Privacy Policy

Last updated: August 2026 ·

Who we are

PuffinVBT is operated from Austria (see Impressum). This policy explains how we process personal data under the GDPR.

Data we process
Why we process it

To provide the analysis service (contract), to operate and secure the platform (legitimate interest), and - only with your explicit opt-in - to use anonymised metrics for academic research (consent).

Processors

Google Cloud, Paddle, and Resend process data on infrastructure located in the EU/EEA; we do not transfer personal data outside the EEA through those processors. Google Analytics 4 is a global Google product and may process data outside the EEA; this is safeguarded under the Google Ads Data Processing Terms and EU Standard Contractual Clauses, and Google truncates/drops IP addresses for EU, UK, and Swiss visitors before logging.

Retention

Videos are retained for as long as your account has an active paid plan (or is on the free tier, capped at 15 lifetime analyses). You can delete a video at any time yourself (Trash, then permanent delete), which also removes the underlying file from storage.

If a paid subscription is cancelled, the raw video files on the account are removed 60 days after cancellation. We email a reminder at day 30 and a final warning at day 55 before this happens. Your computed results are not affected either way - velocity, ROM, per-rep KPIs, personal records, and trend history remain fully intact, whether or not the underlying video is still there. Resubscribing before the 60 days are up keeps everything, including the video files; resubscribing after does not restore already-removed files. Grandfathered ("OG Puffineer") accounts are exempt from this policy.

To delete your whole account and all associated personal data, email contact@puffinvbt.com from your registered address. We don't offer a self-service "delete account" button by design - deletion is verified and carried out by us on request, so that no automated flow can ever remove another user's data by mistake. We complete verified erasure requests within 30 days. Billing records may be kept longer where required by Austrian accounting/tax law, with the personal-data link to your account removed.

Our database runs automated daily backups, retained for 7 days, on infrastructure located in the EU. Deleted data may continue to exist in these backups for up to 7 days after deletion before being permanently purged as older backups roll off.

Free accounts are not automatically deleted for inactivity today. We reserve the right to delete a free account and its data after an extended period (24 months or more) with no login, with an email warning first; this has not yet been enforced in practice.

Children

The Service is not directed at, and may not be used by, anyone under 16 years old (see our Terms of Service). We do not knowingly collect personal data from children under 16; if you believe a child has provided us data, contact us and we will erase it.

Your rights

You may request access, rectification, erasure, portability, restriction of processing, or object to processing by contacting contact@puffinvbt.com. Where processing is based on your consent (Google Analytics, academic research use), you may withdraw that consent at any time by contacting us the same way; this won't affect processing carried out before the withdrawal. You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

Governing law

This policy and our processing of your data are governed by the GDPR and Austrian law. If you are a consumer habitually resident in another EU/EEA member state, this does not deprive you of the protection afforded by mandatory provisions of that state's law.