Privacy Policy

This policy explains which personal data boonvid processes when you use the website and the service: why, on which legal basis, for how long, who receives it, and which rights you have.

Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Firehorse Media LLC
30 N Gould St Ste R
Sheridan, WY 82801
United States of America

A limited liability company under the law of the State of Wyoming, registered with the Wyoming Secretary of State under ID 2026-001921765.

Email for all privacy questions and requests: hello@boonvid.com

What we process, why, and for how long

The table shows which personal data we process, for which purpose, on which legal basis under Art. 6(1) GDPR, and how long we keep it.

We do not create profiles, we do not sell data, and we do not use your uploads for advertising. Customer data is not used to train AI models.

Contact form

If you write to us with the contact form, we store your name, your email address, the subject if you give one, your message, the language of the page and the time we received it. We forward the message by email to our own mailbox, through our email service provider (see “Recipients”), with your email address as the reply address, so that we can answer you. We do not send an automatic email to the address you enter. We use these details only to answer your message and to deal with your request.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before entering into one; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries. To protect the form against abuse, our server counts requests per IP address and per email address, each within a time window of at most one hour. These counters are kept only in the server’s memory and are never written to disk; the server deletes expired counters as further requests come in, and at the latest when it restarts.

Retention: we delete the stored message automatically 12 months after we received it, and the copy in our mailbox within the same period, unless we need it for longer to perform a contract with you or to establish, exercise or defend legal claims.

Using the form is voluntary. Without a name, an email address and a message we cannot answer you; you can also write to hello@boonvid.com instead.

Affiliate Program applications

If you apply to the Affiliate Program, we store the details you enter in the form: your name, your email address, the link to your website, channel or profile, your platform, your niche, your audience size, how you would promote boonvid, your country and your note if you write one, together with the language of the page and the time we received your application. We forward your application by email to our own mailbox, through our email service provider (see “Recipients”), with your email address as the reply address. We do not send an automatic email to the address you enter; a person reviews your application and answers you by email. We use these details only to review your application and to answer you.

Legal basis: Art. 6(1)(b) GDPR, steps you asked for before entering into an affiliate agreement with us. To protect the form against abuse, our server counts requests per IP address and per email address, each in a window of at most one hour and only in its memory, as described for the contact form.

Retention: we delete your stored application automatically 12 months after we received it, and the copy in our mailbox within the same period. If we agree on an affiliate partnership, we keep what that agreement needs for as long as it runs and as required by law.

Arcade challenge

On our website and in the waiting area while your video is being built, you can play an optional mini-game, the arcade challenge. Its rules and rewards are in the participation terms.

Practice and playing without an account: practice rounds, and rounds you play without being signed in, are not sent to us. Without an account, the number of tries you have left and your best score are kept only while the page is open. To show the current rules, the game asks our server for them; this request is handled like any other request to our website (see “Server logs”).

Weekly challenge (signed in): every round starts with a game session from our server, linked to your account ID. When the round ends, the game sends us the score and the times of your inputs. We store the session (a random session key, the course of the round, the start time and, in the waiting area, which of your orders was running), the round (score, the number and times of your inputs, its duration, the result of our automatic check and the time) and the rewards you claim (minutes or discount, the week or claim number, the discount code, its validity and its state). Minutes you receive are credited to your balance like other minutes.

Purpose and legal basis: we use this data to check that a score was reached in a real round before we grant a reward, to keep the limits of the participation terms, to show you your rewards and codes and to credit your minutes: Art. 6(1)(b) GDPR (performing the participation terms). We also use it to detect and prevent misuse, such as automated input or forged and repeated rounds: Art. 6(1)(f) GDPR (our legitimate interest in a fair challenge and in protecting the rewards). A round that our check rejects is noted in our server logs with a shortened account ID, the score and the reason, never with your email address or your name. How many requests an account may send to the game is counted only in our server’s memory (see “Request limits”).

Automated decision: whether a round counts for a reward is decided automatically. If you think a decision is wrong, write to hello@boonvid.com: a person reviews it, and you can state your point of view.

