Privacy Policy
This policy explains which personal data boonvid processes when you use the website and the service: why, on which legal basis, for how long, who receives it, and which rights you have.
Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
Firehorse Media LLC
30 N Gould St Ste R
Sheridan, WY 82801
United States of America
A limited liability company under the law of the State of Wyoming, registered with the Wyoming Secretary of State under ID 2026-001921765.
Email for all privacy questions and requests: hello@boonvid.com
What we process, why, and for how long
The table shows which personal data we process, for which purpose, on which legal basis under Art. 6(1) GDPR, and how long we keep it.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: email address, name (optional), language, times of sign-up and sign-in; sign-in codes we send by email (there is no password); your confirmation that you are at least 18 years old (the time and the version of the Terms; we do not ask for your date of birth) | Your account and signing in; making sure that only adults use boonvid | Art. 6(1)(b) GDPR (contract) | As long as your account exists. If you ask us by email to delete your account, we delete it within 30 days, except booking records (see below). |
Session: the cookie __Host-vd_sitzung (HttpOnly; deleted when you close the browser, and our server accepts it for at most 8 hours); on our server it is stored only as a SHA-256 hash. While you sign in, short-lived security cookies: vd_anmeldung (classic sign-in page only) and, for sign-in with Google, __Host-bv-google-state and __Host-bv-google-pending | Keeping you signed in; protecting the sign-in against forged requests | Art. 6(1)(b) GDPR (contract); strictly necessary under Section 25(2) of the German TDDDG | Session: until you close the browser, at most 8 hours. Security cookies: until you have signed in (vd_anmeldung) or at most 10 minutes (Google) |
Sign in with Google (optional): your Google account ID (sub) and email address | Signing in | Art. 6(1)(b) GDPR (contract) | Until your account is deleted |
| Orders: script, voiceover, the options you choose, the finished video, subtitles, the list of sources and licences; build logs and check results (they contain the text of your script) | Building, checking and delivering your video, and letting you download it | Art. 6(1)(b) GDPR (contract) | You can download the finished video for 30 days after it is ready; then the download is withdrawn. All files of the order are deleted automatically 90 days after delivery (or 90 days after the order was created, if it was never delivered). Earlier on request by email. |
| “Your video is ready” notice (optional): your email address and, if you ask for a text message, your mobile number | Telling you that your video is ready | Art. 6(1)(b) GDPR (contract) | Deleted together with the files of the order, 90 days after delivery |
| Invitations (optional): your personal invitation codes; when a friend signs up with your link, their email address, linked to yours, and the time of their first subscription payment | Crediting the invitation bonus (10 minutes) to both of you | Art. 6(1)(b) GDPR (contract) | As long as the inviting account exists |
| Ratings (optional): for a finished video, 1 to 5 stars, what you liked and what should be better (fixed categories), free text of up to 2,000 characters, linked to your account and the video, and the time of your last change. One rating per video; you can change it. Private: never published, seen only by the boonvid team. | Improving the product | Art. 6(1)(f) GDPR (legitimate interest in improving boonvid) | Deleted automatically 90 days after the video’s delivery, together with its files. If we delete the video’s files earlier at your request, or your account (see “Account”), we delete your ratings with them. Never kept longer than 24 months after your last change |
| Creator Program applications (optional): what you send us by email to hello@boonvid.com — usually your name or creator name, your email address, links to your channel, profile and recent videos, platform, content niche, audience size, recent views, screenshots of your creator analytics and your message | Reviewing your application and, if there is a fit, getting in touch about a partnership | Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) | If no partnership follows: deleted no later than 6 months after our decision. If one does: for as long as the partnership lasts; minutes credited to you are kept as booking records (see “Bookings”) |
| Bookings: order and payment reference, plan, minutes, credits | Billing and records | Art. 6(1)(b) and (c) GDPR (contract; statutory retention obligations) | As long as commercial and tax law require, at most 10 years from the end of the year in which they were booked |
| Checkout: when you start a purchase, the link between the payment and your account (your account, the email address of your account or, if you are not signed in, the one you entered, plan, billing period, time; after payment, the payment reference); for a subscription, the account its payments belong to; payments we could not yet assign to an account (payment reference, plan, minutes and the account they were later assigned to) | Crediting your payment to the right account | Art. 6(1)(b) and (c) GDPR (contract; statutory retention obligations) | Checkouts that are never paid: 30 days after they were started. Paid checkouts, subscriptions and payments without an account: as booking records, at most 10 years from the end of the year in which they were recorded |
