Privacy Policy

Last updated: October 2026

In case of discrepancies between the German and a translated version, the German version prevails.

§ 1 Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Alex Trupp NordvindAI (sole proprietorship) Vahrenwalder Str. 213 30165 Hannover Germany Phone: +49 176 43198566 Email: alex.trupp@nordvind-ai.de Website: https://community.nordvind-ai.de

No data protection officer has been appointed, as the statutory requirements are not met.

§ 2 Overview of processing

NordvindAI is an AI-powered studio: a digital avatar is created from a photo and a voice recording and is used to generate short vertical videos (“Reels”).

Types of data processed:

  • Email address (registration, login, order)
  • Password (stored encrypted; not applicable when signing in with Google)
  • Photo and voice recording for creating the avatar and voice clone
  • Your consent to the processing of photo/voice, including its timestamp
  • Topic/script inputs for video generation
  • Generated videos, scripts, subtitles
  • Contract and payment data (plan, payment status, Stripe customer ID; card data only at Stripe)
  • Usage data (number of videos created, quota)
  • when connecting social channels: access tokens and channel ID
  • if activated: your browser’s push subscription
  • Log data (IP address, browser type, access times — by infrastructure providers)

§ 3 Legal bases

  • Consent (Art. 6(1)(a), Art. 9(2)(a) GDPR; § 25(1) TDDDG): photo and voice for avatar/voice clone, analytics and marketing cookies, push notifications, connecting social channels
  • Performance of a contract (Art. 6(1)(b) GDPR): account, video generation, payment processing, cancellation
  • Legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, system operation
  • Legal obligation (Art. 6(1)(c) GDPR): retention obligations under commercial and tax law

§ 4 Security measures

  • TLS encryption of all connections
  • Encrypted storage of passwords
  • Row Level Security (RLS) in the database — access to your own data only
  • Time-limited, signed URLs for media access
  • Restricted access to infrastructure and API keys

§ 5 Registration and user account

An account can be created with email and password, via Google (OAuth; Google Ireland Limited) or as part of an order; in the latter case, the email address entered at checkout is used and access is provided via magic link.

We store: email address, encrypted password (if any), user ID, time of registration.

Legal basis: Art. 6(1)(b) GDPR. You can delete your account at any time in the account settings; afterwards, re-registration with the same email address is blocked for 30 days (abuse protection).

§ 6 Avatar and voice clone creation

For your AI avatar, you upload a photo and a short voice recording. Before uploading, you give your explicit consent by ticking the corresponding checkbox yourself; we store the time of consent.

Your photo is transmitted to HeyGen (HeyGen Technology Inc., USA) to create the photo avatar, and your voice recording to ElevenLabs (Eleven Labs Inc., USA) to create the voice clone. Google Gemini (Google Ireland Limited) may additionally be used for speech output; only the script text is transmitted in that case.

Photo and voice may be suitable for identifying you uniquely; processing is based exclusively on your consent (Art. 9(2)(a) GDPR). You can withdraw it at any time with effect for the future — by email or by deleting the avatar or account; we will then arrange deletion at the service providers as far as technically possible.

HeyGen: https://www.heygen.com/privacy-policy ElevenLabs: https://elevenlabs.io/privacy Google: https://policies.google.com/privacy

§ 7 Video generation and B-roll research

To create your videos, we process your topic and script inputs. Hooks, scripts and the quality check of visual material are produced by Anthropic (Anthropic Ireland, Limited; processing also by Anthropic, PBC, USA); AI-generated background footage is produced by xAI (SpaceXAI LLC, USA).

During automatic B-roll research, our servers search publicly available video material (e.g. on YouTube or X) using search terms derived from your topic and download suitable clips; no personal data of yours is transmitted to these platforms.

Finished videos are stored on Cloudflare R2 for as long as you keep them in your gallery; you can delete them at any time.

Legal basis: Art. 6(1)(b) GDPR.

Anthropic: https://www.anthropic.com/legal/privacy xAI: https://x.ai/legal/privacy-policy

§ 8 Payment processing

We process payments via Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland; Stripe, Inc., USA). We offer one-time purchases and monthly subscriptions.

We transmit to Stripe your email address, your user ID (if any), as well as the plan and your order consents (timestamp, version of the Terms). Payment data (e.g. card data) is processed exclusively by Stripe; we store the Stripe customer ID, subscription and payment status. Stripe.js is only loaded on the order and payment pages, where it sets cookies for fraud detection (§ 25(2) no. 2 TDDDG).

Legal basis: Art. 6(1)(b) and (c) GDPR (retention of accounting records: 8 or 10 years).

Stripe: https://stripe.com/privacy

§ 9 Cookies and similar technologies

Strictly necessary (§ 25(2) no. 2 TDDDG — no consent required):

  • Supabase authentication cookies (sb-*-auth-token): login and session
  • NEXT_LOCALE: selected interface language
  • nv_consent: your cookie choice including its timestamp, lifetime six months
  • Stripe (__stripe_mid, __stripe_sid): fraud detection, only on order and payment pages

Subject to consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR):

  • Analytics: Google Analytics via Google Tag Manager
  • Marketing: Google Ads via Google Tag Manager, including enhanced conversions (your email address is only transmitted to Google as a SHA-256 hash)

Google Tag Manager is only loaded after you have consented in the cookie banner. In addition, we use Google Consent Mode v2 with the default setting “denied”. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

You can change or withdraw your choice at any time via “Cookie settings” in the footer of every page; the withdrawal takes effect for the future.