Leaderboard: every signed-in player with a weekly challenge round that passed our check is ranked, so that everyone sees their real place: by the best score of the current week and by the best score ever. On a tie, whoever reached the score first is ahead. For this we keep, for each account, the best score of each week and the best score ever, each with the time it was reached: Art. 6(1)(b) GDPR (performing the participation terms). Only signed-in players can see the leaderboard: the top 10 and their own place; visitors without an account see nothing. Other players see your row only as “Player” with your score. Your first name appears only if you switch it on: Art. 6(1)(a) GDPR (your consent). You can withdraw it at any time with “Hide my name”: the name disappears at once from all views, and your score stays in the ranking as “Player”. We keep your choice (shown or hidden, and when you made it) as long as your account exists.

Discount codes: when you claim a discount code, we create this code at Whop, Inc., our payment provider (see “Recipients”). Whop receives only the code and its conditions (the discount, the number of monthly payments, the eligible plans, the expiry date and that it can be used once), not your name, your email address or your account ID. When you enter the code in the payment form, Whop processes it as part of your payment. We do not pass any other data from the arcade challenge to anyone. Until they expire, your discount code and the minutes you receive from the challenge are also shown to you in the notification bell of your account; the bell uses the stored reward and keeps nothing extra. When a new discount code is issued, we also send it once by service email to your account address, with its validity and conditions. We store the send status with your reward to avoid duplicate messages and investigate delivery failures; these records are deleted with your arcade account data. This fulfils the reward you requested by playing (Art. 6(1)(b) GDPR), and is not a marketing subscription. Codes are not sent by push notification.

Retention: game sessions are deleted 24 hours after they started; the times of your inputs after 7 days; rounds that did not lead to a reward after 7 days. To answer a repeated claim the same way, we keep a copy of our answer for 2 days. Rounds on which a reward is based and your rewards are kept as long as your account exists, because they prove the reward and count toward the limits. Weekly leaderboard scores are deleted 4 weeks after the week they belong to; your best score ever is kept as long as your account exists. Credited minutes are booking records (see “Bookings”). Backups follow the rule in “Backups”.

Deleting your account deletes all arcade data of your account. Unused discount codes and minutes from the challenge lapse with the account; we withdraw unused codes at Whop.

Sound: if you switch the sound of the game on or off, your browser keeps this choice under boonvid.arcade.sound in its local storage (see “Settings and browser storage”). It is not sent to us.

How your video is built

boonvid plans and edits your video with the help of AI: it selects and places the material and checks the result. It does not create synthetic people or AI voices. For this, the AI models of an AI service provider in the USA, acting on our behalf, receive the text of your script and still images of the footage and of the finished video. The same models carry out the content check of your script (during the free check and again when your order is accepted) and the visual checks of the footage and of the finished video. Under the provider’s published commercial terms, none of this is used to train models. Our servers and storage remain in the EU. Footage and photos come from media libraries; they receive only search terms, never your files. Music is uploaded by you and processed on our servers to mix it under your voiceover.

Automated checks

During the free check before ordering, and again before an order is accepted, the text of your script is checked automatically against the content rules in our Terms, by an AI model. If it breaks a rule, the order is not accepted and you see the reason. If the check is unsure, our operator is notified and can look at the order before the video is delivered. If you think the check was wrong, write to hello@boonvid.com: a person reviews the decision, and you can state your point of view.

Automated pre-delivery checks assess available rights information and the match between picture and text, using still images of the video. They are not a comprehensive legal clearance. You may contact hello@boonvid.com to request human review of a decision affecting your order and explain your position. Your applicable data-protection rights remain unaffected. If a check fails, the video is rebuilt; if it cannot be delivered, the minutes are not charged.