| Payment notifications: what our payment provider Whop reports about a payment (event, time, payment reference, plan, minutes, amount and currency, the email addresses of the credited accounts and the result of the credit; for a refund or chargeback, the refunded amount) | Crediting every payment exactly once; answering questions about payments | Art. 6(1)(b) and (c) GDPR (contract; statutory retention obligations) | Complete for 90 days; then the email addresses are removed and the rest is kept as a booking record, at most 10 years from the end of the year in which it was received |
| Finishing a free test video: which test video was finished as which order, the minutes charged and the calculation behind them (full length, length of the test, remaining minutes) | Charging only the remaining minutes; finishing a test video only once at a time | Art. 6(1)(b) GDPR (contract) | Deleted together with the files of the order it belongs to, 90 days after delivery |
| Consents and cancellations: your statements on the immediate start of the service before payment (email address, plan, billing period, language, whether you were signed in, the time and the version of the Terms; if you buy without an account, also the time of your confirmation that you are at least 18) and cancellation notices (name, email address, contract, type, reason if given, requested date, language and the time they were received) | Proof in our dealings with you | Art. 6(1)(c) and (f) GDPR (legal obligation; legitimate interest in being able to provide proof) | 3 years from the end of the year in which they were recorded |
| Contact form: your name, email address, subject (optional), message, the language of the page and the time we received it — details in the section “Contact form” below | Answering your message | Art. 6(1)(b) GDPR if your message concerns a contract with us or steps before one; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries) | 12 months after we received it, then deleted automatically |
| Server logs: among other things IP address, time and request; they can also contain the short note of the automated content check, which can refer to the content of your script | Security and troubleshooting | Art. 6(1)(f) GDPR (legitimate interest in a secure, working service) | 30 days (AWS CloudWatch, Frankfurt) |
| Sign-in protection: a keyed hash (HMAC) of your email address, never the address itself; the times at which we sent sign-in codes to this address and at which a wrong code was entered; after too many wrong codes, a temporary lock of the sign-in with a code for this address (when it was set, when it ends and its level) | Protecting your account against someone guessing sign-in codes; limiting how many codes are sent to one address | Art. 6(1)(f) GDPR (legitimate interest in the security of accounts) | Sent codes and wrong codes: 24 hours. A lock: until 24 hours after it has ended. A successful sign-in deletes the wrong codes and the lock at once. Our server deletes expired entries at least once an hour |
| Request limits: counters of requests per IP address and per email address (for example for sign-in codes, orders, uploads, cancellations, consents and the contact form), per account, and per delivery of a video (how often it was played or downloaded) | Protecting the service against floods of requests and misuse; every playback or download creates a new, time-limited download link | Art. 6(1)(f) GDPR (legitimate interest in a secure, working service) | Only in our server’s memory, never written to disk. Counters per IP address and per email address: at most one hour; per account and per delivery: at most 24 hours. The server deletes expired counters as further requests come in, and all counters when it restarts |
| Free check before ordering: the script and voiceover you upload, the transcript of your voiceover and the result of the check; a record of each check and each order submission (your account, the upload, its state and result). For fair limits: the seconds of audio checked per account, and counts per account under a shortened SHA-256 hash of the account ID (free checks of accounts without paid minutes, and order attempts that did not lead to an order). If a check had to stop because it took too long: a SHA-256 hash of the recording with the time and, together with your account, a note that makes your second attempt free. If the speech recognition fails on a recording (for example twice within 24 hours), only the SHA-256 hash of that file, which is then no longer processed | Checking before you pay whether script and voiceover fit together and follow our content rules; fair daily limits for everyone; protecting the service against files that make it fail | Art. 6(1)(b) GDPR (steps at your request before a contract); for the limits and blocked recordings Art. 6(1)(f) GDPR (legitimate interest in a service that works for everyone) | Files that do not become an order, and the transcript: deleted about 21 hours after the upload. Records of checks and order submissions: 7 days after they have ended. Seconds of audio: 7 days. Counts: 40 days. Hash and note after a stopped check: 24 hours. Hash of a blocked recording: until we unblock the file by hand |
| One free test video per person: a SHA-256 hash of your email address in a normalised form (lower case, without a “+” suffix, for Gmail addresses without dots), linked to your account and the time | Making sure that each person gets only one free test video, even with several accounts or variants of the same address | Art. 6(1)(f) GDPR (legitimate interest in preventing misuse of the free offer) | As long as your account exists, and 12 months after it has been deleted. If our content check rejects your free test video after the order was accepted, we delete the hash at once, so that you can try another script |
