Privacy

In short

• No advertising, no advertising trackers, no third-party analytics, no sale of data.
• Data and files are hosted in the European Union.
• Your films and feedback are never used to train an artificial intelligence model.
• A client who reviews a film has no account, never pays and never receives any commercial solicitation from Noterz.
• Films are deleted automatically after delivery, and any deleted project is erased completely after 7 days.

Who is responsible

Noterz is published by Teddy Verneuil, a French sole trader, 14 bis rue Magellan, 56860 Séné, France, SIRET 792 687 576 00043. Contact for any question about your data: contact@noterz.app.

For video makers' accounts, their billing and the security of the service, Noterz is the controller.

For clients' feedback, the video maker who sends the link decides how it is used: they are the controller, and Noterz processes it on their behalf, as a processor, under the data processing agreement in the terms.

You are reviewing a film

• Noterz keeps the first name you enter, your email address if you give it (to hear about replies), your feedback (text, type, importance, moment in the film), your drawings with the frame capture, your voice notes and your answers to questions.
• If you sign the delivery sign-off, Noterz also keeps your last name, the date, your IP address and your browser, as proof of the signature.
• One cookie recognises your device so you find your feedback again, and a second one keeps the link password if there is one. If the network drops, your feedback waits on your device until it can be sent.
• Your feedback is seen by the video maker and the people working with them on this project, and by the other reviewers of the same link, with your first name; they can say whether they agree. Your email address is never shown to them.
• Once the review is closed, your feedback (without your email address) is grouped into an edit plan by an artificial intelligence model, which does not see the video; the video maker reviews every task, and your original text stays visible.
• Noterz also counts a few gestures (link opened, first pause, form opened), without your first name or the content of your feedback, to learn whether the service is easy to use.
• You only receive emails about the review, and can unsubscribe from each of them.
• While the review is open, you edit or delete your feedback yourself. For anything else (copy, correction, deletion), write to the video maker or to contact@noterz.app.

You use Noterz for your films

• Noterz keeps your email address, your first name, your business name, logo and colour, your language, your projects, your films, your clients and their usual addresses, your clients' feedback and your email preferences.
• If you sign in with Google, Google sends Noterz your email address and your name.
• For a subscription, Link, Stripe's payment solution, collects your payment method, your billing address and your email; Noterz only keeps the plan, its dates and your Stripe customer ID, never your card number.
• A log keeps the important actions in the workspace (sending a link, closing a round, a signature, a deletion) and sign-ins, for security.
• Server errors are recorded so they can be fixed, without headers, cookies or feedback content.
• Noterz writes to you about the service (sign-in, the notifications you choose, how long your films are kept, changes to the terms), never for advertising.

Why, and on what basis

Providing the service: accounts, projects, links, feedback, edit plan, exports, service emails

Performance of the contract with the video maker (GDPR, article 6.1.b); for reviewers, on the video maker's instructions

Billing subscriptions and keeping accounts

Legal obligation (article 6.1.c)

Security, abuse prevention, proof of signature, fixing errors

Legitimate interest of Noterz and the video maker in a safe service (article 6.1.f)

Measuring usage, without feedback content

Legitimate interest in improving the service (article 6.1.f)

No decision with legal effect is made by automated processing: artificial intelligence suggests tasks, which the video maker reviews.

With whom

Cloudflare, Inc. (United States)

Application, files (frame captures, voice notes, original films) and video processing in the European Union; video delivery through Cloudflare Stream, on its global network; printing the edit plan as a PDF

Supabase, Inc. (United States)

Database and sign-in, hosted in the European Union (Paris)

Resend, Inc. (United States)

Email delivery, from the European Union (Ireland)

Stripe Payments Europe, Ltd (Ireland) and Sold through Link, LLC (United States)

Subscription payments: Link, a Stripe company, is the merchant of record; it calculates and remits VAT, issues receipts and invoices and answers questions about payments. Stripe and Link are also controllers of their own processing, including fraud prevention and their tax obligations

Functional Software, Inc., Sentry (United States)

Server error tracking, data hosted in the European Union (Germany)

OpenRouter, Inc. (United States) and Google Cloud (Vertex AI)

Edit plan: Anthropic's Claude model, served by Google Cloud in the European Union, called through OpenRouter, with any collection for training refused

Several of these providers are American companies. When data is transferred or accessed outside the European Union, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework for companies that have joined it, and otherwise on the European Commission's standard contractual clauses.

No data is sold, rented or passed on to advertisers.

For how long

• Films: the approved version and its download link 90 days after sign-off, earlier versions after 30 days, and any version of a project with no activity for 180 days. The video maker is notified 7 days before and can extend.
• Feedback, the edit plan, signatures and history: as long as the project exists in the video maker's workspace. A deleted project or workspace stays in the trash for 7 days, then it is erased completely (database, files, videos), including the video maker's account when they delete their workspace; backups disappear when they expire.
• Video maker's account: as long as their workspace exists.
• Billing data: 10 years, as required for accounting records (French Commercial Code, article L123-22).
• Server errors: 90 days at most. Sign-in codes: a few minutes.
• The video maker can export all of a reviewer's data in one file, to hand it over to them.

Cookies

Noterz only uses cookies that are strictly necessary for the service. They require no consent (French Data Protection Act, article 82) and are never used for analytics or advertising.

sb-…-auth-token

Keeps the video maker signed in to their workspace, for the session

pending_email, auth_next

Completes a sign-in in progress, 15 minutes at most

lang

Remembers the chosen language, 1 year

nz_device

Recognises a reviewer's device to find their feedback again, 400 days

nz_pass_…

Keeps the password of a protected link, 30 days

Your rights

• You can ask to access, correct, delete, restrict or port your data, and object to its processing, by writing to contact@noterz.app. Answer within one month.
• If you are reviewing a film, preferably contact the video maker, who is responsible for your feedback; Noterz forwards them any request it receives directly.
• You can also set instructions for what happens to your data after your death.
• If you are in France, you can complain to the CNIL (cnil.fr); elsewhere, to your data protection authority.

Security

Connections are encrypted (HTTPS). Each workspace is isolated by access rules in the database, link tokens are only stored there as hashes, media links are signed and expire in under an hour, and limits slow down abuse. If a data breach put you at risk, you would be informed within the time limits set by the GDPR.

Changes

This page evolves with the service. The date at the top of the page is authoritative, and any significant change is announced to video makers by email.