Recipients

We pass personal data only to the following recipients, and only for the purposes above:

• Hosting and storage: our hosting and storage providers: servers, storage and backups in data centres in the EU.
• AI processing: an AI service provider in the USA that processes this content on our behalf. It receives the text of your script (to plan the video and for the content check) and still images of the footage and of the finished video (for the visual checks). Under its published commercial terms, the provider may not train models on this content. It stores it in the USA and, as a rule, deletes it within 30 days; content that its automated safety systems flag as a violation of its usage policy can be kept for up to 2 years. Associated safety classification scores may be retained for up to 7 years. Longer retention can also apply where required by law; the 30-day rule is not an unconditional maximum. The models may also process the data in other countries.
• Website delivery and security: a content-delivery and security network provider in the USA delivers the website and the pre-launch page. Requests from your browser to our servers (for example sign-in and orders) also run through this network. Your files (script and voiceover) and your finished videos do not: they are transferred directly between your browser and our storage in the EU. To show prices with the VAT of your country, the page asks this provider which country your connection comes from; the provider derives it from your IP address, and only the two-letter country code goes back to your browser, which keeps it in its local storage. We do not store it.
• Email delivery: an email delivery provider in the USA sends our emails, such as sign-in codes, and forwards messages from the contact form to our mailbox. The pre-launch page sends its emails through the same provider.
• Email mailboxes: a provider of email mailboxes keeps our own mailboxes. It stores the emails you send us, the messages forwarded from the contact form and the application forms, and the copies of payment confirmations in our billing mailbox.
• Text messages: a text-message provider in the USA sends the text message “your video is ready”, only if you ask for one. It receives your mobile number and the text of the message.
• Operator alerts: a messaging service that we use for internal alerts to our operator. It receives no personal data about you. An alert contains only the type of the alert, a fixed description, how many cases of that type are open and the step our operator has to take; notices of new orders, payments and deliveries contain only their type, whether it is a test order, and how many there are. Neither contains a reference to you, your order, your payment or your recording (not even in shortened or hashed form), your email address, your name, payment amounts, your minute balance, the content of your script or your files. The messaging service processes only our operator’s own account data, as for any user of that service.
• Development and operations tools: software tools, including from providers in the USA, that we use to develop, maintain and monitor the service. Under our internal rules they are given no customer content and no contact details: at most internal references, such as a shortened order number, and technical figures. Use of what they receive for training models is switched off.
• Whop, Inc., New York, USA: payment processing. Whop sees your email address, the plan and your payment details; we never see card details. Whop’s own privacy policy applies to the payment.
• Web analytics: a web analytics provider, only with your consent: usage statistics. Processing may take place outside the EU, including in the USA.
• Google Ireland Ltd.: only for the optional sign-in with Google.
• Media libraries and reference sources: licensed stock and archive media libraries, public reference databases for names of people in your script, and map services for map and satellite images of places in it, only search terms and place coordinates, never your files. Search terms may contain names or other personal information from your script; they are not necessarily anonymous.

Transfers to the USA and other countries outside the EU

Firehorse Media LLC is a company in the USA. The service’s servers and storage are in the EU. Where a recipient above is based outside the EU, or may process data there, the following applies to these transfers:

• AI service provider (USA): the provider’s published data processing addendum relies on the EU standard contractual clauses for such transfers.
• Content-delivery and security network provider, storage provider (which keeps the data in the EU), email delivery provider and text-message provider (USA): these providers’ published data processing addenda rely on the EU–US Data Privacy Framework or the EU standard contractual clauses for such transfers.
• Provider of email mailboxes and development and operations tools (USA and possibly other countries): we have not yet documented a transfer mechanism for these transfers and are working on it, by moving our mailboxes to a provider with a data processing agreement and by giving the tools no more than internal references.
• Whop (USA): Whop is its own controller for the payment, and you enter your details in its payment form directly; its privacy policy describes its safeguards. For data that Whop shares with us as a seller (for example your email address and the status of your payment), Whop’s published Seller Data Sharing Addendum relies on the EU standard contractual clauses between controllers and the UK addendum, with Whop as the exporter. For data that we send to Whop ourselves to carry out your purchase or a cancellation you asked for (for example the reference of your membership or a discount code), we are still reviewing the appropriate transfer mechanism.
• Web analytics: the web analytics provider may process data in the USA; this happens only if you have consented to web analytics. The provider states that such transfers rely on the EU–US Data Privacy Framework, under which its US parent company is certified.
• Operator alerts: the messaging service for operator alerts receives no personal data about you (see “Recipients”): the alerts and notices contain no reference to you, your order, your payment or your recording, and no contact or payment details. No personal data about you is therefore transferred to it.

