Controller
FADED Filmproduktion e.U.
Hold my Frame
Weyringergasse 13
1040 Vienna
Austria
Vienna, Austria
[email protected]
What data we collect
Account data: When you sign up, we store your email address and display name. Passwords are hashed using bcrypt and never stored in plain text.
Payment data: If you subscribe to a paid plan, payment is processed by Stripe. We store your Stripe customer ID and subscription status in our database. We do not store credit card numbers, bank account details, or other payment credentials — Stripe handles this directly. Stripe may collect additional data as described in their privacy policy.
Usage data: We log page views, search queries, and feature usage to improve the product. This data is stored on our own infrastructure and not shared with third parties, except as described under Analytics below.
Uploaded media and generated metadata: If you upload film material, we store the source file, generated stills, thumbnails, search embeddings, visual metadata and processing logs as needed to operate the service, secure the upload pipeline and support moderation or deletion requests.
Location data: We derive your approximate geographic location from your IP address (GeoIP lookup) for security purposes, including login anomaly detection. We do not store your raw IP address beyond the server access logs, which are retained for up to 30 days.
Email communications: We use Resend as our email service provider to send account verification and notification emails. Resend processes your email address solely for delivery purposes.
Cookies
We use the following cookies:
fd_session— required for authentication, expires after up to 30 days or when you log out. (Technically necessary, no consent required.)fd_csrf— protects forms and API requests against cross-site request forgery, expires after up to 30 days. (Technically necessary.)fd_oauth_state— temporary OAuth login protection, expires after 10 minutes. (Technically necessary.)fd_admin_stepup— temporary admin confirmation cookie, expires after 10 minutes. (Technically necessary, admin users only.)simulate_tier— temporary admin preview setting, expires after 24 hours. (Technically necessary, admin users only.)hmf_preview— optional preview access cookie, expires after 30 days. (Technically necessary.)hmf_consent— stores your cookie preference (accepted/rejected), expires after 1 year. (Technically necessary.)
The following cookies are only set if you accept analytics cookies via our consent banner:
_ga— Google Analytics client ID, expires after 2 years._ga_*— Google Analytics session data, expires after 2 years.
Analytics
We use Google Analytics 4 (GA4) on our landing page to understand how visitors find and interact with our website. GA4 is only loaded after you give consent via our cookie banner. If you reject analytics cookies, no tracking scripts are loaded and no data is sent to Google.
You can withdraw your consent at any time by clearing the hmf_consent cookie in your browser settings and reloading the page.
When GA4 is active, data is processed by Google Ireland Limited. Google may transfer data to the United States under the EU-US Data Privacy Framework (adequacy decision of July 10, 2023). For details, see Google's privacy policy.
Legal basis
We process your data based on:
- Consent (Art. 6(1)(a) GDPR) — for analytics cookies (GA4). You can withdraw consent at any time.
- Contract performance (Art. 6(1)(b) GDPR) — to provide the service you signed up for, process payments, and send transactional emails.
- Legitimate interest (Art. 6(1)(f) GDPR) — to ensure security (login anomaly detection, rate limiting, GeoIP checks) and improve the product based on aggregated usage data.
Data processors
We use the following third-party service providers who process data on our behalf:
- Cloudflare, Inc. (US) — CDN, DDoS protection, DNS, WAF and R2 object storage for media. Data processed at edge locations worldwide. Privacy policy
- Stripe, Inc. (US) — Payment processing for subscriptions. Privacy policy
- Google Ireland Limited (IE/US) — Analytics (GA4), only with consent. Privacy policy
- Resend, Inc. (US) — Transactional email delivery. Privacy policy
- Modal Labs, Inc. (US) — GPU compute for image processing pipeline. Privacy policy
- OpenAI, L.L.C. (US) — AI-assisted visual analysis and metadata generation where relevant features are used. Privacy policy
- Functional Software, Inc. (Sentry) (US) — optional error monitoring and diagnostics when enabled. Privacy policy
Where US-based providers are used, data transfers are covered by the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
Business transfers
If Hold my Frame is involved in a merger, acquisition, restructuring, financing, sale of assets, transfer of the Service, or similar corporate transaction, personal data may be transferred as part of that transaction where permitted by law. Any successor will be required to respect this Privacy Policy or provide you with notice of any material changes.
Data retention
Account data is stored as long as your account is active. Login history is retained for up to 90 days for account security. Product usage and search logs are retained for up to 12 months to maintain and improve the service. Server access logs are retained for up to 30 days. Uploaded media and generated metadata are retained until deletion, hiding, quarantine, account-level deletion handling, or a rights/moderation decision requires a different retention period.
You can export your account data and request deletion directly in Settings. Account deletion removes your active account, sessions, OAuth links, login history, private tags, saved searches, pitch versions, owned projects and other private app interactions from the active databases. Shared library assets, billing records, fraud-prevention records and legal accounting records may be retained where required. Safety backups age out according to the backup retention schedule.
Children
The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe that a child has provided personal data to us, contact us at [email protected] and we will take appropriate steps to delete it where required.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15).
- Request correction of inaccurate data (Art. 16).
- Request deletion of your data (Art. 17).
- Restrict processing (Art. 18).
- Data portability (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3)).
To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before responding, especially for access, export or deletion requests. We will respond within 30 days unless a longer period is permitted by law.
If you use the Service through an agency, studio, company or other organization, that organization may also control some account, project or billing information and may be responsible for responding to requests about data it controls.
You also have the right to lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at
Changes to this policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. For significant changes, we will notify registered users by email.
Contact
For any privacy-related questions, reach us at [email protected].