Data controller
The controller of personal data is Dominik Łupicki, conducting sole proprietorship business under the name „DOMINIK ŁUPICKI", ul. Nadwarciańska 74, 62-040 Puszczykowo, NIP 7831935719, REGON 542541590 (hereinafter: the „Controller"). In all matters concerning personal data, you may contact us at: kontakt@edimi.ai.
This Policy describes the principles of personal data processing in accordance with Regulation (EU) 2016/679 (GDPR). The Controller has not appointed a data protection officer - none of the cases in which that is mandatory applies.
What data we collect
- Account data: e-mail address, display name, password (in hashed form only).
- Billing data: invoicing details, payment history and the customer identifier at the payment operator (we neither receive nor store full card data).
- Content: uploaded tracks and video materials, generated edits, hook and caption texts, file metadata.
- Connected TikTok, Instagram or YouTube account data: account identifier, name and avatar, and the access token issued by the platform after authorization.
- Correspondence: the content of messages sent through the support form and of illegal-content notices.
- Technical data: IP address, device and browser type, server logs, and the session identifier stored in a cookie.
Purposes, legal bases and retention
The table below corresponds to the record of processing activities maintained by the Controller:
| Providing the services (Account, generating and publishing edits) | Necessity to perform the contract - Art. 6(1)(b) GDPR. Retention: for the duration of the contract and 30 days after the Account is deleted. |
| Billing, invoices and accounting | Legal obligation - Art. 6(1)(c) GDPR. Retention: 5 years from the end of the tax year. |
| Evidence of consents given at purchase (acceptance of documents, request for immediate performance) | Legal obligation and legitimate interest - Art. 6(1)(c) and (f) GDPR. Retention: 6 years after the contract ends (the limitation period for claims). |
| Handling complaints, content notices and correspondence | Legal obligation and legitimate interest - Art. 6(1)(c) and (f) GDPR. Retention: 3 years after the matter is closed. |
| Security of the Service, logs, abuse prevention | Legitimate interest - Art. 6(1)(f) GDPR. Retention: 12 months. |
| Marketing messages | Consent - Art. 6(1)(a) GDPR. Retention: until consent is withdrawn. |
Cookies
We use only the cookies necessary for the Service to work: the login session and CSRF protection. Your language choice is stored in your browser's local storage. We do not use cookies for analytics and we do not track you across sites. You can delete stored cookies at any time in your browser settings - doing so signs you out.
Processors
We entrust data only to providers necessary to operate the Service, under data processing agreements. Current list:
| Hetzner Online GmbH (Germany) | Application server and database. |
| Amazon Web Services EMEA SARL (eu-central-1 region, Germany) | Rendering edits. |
| Cloudflare, Inc. (USA / EEA) | Storing and delivering video files and traffic protection. |
| Stripe Payments Europe, Ltd. (Ireland) | Payment and invoice handling. |
| Sendinblue SAS / Brevo (France) | Sending transactional messages (confirmations, notifications). |
| ElevenLabs, Inc. (USA) | Transcribing the vocal layer for captions. |
| Anthropic PBC (USA) | Generating hook and caption suggestions at the User’s request. |
| TikTok Technology Limited (Ireland), Meta Platforms Ireland Limited (Ireland), Google Ireland Limited (Ireland) | Publishing a post on the User’s account - only after authorization and approval of the specific post. |
| ZERNIO SOFTWARE SL (Spain) | Publication intermediary: receiving the video file and passing it to the target service on the User’s instruction. |
Transfers outside the EEA
Some providers process data in the United States. The basis for transfer is the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) and, for providers participating in the Data Privacy Framework, an adequacy decision.
For transcription we send only the audio track of the song, and for hook generation only the text the User entered in the form. We do not send Account data or billing data there.
Retention and storage limits
Retention periods for each category of data are set out in the table in §3. After the Account is deleted, data is deleted or anonymized, except for data whose retention is required by law - in particular accounting records.
Material uploaded by the User and generated edits occupy the storage assigned to the Plan (25 GB on Starter, 100 GB on Pro, 500 GB on Max). Once the limit is exceeded the Service asks you to free up space and does not delete material automatically without notice.
Generated edits and source files are deleted within 30 days of the Account being deleted. Database backups are overwritten on a 30-day cycle.
Automated content checking
Before a post is published, the Service automatically checks its content against the acceptable use rules. The check may block sending the post; the User is then told the reason and can correct the text.
The check concerns the content of the post, not the person of the User, and is not automated decision-making producing legal effects within the meaning of Art. 22 GDPR. Decisions to suspend or close an Account are made by a human.
Your rights
You have the following rights under the GDPR:
- The right to access your data and obtain a copy of it.
- The right to rectification, erasure (the „right to be forgotten") and restriction of processing.
- The right to data portability and to object to processing based on legitimate interest.
- The right to withdraw consent at any time - without affecting the lawfulness of processing before withdrawal - and to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
Security, contact and changes
We apply technical and organizational measures appropriate to the risk: transmission encryption (TLS), database-level isolation of data between Accounts, access control and signed, expiring URLs for video files. Passwords are stored only in hashed form.
For privacy matters, write to kontakt@edimi.ai. We will inform you of significant changes to the Policy by electronic means before they take effect.