Platform privacy policy

This policy covers accounts opened on the Videas platform, app.videas.com: account holders, members of an organization, billing contacts and people invited to collaborate (recipients of a share, subtitle reviewers).

It does not cover:

• the videos, files and content our customers upload, nor the data of the viewers and members of their channels. For that data, Videas acts as its customers’ processor, under the terms of the Data Processing Agreement;
• the videas.com website, which has its own Privacy Policy;
• white-label platforms operated by our customers: each one has the privacy policy of the customer who operates it.

Who is responsible for your data?

VIDEAS SAS, a simplified joint-stock company (SAS) with a share capital of €1,000, whose registered office is at 4702, chemin de l’Aventure, 59236 Frelinghien, France, registered with the Lille Trade and Companies Register under number 834 356 677.

Videas has appointed Dipeeo SAS as its data protection officer (DPO):

• by email: dpo@videas.com;
• by post: Dipeeo SAS, 95 avenue du Président Wilson, 93100 Montreuil, France;
• by phone: +33 1 59 06 81 85.

What data do we collect?

• Your account: email address, name, language, password (stored in an unreadable form that nobody can recover) and, if you turn it on, your second authentication factor.
• Your Google sign-in, if you choose this option: the identifier and email address of your Google account, and your name.
• Your sign-ins: open sessions (device and browser), sign-in attempts with the IP address and browser used, to protect your account.
• Your organization: its name, its members, their roles and the invitations sent or received.
• Your collaborations: when a member invites you to view a share or review subtitles, your email address and, where applicable, your name.
• Your billing: billing name and address, top-up and usage history, invoices, and your consent to automatic top-up if you turn it on. Your card details are entered directly with our payment provider Stripe; Videas has no access to them.
• The welcome credit: to grant the free credit only once per person, a fingerprint of the e-mail address of whoever founds an organization. It is computed with a secret key and cannot be reversed: it does not reveal the address.
• Your use of the API: for each call made with an API key, the date, the IP address and the operation called.
• Your exchanges with us: the messages you send us by email or from the platform (support, contact, requests about your rights).
• The emails we send you: their content and the record of their sending.

We do not collect so-called sensitive data. Please do not include any in your messages.

Why do we use your data?

Purpose	Legal basis
Creating and managing your account and your organization, giving you access to the service	Performance of the contract (Terms of Service and Terms of Sale)
Letting you collaborate (invitations, shares, reviews)	Performance of the contract
Invoicing the service, managing your top-ups and invoices	Performance of the contract; legal obligation for keeping invoices
Topping up your balance automatically, if you turned it on	Performance of the contract, based on your explicit consent
Securing accounts and the service (sign-ins, second factor, abuse detection)	Legitimate interest
Granting the welcome credit only once per person	Legitimate interest (preventing abuse of the free offer)
Sending you the emails the service needs (verification, balance alerts, exports ready…)	Performance of the contract
Answering your requests and the exercise of your rights	Legitimate interest; legal obligation for rights
Telling you about Videas news and offers, with an unsubscribe link in every email	Legitimate interest (you are a customer)

How long do we keep your data?

Data	Retention
Account and organization	While the account is active, then deleted no later than 3 years after it is closed
Sessions	30 days without activity, 90 days at most
Sign-in attempts	6 months
API usage logs	90 days
Invitations and shares	No later than 3 years after they end
Invoices and accounting records	10 years (accounting obligation)
E-mail fingerprint for the welcome credit	Kept after the account and the organization are deleted, solely so the welcome credit is not granted a second time
Content of emails sent	90 days, after which only the record of the sending is kept, for 2 years
Support and contact messages	No later than 3 years after the last exchange
News and offers emails	Until you unsubscribe, and no later than 3 years after your contract ends

Who has access to your data?

• Authorized Videas teams, each for its own area (support, billing, technical).
• The administrators of your organization, for the members and the use of the organization.
• Our processors, strictly to run the service:
  • OVH: off-site backups, in Roubaix (France);
  • Cloudflare: domain name resolution and network protection;
  • Mailjet: sending emails;
  • Stripe: payments;
  • Google: sign-in with your Google account, if you choose this option.

Your data is never sold.

Does your data leave the European Union?

Your data is hosted in France. Some providers may process data outside the European Union:

• Cloudflare, which sees your IP address in particular;
• Stripe, for payments;
• Google, if you sign in with your Google account.

These transfers are covered by the EU–US Data Privacy Framework, to which Cloudflare, Stripe and Google have adhered.

What cookies do we use?

The platform uses no advertising cookies and no audience measurement tool. It only sets cookies needed to sign in:

Cookie	Purpose	Duration
videas_session	Keeping your session open	30 days without activity, 90 days at most
videas_mfa_challenge	Completing a sign-in with a second factor	5 minutes
videas_mfa_enrolment	Completing the setup of a second factor	15 minutes
videas_reauthentication	Confirming your identity before a sensitive action	5 minutes
videas_sso_binding	Securing sign-in with Google	10 minutes

These cookies are strictly necessary: they do not require your consent.

What are your rights?

You may at any time ask to access your data, correct it, erase it, receive it, restrict its use or object to it. You may also set out what happens to your data after your death.

To exercise these rights, write to our DPO: dpo@videas.com. These requests are made this way only: the platform does not offer an export of your data. If you ask to receive your data, we send it to you in a readable, commonly used format. We answer within one month.

You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

How is your data protected?

• Exchanges between your browser and the platform are encrypted (TLS 1.2 minimum).
• Passwords are stored in an unreadable form that nobody can recover.
• You can turn on a second authentication factor; your identity is confirmed again before sensitive actions.
• Sign-in cookies cannot be read by the page’s scripts and only travel over secure connections.
• Our database backups are encrypted (AES-256).
• Access to our servers is restricted to the Videas technical team.