Privacy Policy

For the processing described in this Policy, the controller is JT Digital d.o.o., Stantetova ulica 10, 2000 Maribor, Slovenia, registration number 7423268000, VAT ID SI42228441. You can reach us about anything in this Policy at support@jtdigital.si. We have not appointed a data protection officer; questions go to the same address.

In this list we are the controller: we decide why and how the data is processed. The videos, photos, sound, and text you put into Everyframe are a different case, explained under “Content You Upload or Make”.

• Account data: your email address, your name if you give it, your password (stored only as a one-way hash), whether you have verified your email address, your role, which apps your account can use, and the organisation you belong to, if any. We use it to give you your account and to show you the apps you can use. Basis: performance of our contract with you (Article 6(1)(b) GDPR). Kept while your account exists, and deleted when you delete it.

• Sign-in and security data: the sessions you are signed in with, and the links we send to verify an email address, reset a password, or open an invitation. We store only a hash of each token. A session lasts 7 days; a password reset link 1 hour; an email verification link 24 hours; an invitation 14 days. To protect sign-in from abuse we count attempts per IP address, and our servers log each request with the IP address it came from. Basis: our legitimate interest in keeping accounts and the Service secure (Article 6(1)(f)). Server logs are kept for TODO.

• Waiting list data: your email address, your name, and what you tell us you want to make. Our team receives each new entry by email. We use it to invite you and to decide what to build. Basis: steps you ask us to take before a contract (Article 6(1)(b)). Kept for TODO, also after you create an account.

• Usage data: the pages you open, the page you came from, your browser’s user-agent string, a random session identifier, and, when you are signed in, your user identifier, together with a few events such as signing up, signing in, and finishing onboarding. We collect it ourselves, on our own servers, to understand how Everyframe is used and to improve it. We do not store your IP address with it. Basis: our legitimate interest in understanding and improving the Service (Article 6(1)(f)). Kept for TODO; when you delete your account we remove your user identifier from it.

• Usage limits and costs: how much each of your AI requests and agent runs cost us, and how many analyses, clean-ups, and renders you used each day. We use it to apply the limits the Service shows you and to control our costs. Basis: performance of the contract (Article 6(1)(b)) and our legitimate interest in controlling costs (Article 6(1)(f)). Kept while your account exists.

• Feedback and support: ratings and notes you give on the agent’s work, and messages you send us. Our team reads them to fix problems and improve Everyframe. Basis: our legitimate interest in improving the Service and answering you (Article 6(1)(f)). Feedback is kept while your account exists; support messages for TODO.

• Emails we send you: your address and the message, for email verification, password resets, invitations, and news about your agent runs (a plan ready, a question, a finished or stopped run). Basis: performance of the contract (Article 6(1)(b)). We do not send marketing email.

• Connected platform data: when you connect an account on another platform, the access it grants us, the account’s identifier, name, and picture, and a record of each video you send there (where it went, its title or caption, its status, the platform’s identifier and link for it, and any refusal). We use it only to send what you ask and show you what happened. Basis: performance of the contract (Article 6(1)(b)). Kept until you disconnect the account or delete yours; see “Connected Platforms”.

Where we rely on your consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it. Where we rely on legitimate interests, you may object, and we will stop unless we can show compelling legitimate grounds that override your interests.

Your content is everything you put into Everyframe or make with it: videos, photos, sound, and documents in your library; projects, scripts, captions, and transcripts; briefs and messages to the agent; and the videos, images, and sound the Service makes for you.

Where your content contains personal data about other people, such as the people who appear in your videos, you are its controller and we process it on your behalf, under the processor terms in our Terms of Service (“People in Your Content”). If you are a person shown in someone’s content and want to exercise your rights, please contact them; if you write to us, we will pass your request on.

To give you the Service we:

• store your content in our storage in Germany;

• render videos, transcribe speech, find cuts and scenes, measure sound, clean up voices, and separate people from backgrounds, on servers we run in Germany;

• detect where faces are in a frame, so that a shot can be framed and cropped around them. We do not recognise who a person is, and we keep no data that could;

• send parts of your content to the AI providers in “AI Providers” when you use a feature that needs them.

We keep your content until you delete it or your account. Draft renders are deleted after 7 days, and uploads that never finish after 48 hours.

Some features send parts of your content to an AI provider, which returns the result to us:

• The agent sends your brief, your messages, and what it reads from your files (frames, transcripts, product photos) to Anthropic’s Claude models.

• Generating images, video, voice, and sound effects, and some transcription, sends your prompt and the files it uses to the model you chose, run by fal.ai.

• Writing a prompt for you from a still image uses a model we run ourselves, in Germany.

We do not use your content to train machine-learning models.

You can connect Everyframe to accounts you hold on other platforms, such as YouTube, Google Ads, Instagram, Facebook, Meta’s ad accounts, TikTok, TikTok’s ad accounts, LinkedIn, and X. You sign in with the platform, and it asks you which access to give us. We use that access only to do what you ask: publish or upload the videos you send, add a video to an ad account’s library, check the status of what we sent, and, if you turn it on, read how what you sent performed. We send only when you press Send.

The access a platform gives us works like a key to your account there. We store it encrypted, use it only for the purposes above, never write it to our logs, and never pass it to anyone else.

We do not sell data we receive from a platform, use it for advertising, or share it with anyone except to do what you asked. Our staff do not read it, except with your agreement, to look into a problem you report, for security, or where the law requires it.

When you disconnect an account, we stop using the access, ask the platform to end it where the platform allows, and delete the access and the data we received from that platform within 7 days. We keep the record of what you sent until you delete your account, so that you can see where each video went. You can also end our access in the platform’s own settings. Videos you published stay on the platform until you delete them there.

The platform’s own privacy policy governs what the platform does with your data.

Everyframe uses the YouTube API Services. When you connect a YouTube channel, we receive the channel’s identifier, name, and picture, and the access to upload videos to it. We use them to upload the videos you send, with the title, description, and privacy setting you choose, and to show you each upload’s status and link. We do not read your other videos or your viewers’ data. When you connect a Google Ads account, we receive its identifier and name, and the access to add videos to it as assets for your adverts.

How Google handles your data is described in the Google Privacy Policy, at google.com/policies/privacy. Using YouTube is subject to the YouTube Terms of Service, at youtube.com/t/terms.

You can remove Everyframe’s access at any time on Google’s security settings page, at security.google.com/settings/security/permissions, as well as by disconnecting the account in Everyframe. When you do, or when you ask us to delete the data, we delete the data we received from Google within 7 days.

Everyframe’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data received from Google APIs to develop, improve, or train AI or machine-learning models.

Questions and complaints about how we use data from Google go to support@jtdigital.si.

When you connect an Instagram professional account or a Facebook Page, we receive its identifier, name, and picture, and the access to publish videos to it. When you connect a Meta ad account, we receive its identifier and name, and the access to add videos to its library. We use them only to publish or upload what you send and to show you its status. How to have this data deleted is under “Deleting Your Data”.

When you connect a TikTok account, we receive its identifier, display name, and picture, and the posting options TikTok offers for it, such as who can see a post. We use them to publish the videos you send, or to place them in your TikTok inbox as drafts, with the caption and options you choose, and to show you each post’s status. When you connect a TikTok ad account, we receive its identifier and name, and the access to add videos to its library.

When you connect a LinkedIn profile or page, or an X account, we receive its identifier, name, and picture, and the access to post on it. We use them only to publish the videos you send, with the text you choose, and to show you each post’s status.

Our staff see your data only when they need to. They may see your account, the names of your projects and files, your briefs, and the cost and errors of your agent runs, to support you, keep the Service secure, and fix problems.

To help you with a problem, a member of our staff may sign in as you for up to 2 hours at a time. While they do, they cannot change your password or email address or delete your account, and each time is logged.

To improve the agent, a few named members of our team can read an agent run’s full record: what it did, its messages, and your feedback on it.

You can delete your data yourself, at any time:

• A file: delete it in your library. It is deleted from our storage at once.

• A connected account: disconnect it in Everyframe. We delete the access and the data we received from that platform within 7 days.

• Everything: delete your account in your account settings. We delete your account and everything in it, including your files, your projects, your agent runs, and your connected accounts.

You can also write to support@jtdigital.si from the email address of your account and ask us to delete your data, all of it or only what we received from one platform, such as Facebook or Instagram. We confirm when it is done, within 30 days at the latest, and within 7 days for data we received from a platform. Where the law requires us to keep something, we tell you what and why.

We use service providers who process personal data on our behalf, under written instructions and confidentiality obligations. They are:

• NEOSERV d.o.o., Slovenia: hosting of the Everyframe website, its database, and its email.

• Hetzner Online GmbH, Germany: storage of your content, and the servers that render, analyse, and process it, run the agent, and run our own AI model.

• Anthropic, United States: the language models the agent uses.

• fal.ai (Features & Labels, Inc.), United States: the models that generate images, video, voice, and sound effects, and some transcription.

• Google, Ireland and United States: Google Analytics, only if you accept it (see the Cookie Policy).

When you send a video to a connected platform, that platform receives it because you asked us to send it there. It is not our processor; its own privacy policy applies.

We do not sell personal data and we do not share it for advertising. We disclose personal data to public authorities only where the law requires it, and we tell you when we are permitted to.

Your account and your content are stored in the European Union, in Slovenia and Germany. Some providers in “Who Else Processes It” are in the United States: Anthropic and fal.ai, when you use a feature that needs them, and Google, if you accept Google Analytics. For these transfers we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR). You can ask us for a copy of the safeguards.

We use a cookie to keep you signed in and a cookie that counts page views on our own servers. Google Analytics is used only if you accept it in the cookie banner. Each cookie, what it does, and how long it lasts are listed in the Everyframe Cookie Policy.

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access control on a need-to-know basis, logging of access to customer data, and regular review of our providers. No system is perfectly secure; where a breach is likely to result in a high risk to you, we will notify you in line with Article 34 GDPR.

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you, and obtain a copy;

• have inaccurate data corrected and incomplete data completed;

• have your data erased;

• restrict processing, or object to it;

• receive data you provided to us in a portable format, and have it transmitted to another controller where technically feasible;

• withdraw consent, where processing is based on consent.

Write to support@jtdigital.si to exercise any of these. We respond within one month, and will tell you if we need longer. If you are unhappy with how we handled it, you may complain to the supervisory authority: Informacijski pooblaščenec Republike Slovenije, Dunajska cesta 22, 1000 Ljubljana (ip-rs.si).

Everyframe is not directed at children and we do not knowingly process the personal data of anyone under 18 as an account holder. If you believe a child has created an account, write to us and we will delete it.

We may update this Policy. For changes that materially affect how we process your personal data, we will give you at least 15 days’ notice by email or in-app notification before they take effect, and keep the previous version available on request.

JT Digital d.o.o., Stantetova ulica 10, 2000 Maribor, Slovenia — support@jtdigital.si — jtdigital.si.