Privacy Policy

1. Who is responsible for your data

For the purposes of the EU General Data Protection Regulation ("GDPR"), the data controller is the Developer operating Collabricate, based in Spain, reachable at contact@collabricate.com.

2. What data we collect

Account information. When you sign up, we collect your name, email address, and profile photo, either from Google OAuth or from the email address you verify by one-time code.

Content you upload. Video files and other assets you upload to Collabricate, their filenames, and any metadata generated during processing (duration, file size, thumbnails, proxy versions).

Comments and review activity. Comments, timestamps, and approvals left on your projects, both by you and by reviewers you invite. For anonymous reviewers (people who don't have a Collabricate account), we collect the name and email address they provide when leaving a comment or approval through a review link.

Billing information. Subscription plan, billing status, and transaction history. Payment card details are collected and processed directly by Stripe, our payment processor, we do not receive or store your full card number.

Usage and log data. IP address, browser/device type, pages visited, and actions taken in the app, collected automatically for security, debugging, and product improvement.

Communications. If you email us for support, we keep a record of that correspondence.

3. Why we process your data (legal basis)

• Performance of a contract, creating your account, storing and delivering your projects, processing payments, sending transactional emails (verification codes, comment notifications, delivery confirmations).
• Legitimate interests, securing the Service, preventing abuse, understanding usage to improve the product.
• Consent, where required, e.g. for optional communications you opt into.
• Legal obligation, retaining billing records as required by tax law.

4. Who we share data with

We don't sell your personal data. We share data only with the service providers needed to run Collabricate:

These providers process data on our behalf under their own data processing agreements and are contractually restricted from using your data for their own purposes.

Reviewers you invite. If you share a review or delivery link, the people you share it with can see the associated video, comments, and (if they choose to leave feedback) will have their name/email stored against that comment.

5. International data transfers

Some of our service providers (e.g. Google Cloud Storage, Stripe) may process or store data outside the European Economic Area, including in the United States. Where this happens, we rely on providers that offer appropriate safeguards, such as Standard Contractual Clauses, to protect your data during international transfer.

6. How long we keep your data

We retain your account data and uploaded content for as long as your account is active. If you delete your account, we delete your personal data and uploaded content within a reasonable period afterward, except where we're required to retain certain records (e.g. billing history) for legal or tax purposes.

Old delivery links and version history are retained as an audit trail while your account remains active, so you can see what was delivered to a client and when.

7. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access, request a copy of the personal data we hold about you.
• Rectification, correct inaccurate or incomplete data.
• Erasure, request deletion of your data, subject to legal retention requirements.
• Restriction, ask us to limit how we use your data.
• Portability, receive your data in a portable format.
• Objection, object to processing based on legitimate interests.
• Withdraw consent, where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email contact@collabricate.com. If you're in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority, in Spain, this is the Agencia Española de Protección de Datos (AEPD).

California residents (CCPA/CPRA). You have the right to know what personal information we collect, request deletion of it, and opt out of the "sale" or "sharing" of personal information. We do not sell personal information. To exercise these rights, email contact@collabricate.com.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), signed-URL uploads directly to cloud storage (so files never pass through our servers unprotected), and access controls on internal systems. No system is completely secure, and we can't guarantee absolute security.

9. Cookies and local storage

Collabricate uses browser local storage to keep you signed in (storing your authentication token) and may use essential cookies required for the Service to function. We do not use third-party advertising cookies or trackers.

10. Children's privacy

Collabricate is not directed to individuals under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the Service. Continued use of Collabricate after changes take effect constitutes acceptance of the updated policy.

12. Contact

Questions about this Privacy Policy or your data can be sent to: