Privacy Policy

Last updated: July 2026 · Draft — pending legal review.

Who we are

PuffinVBT is operated from Austria (see Impressum). This policy explains how we process personal data under the GDPR.

Data we process

• Account data — name, email, and Google account identifier (OAuth).
• Training data — uploaded videos, exercise metadata, and derived VBT metrics.
• Usage data — logins, last-seen timestamps, and basic view analytics.
• Billing data — handled by Paddle; we store only subscription status and identifiers, not card details.

Why we process it

To provide the analysis service (contract), to operate and secure the platform (legitimate interest), and — only with your explicit opt-in — to use anonymised metrics for academic research (consent).

Processors

• Google Cloud (EU region) — hosting, storage, database.
• Paddle — payments and invoicing (Merchant of Record).
• Resend — transactional email.

Retention

Videos are retained while your account is active and may be moved to lower-cost archival storage over time. You can delete videos at any time. On account deletion we remove your personal data, except where retention is legally required.

Your rights

You may request access, rectification, erasure, portability, or object to processing by contacting contact@puffinvbt.com. You may also lodge a complaint with the Austrian Data Protection Authority.