The providers publish the terms named above; on request, we send you the links to the published versions.

Your rights

You have the following rights. To use them, write to hello@boonvid.com.

• Access (Art. 15 GDPR): you can ask whether we process data about you and receive a copy together with the information the law provides for. We send the copy as a file in a structured, machine-readable format.
• Rectification (Art. 16 GDPR): you can have incorrect data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you can have your data deleted, unless we are required to keep it, for example booking records under commercial and tax law. You can delete your account yourself at any time under Account → Delete account (see “Account” in the table above), or ask us by email.
• Restriction of processing (Art. 18 GDPR): in certain cases, for example while the accuracy of data is disputed, you can have the processing restricted.
• Data portability (Art. 20 GDPR): you can receive the data you have provided to us and that we process on the basis of your consent or a contract in a structured, commonly used and machine-readable format, or have it sent directly to another controller where technically feasible.
• Objection (Art. 21 GDPR): see the next section.
• Automated decisions (Art. 22 GDPR): where a decision about your order or a reward is taken automatically (see “Automated checks” and “Arcade challenge”), you can ask for a person to review it, state your point of view and contest the decision.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw a consent at any time with effect for the future. Processing up to the withdrawal remains lawful. How to change your cookie choice is explained in the Cookie Policy; you can withdraw your early-access consent with the unsubscribe link or by email.
• Complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place. In Switzerland and the United Kingdom, see the next section.

We answer your request without undue delay and at the latest within one month (30 days under Swiss law). Where a request is complex, this period can be extended as the law allows; we then tell you why. To protect your data, we may ask you to send your request from the email address of your account or to confirm it from there.

Switzerland and the United Kingdom

If you are in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies; if you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. This policy applies accordingly: you have the rights described under “Your rights”, including access, a copy of your data, rectification, erasure and objection, and you use them in the same way, by email to hello@boonvid.com. Transfers of your data to recipients outside Switzerland or the United Kingdom are based on the safeguards described under “Transfers”, in the form recognised under Swiss or UK law where such safeguards are required.

You can complain to the supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the United Kingdom, the Information Commissioner’s Office (ICO).

Your right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR: account-setup questionnaires, settings and browser storage, ratings, server logs, sign-in protection, request limits, the limits and blocked recordings of the free check, one free test video per person, the counting of cancellation confirmations, alerts to our operator, backups, proof of consents and cancellations, messages from the contact form that do not concern a contract, the unsubscribe note for early access, the misuse checks of the arcade challenge, maintaining the service with development and operations tools, providing requested team invitations and protecting shared account access), you can object to this processing at any time on grounds relating to your particular situation. We then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, write to hello@boonvid.com.

Do you have to provide your data?

You are not legally obliged to. However, an account and the data of an order are needed for the contract: without an email address and your confirmation that you are at least 18 we cannot set up an account, and without a script and a voiceover we cannot build a video. The ready email is part of delivering your order, not a marketing subscription. New accounts must also complete the setup questionnaire described above before continuing; existing accounts and invited team members are exempt. The following are voluntary: signing in with Google, text messages when your video is ready, invitations, ratings, applications to the Creator Program and the Affiliate Program, messages through the contact form, the early-access sign-up, the arcade challenge and consent to web analytics.

Cookies

The session cookie __Host-vd_sitzung keeps you signed in, and short-lived security cookies protect the sign-in itself; the cookie bv_consent and your browser’s local and session storage remember your cookie choice and your settings, such as language and appearance. Your account data is not kept in your browser. These entries are strictly necessary. Web analytics runs only after you have accepted it in the cookie banner. Details are in our Cookie Policy.

Version: 26 October 2026