 days later. So that restoring a backup cannot undo the erasure, a non-reversible fingerprint of the account's internal identifier — with no email address or other information — is kept for at most 40 days outside the database, then deleted.

07Security

Encrypted connections (HTTPS), hashed passwords, private files only reachable through signed, time-limited links, encrypted backups, restricted administrative access.

08Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and may withdraw your consent at any time. Access and portability: Settings → Privacy → Export my data. Erasure: Settings → Privacy → Delete my account. Other requests, or instructions on what happens to your data after your death: enzo.pitre33@gmail.com. We reply within one month. You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with your local supervisory authority.