| Confirmations of cancellations: so that the cancellation form cannot be used to send emails to other people, we count the confirmations: for addresses without a boonvid account only the times (no addresses), and for short confirmations a keyed hash (HMAC) of the recipient’s address with the time. If more confirmations to addresses without an account are due within 24 hours than our limit allows, we send a short confirmation right away instead of the full one: contract, type of cancellation, receipt number, date and time of receipt and when the contract ends, but not the name or reason entered in the form | Confirming every cancellation without delay (Section 312k of the German Civil Code) without letting the form be misused | Art. 6(1)(c) and (f) GDPR (legal obligation to confirm; legitimate interest in preventing misuse) | 24 hours, then deleted automatically; our server checks at least once an hour |
| Alerts to our operator: when something needs a person — for example an order that is stuck, a cancellation that still has to be carried out at Whop, a locked sign-in, a blocked recording, a content check that is unsure, or a refund or chargeback — our server writes an alert and sends it to our operator through Telegram (see “Recipients”). An alert contains only what is described there: reference numbers and shortened hashes, the state of an order and, depending on the case, the details listed there; never your full email address, your name or your files | Noticing and fixing problems with the service and with your order in time; carrying out cancellations; being able to stop a video before delivery if the content check is unsure | Art. 6(1)(f) GDPR (legitimate interest in a service that works and in fixing problems in time) | In our operator’s Telegram chat, and as copies in an internal folder on our server: until our operator deletes them. The list of open alerts on our server: as long as the problem lasts, then at most 24 hours. In the server logs: 30 days |
| Backups: copies of our databases (every hour) and snapshots of our server’s data volume (every day). They contain the data described in this table as it was at that time, including the files of orders | Restoring the service and your data after a failure | Art. 6(1)(f) GDPR (legitimate interest in not losing data through a failure) | 14 days, then deleted automatically; stored encrypted at Amazon Web Services in Frankfurt. Data that we delete under the rules above can therefore remain in a backup for up to 14 days longer. If we restore a backup, the deletion rules above apply to the restored data again, and deletions you asked for are applied again from a deletion log that contains only a keyed hash (HMAC) of your email address and internal identifiers |
| Early-access sign-up (pre-launch page only): email address, language, time of sign-up, your personal launch code, a salted hash of your IP address (to prevent abuse) and a log of the emails we sent you. You receive an email with a confirmation link (double opt-in); only after your click is your sign-up confirmed and your personal launch code created. If you signed up before the confirmation link was introduced, we ask you once to confirm | Asking you to confirm your address and, once you have confirmed, sending you the launch email with your personal launch code | Art. 6(1)(a) GDPR (consent); after you unsubscribe, Art. 6(1)(f) GDPR (legitimate interest in not writing to you again) | Until you withdraw your consent, for example with the unsubscribe link. After that, your sign-up stays on file marked as unsubscribed, so that we do not write to you again. If you ask us by email, we delete it entirely. |
Settings and browser storage: your cookie choice (cookie bv_consent, and boonvid.consent in your browser’s local storage). Also in local storage: under boonvid.state your language, country, the country whose VAT is shown with the prices, appearance, the billing period and minute pack you chose, whether you want an email when a video is ready, the invitation code of a link you followed, which notifications and feedback prompts you have already seen, and the notifications shown in this browser; under bv.news the latest service notifications; under bv_idem, only while an order is being sent, a random key and a checksum of the chosen files; on the early-access page boonvid.pl.lang and boonvid.pl.theme. In session storage, boonvid.wx keeps the background scene of the home page. Your account data (email address, name, minutes, videos) is not stored in your browser: the page loads it from our server every time | Remembering your settings; not placing an order twice when a request is repeated | Art. 6(1)(f) GDPR (legitimate interest in a website that works and remembers your choices); strictly necessary under Section 25(2) of the German TDDDG | bv_consent: 180 days. bv_idem: until the order has been answered, otherwise removed the next time you open the studio after 24 hours. boonvid.wx: until you close the browser tab. Everything else until you delete it in your browser |
Google Analytics 4: cookies _ga and _ga_* (up to 2 years); IP addresses are shortened | Usage statistics | Art. 6(1)(a) GDPR (consent), only after you have accepted it in the cookie banner | Until you withdraw your consent, at most 2 years |
We do not create profiles, we do not sell data, and we do not use your uploads for advertising. Customer data is not used to train AI models.
