Privacy Policy

1. Data Controller

Nils Wildt, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany. Contact: blurhub@mailbox.org

2. What We Collect

— Uploaded videos

Processed server-side. All videos — input and rendered output — are deleted within 24 hours of upload, regardless of outcome.

— Account data

Email address (via Supabase Auth)

— Usage data

Anonymous analytics via Google Analytics

— Payment data

Handled by Stripe (we never see your card)

3. Video Processing

Videos are processed on our servers. Input videos are deleted after successful processing. Output videos are available for download for 24 hours, then automatically deleted.

4. Content Moderation

We scan uploaded videos for explicit content using automated tools. This is a safety measure — flagged videos are rejected and not stored. We do not retain flagged content.

5. Third-Party Services

— Supabase

Authentication (email only)

— Stripe

Payment processing

— Modal Labs

GPU compute for AI inference (face detection, segmentation). Data processed in EU region. DPA in place.

— Hetzner

Object storage for uploaded and processed videos. Data centers in Helsinki, Finland (EU). DPA in place.

— Google Analytics

Anonymous usage analytics

6. Your Rights (GDPR)

You have the right to: access, rectification, erasure, portability, restriction, and objection. Contact blurhub@mailbox.org to exercise these rights.

7. Data Retention

— Videos:

All uploaded and rendered videos are deleted within 24 hours of upload, regardless of outcome (S3 bucket lifecycle, enforced automatically).

— Account data:

Retained until account deletion

— Analytics:

Google Analytics data retained for 26 months (Google default). Deleted automatically thereafter.

Legal Basis for Processing

We process your data under GDPR Art. 6(1)(b) (contract performance — delivering the anonymization service you requested), Art. 6(1)(f) (legitimate interests — fraud prevention, security, service improvement), and Art. 6(1)(a) (consent — for analytics and tracking cookies, which are gated behind the cookie banner). Sensitive data (biometric processing for per-face selection) is processed under Art. 9(2)(a) with your explicit consent at upload time.

Cookies & Tracking

Essential cookies: an anonymous quota fingerprint stored in localStorage (no server-side cookie). Tracking cookies: Google Analytics sets cookies only after you click 'Accept' in the cookie banner. We do not use advertising cookies or share data with ad networks. You may withdraw consent at any time by clearing the 'blurhub_consent_v1' key in localStorage.

Data Processing Agreements

BlurHub maintains controller-processor agreements (DPAs) with all sub-processors: Hetzner (storage), Modal Labs (compute), Supabase (authentication), and Stripe (payments). Copies are available upon request to blurhub@mailbox.org.

Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware, in accordance with GDPR Art. 33. If the breach is likely to result in a high risk to your rights, we will also notify you directly.

8. Transfers

All video data is stored in the EU (Hetzner Object Storage, Helsinki, Finland). AI inference runs on Modal Labs within the EU region. Stripe (payments) and Supabase (authentication) process data under their own DPAs with standard contractual clauses. No data is transferred to jurisdictions without an adequacy decision or appropriate safeguards.