Privacy Policy

Last updated: July 2026 · Draft — pending legal review.

Who we are

PuffinVBT is operated from Austria (see Impressum). This policy explains how we process personal data under the GDPR.

Data we process

• Account data — name, email, and Google account identifier (OAuth).
• Training data — uploaded videos, exercise metadata, and derived VBT metrics.
• Usage data — logins, last-seen timestamps, and basic view analytics.
• Billing data — handled by Paddle; we store only subscription status and identifiers, not card details.

Why we process it

To provide the analysis service (contract), to operate and secure the platform (legitimate interest), and — only with your explicit opt-in — to use anonymised metrics for academic research (consent).

Processors

• Google Cloud (EU region, europe-west1) — hosting, storage, database.
• Paddle — payments and invoicing (Merchant of Record).
• Resend — transactional email.

All of the above process data on infrastructure located in the EU/EEA. We do not transfer personal data outside the EEA.

Retention

Videos are retained while your account is active and may be moved to lower-cost archival storage over time. You can delete a video at any time yourself (Trash, then permanent delete), which also removes the underlying file from storage.

To delete your whole account and all associated personal data, email contact@puffinvbt.com from your registered address. We don't offer a self-service "delete account" button by design — deletion is verified and carried out by us on request, so that no automated flow can ever remove another user's data by mistake. We complete verified erasure requests within 30 days. Billing records may be kept longer where required by Austrian accounting/tax law, with the personal-data link to your account removed.

Your rights

You may request access, rectification, erasure, portability, or object to processing by contacting contact@puffinvbt.com. You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

Governing law

This policy and our processing of your data are governed by the GDPR and Austrian law. If you are a consumer habitually resident in another EU/EEA member state, this does not deprive you of the protection afforded by mandatory provisions of that state's law.