Contact form
If you write to us with the contact form, we store your name, your email address, the subject if you give one, your message, the language of the page and the time we received it. We forward the message by email to our own mailbox, through our email service provider (see “Recipients”), with your email address as the reply address, so that we can answer you. We do not send an automatic email to the address you enter. We use these details only to answer your message and to deal with your request.
Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before entering into one; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries. To protect the form against abuse, our server counts requests per IP address and per email address, each within a time window of at most one hour. These counters are kept only in the server’s memory and are never written to disk; the server deletes expired counters as further requests come in, and at the latest when it restarts.
Retention: we delete the stored message automatically 12 months after we received it, and the copy in our mailbox within the same period, unless we need it for longer to perform a contract with you or to establish, exercise or defend legal claims.
Using the form is voluntary. Without a name, an email address and a message we cannot answer you; you can also write to hello@boonvid.com instead.
How your video is built
boonvid plans and edits your video with the help of AI: it selects and places the material and checks the result. It does not create synthetic people or AI voices. For this, the AI models (Claude) of Anthropic PBC in the USA receive the text of your script and still images of the footage and of the finished video, through the Anthropic API. The same models carry out the content check of your script (during the free check and again when your order is accepted) and the visual checks of the footage and of the finished video. Under Anthropic’s commercial terms, none of this is used to train models. Our servers and storage remain in Frankfurt. Footage, photos and music come from media libraries; they receive only search terms, never your files.
Automated checks
During the free check before ordering, and again before an order is accepted, the text of your script is checked automatically against the content rules in our Terms, by an AI model. If it breaks a rule, the order is not accepted and you see the reason. If the check is unsure, our operator is notified and can look at the order before the video is delivered. If you think the check was wrong, write to hello@boonvid.com: a person reviews the decision, and you can state your point of view.
Every video is checked automatically before delivery (licences, match between picture and text, with still images of the video). This is not an automated decision within the meaning of Art. 22 GDPR: the check has no legal effect on you. If a check fails, the video is rebuilt; if it cannot be delivered, the minutes are not charged.
Recipients
We pass personal data only to the following recipients, and only for the purposes above:
- Amazon Web Services EMEA SARL, Luxembourg — servers, storage and backups in Frankfurt (eu-central-1).
- Anthropic PBC, USA — the AI models (Claude) through the Anthropic API. Anthropic receives the text of your script (to plan the video and for the content check) and still images of the footage and of the finished video (for the visual checks). Under Anthropic’s commercial terms, Anthropic may not train models on this content. Anthropic stores it in the USA and, as a rule, deletes it within 30 days; content that Anthropic’s automated safety systems flag as a violation of its usage policy can be kept for up to 2 years. The models may also process the data in other countries.
- Cloudflare, Inc., USA — delivery of the website and of the pre-launch page (Cloudflare Pages and Functions). Requests from your browser to our servers (for example sign-in and orders) also run through Cloudflare. Your files (script and voiceover) and your finished videos do not: they are transferred directly between your browser and our storage at Amazon Web Services in Frankfurt. To show prices with the VAT of your country, the page asks Cloudflare which country your connection comes from; Cloudflare derives it from your IP address, and only the two-letter country code goes back to your browser, which keeps it in its local storage. We do not store it.
- Email delivery — an email service provider (SMTP) sends our emails, such as sign-in codes, and forwards messages from the contact form to our mailbox. The pre-launch page sends its emails through Resend, Inc., USA.