§ 10 Hosting and infrastructure

The application runs on Cloudflare (Cloudflare, Inc., USA): Cloudflare Workers and Containers (execution and video rendering), Cloudflare R2 (media storage), CDN and DDoS protection. With every access, Cloudflare processes server log data (IP address, timestamp, requested URL, status code, referrer, browser/operating system).

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).

Cloudflare: https://www.cloudflare.com/privacypolicy/

§ 11 Database, email and notifications

Accounts, profiles, video metadata and authentication are managed by Supabase (Supabase Pte. Ltd., Singapore; database servers in the EU: AWS, Stockholm region). We send transactional emails (e.g. login links, order confirmations, notices about finished videos) via Resend (Resend, Inc., USA).

You only receive push notifications if you allow them in your browser. For this, we store your browser’s push subscription; delivery runs via the push service of your browser vendor (e.g. Google, Mozilla, Apple). You can revoke the permission at any time in the settings or in your browser.

Legal basis: Art. 6(1)(b) GDPR; for push notifications Art. 6(1)(a) GDPR, § 25(1) TDDDG.

Supabase: https://supabase.com/privacy Resend: https://resend.com/legal/privacy-policy

§ 12 Connecting social channels

If you wish, you can connect your Instagram account (Meta Platforms Ireland Limited) or your YouTube channel (Google Ireland Limited) to publish videos directly. In doing so, we store the access tokens issued by the provider and your channel ID, and transmit the video including its description to the respective provider only on your instruction. You can disconnect at any time under “Connections”.

Legal basis: Art. 6(1)(a) and (b) GDPR.

Meta: https://www.facebook.com/privacy/policy Google: https://policies.google.com/privacy

§ 13 Recipients and processors

We use the following service providers:

  • Cloudflare, Inc. (USA): hosting, rendering, CDN, media storage
  • Supabase Pte. Ltd. (Singapore; servers in the EU): database, authentication
  • Stripe Payments Europe, Ltd. / Stripe, Inc.: payment processing
  • HeyGen Technology Inc. (USA): photo avatar and avatar video
  • Eleven Labs Inc. (USA): voice clone and speech output
  • Google Ireland Limited: speech output (Gemini), Google sign-in, YouTube publishing; Tag Manager, Analytics and Ads only after consent
  • Anthropic Ireland, Limited / Anthropic, PBC (USA): AI text generation, image review
  • SpaceXAI LLC (xAI, USA): AI generation of background footage
  • Resend, Inc. (USA): sending emails
  • Meta Platforms Ireland Limited: only when you connect your Instagram account

Contracts pursuant to Art. 28 GDPR are in place with all processors (each part of the provider’s terms of service).

§ 14 Transfers to third countries

Several service providers are based outside the European Economic Area. The transfer mechanism per recipient is:

  • EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR), supplemented by Standard Contractual Clauses: Cloudflare, Stripe, HeyGen, ElevenLabs, Google, Resend, Meta, Microsoft
  • Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), part of the respective data processing agreements: Anthropic, SpaceXAI (xAI), Supabase (Singapore; the database itself is hosted in the EU)

Your photo and voice are sent only to HeyGen and ElevenLabs, both certified under the Data Privacy Framework. Data is encrypted in transit and at rest.

§ 15 Storage period

  • Photo, voice recording and proof of consent: until consent is withdrawn or the avatar or account is deleted
  • Generated videos: until you delete them or until the account is deleted
  • Account data: for the duration of use; deleted when the account is deleted
  • Invoice and accounting data: in accordance with retention periods under commercial and tax law (8 or 10 years)
  • Cancellation notices and confirmations: until the limitation period expires (3 years)
  • Server and application logs (Cloudflare): no more than 7 days

After account deletion, re-registration with the same email address is blocked for 30 days.

§ 16 Your rights

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR) — also via “Delete account” in the account settings
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to alex.trupp@nordvind-ai.de is sufficient.

§ 17 Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, https://www.lfd.niedersachsen.de

§ 18 Minors

Our service is not directed at persons under 18 years of age. We do not knowingly collect data from minors.

§ 19 AI labelling (EU AI Act)

Videos created with our service contain AI-generated content (avatar video, voice, and possibly AI-generated B-roll). In accordance with Art. 50 of the AI Regulation (EU) 2024/1689, we label them visibly in the video and in machine-readable form in the metadata of the video file.

§ 20 No automated decision-making

No automated decision-making, including profiling, with legal effect (Art. 22 GDPR) takes place.

§ 21 Changes

We adapt this privacy policy when the legal situation or the service changes. The current version is always available at https://community.nordvind-ai.de/privacy.