- Twilio Inc., USA — sends the text message “your video is ready”, only if you ask for one. Twilio receives your mobile number and the text of the message.
- Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates, and Telegram Messenger Inc.) — our operator receives alerts about problems with the service through a Telegram bot. An alert names orders, recordings and payments only by reference numbers (such as the first characters of an order number, or a payment reference) or shortened hashes. It can contain the state of an order; for a cancellation, the contract, the type and the dates; for the automated content check, its categories and a short note of up to 160 characters on why the check was unsure, which can refer to the content of your script; for a refund or chargeback, its type and state, the amount and currency, the payment reference, the minutes from that payment, the current minute balance of your account, your latest orders (up to 5, by reference number and state) and your email address in shortened form (first letter and domain). It never contains your full email address, your name or your files.
- Whop, Inc., New York, USA — payment processing. Whop sees your email address, the plan and your payment details; we never see card details. Whop’s own privacy policy applies to the payment.
- Google Ireland Ltd. — only for Google Analytics (with your consent) and the optional sign-in with Google.
- Media libraries (Pexels, Pixabay, Wikimedia Commons, Internet Archive, NASA, Smithsonian, Openverse), plus Wikidata for names of people in your script and Esri for map and satellite images of places in it — only search terms and place coordinates, never your files.
Transfers to the USA and other countries outside the EU
Firehorse Media LLC is a company in the USA. The service’s servers and storage are in Frankfurt. Some of the recipients above are based in the USA (Anthropic, Cloudflare, Resend, Twilio, Whop). Transfers to them are based on the EU–US Data Privacy Framework or on the providers’ standard contractual clauses; for Anthropic, on the standard contractual clauses in Anthropic’s data processing addendum. You can ask us by email for a copy of these safeguards. Telegram is based outside the EU, in the United Arab Emirates, for which there is no adequacy decision of the European Commission; it receives only the alerts described above, which name orders and people only by reference numbers, shortened hashes or a shortened email address.
Your rights
You have the following rights. To use them, write to hello@boonvid.com.
- Access (Art. 15 GDPR): you can ask whether we process data about you and receive a copy together with the information the law provides for.
- Rectification (Art. 16 GDPR): you can have incorrect data corrected and incomplete data completed.
- Erasure (Art. 17 GDPR): you can have your data deleted, unless we are required to keep it, for example booking records under commercial and tax law.
- Restriction of processing (Art. 18 GDPR): in certain cases, for example while the accuracy of data is disputed, you can have the processing restricted.
- Data portability (Art. 20 GDPR): you can receive the data you have provided to us and that we process on the basis of your consent or a contract in a structured, commonly used and machine-readable format, or have it sent directly to another controller where technically feasible.
- Objection (Art. 21 GDPR): see the next section.
- Withdrawal of consent (Art. 7(3) GDPR): you can withdraw a consent at any time with effect for the future. Processing up to the withdrawal remains lawful. How to change your cookie choice is explained in the Cookie Policy; you can withdraw your early-access consent with the unsubscribe link or by email.
- Complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place.
Your right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR: settings and browser storage, ratings, server logs, sign-in protection, request limits, the limits and blocked recordings of the free check, one free test video per person, the counting of cancellation confirmations, alerts to our operator, backups, proof of consents and cancellations, messages from the contact form that do not concern a contract, the unsubscribe note for early access), you can object to this processing at any time on grounds relating to your particular situation. We then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, write to hello@boonvid.com.
Do you have to provide your data?
You are not legally obliged to. However, an account and the data of an order are needed for the contract: without an email address and your confirmation that you are at least 18 we cannot set up an account, and without a script and a voiceover we cannot build a video. Everything else is voluntary: your name, signing in with Google, the “your video is ready” notice, invitations, ratings, applications to the Creator Program, messages through the contact form, the early-access sign-up and consent to Google Analytics.
Cookies
The session cookie __Host-vd_sitzung keeps you signed in, and short-lived security cookies protect the sign-in itself; the cookie bv_consent and your browser’s local and session storage remember your cookie choice and your settings, such as language and appearance. Your account data is not kept in your browser. These entries are strictly necessary. Google Analytics 4 runs only after you have accepted it in the cookie banner. Details are in our Cookie Policy.
Version: 27 September 2026