Privacy Policy

1. Controller

The controller for data processing on this website is:

Aron Kretschmer Weizenacker 12 48683 Ahaus Email: aronkretschmer01@gmail.com

You can find full details in the Legal Notice.

2. What data we process

• Account and login data (email address, password hash) via our authentication provider.
• Usage data: videos you upload or link, the clips created from them, and your schedules.
• Payment data for paid plans — processed by Stripe. We do not store full card details.
• YouTube/Google account data when you connect your YouTube account (see section 4).
• Technical data (server logs, IP address) via our hosting provider.

3. Hosting and processors

We use carefully selected service providers as well as our own infrastructure. Where providers process personal data on our behalf, corresponding data-processing agreements are in place:

• Vercel Inc. (USA) — hosting and delivery of the website.
• Supabase — authentication and database.
• Stripe — payment processing.
• Google (Gemini API, USA) — to analyze the transcript generated from your video in order to identify suitable clip moments.
• Our own processing and rendering server (Germany) — cuts and renders the clips; the finished clips are delivered from there over an encrypted connection (Tailscale Funnel).
• ntfy.sh — purely technical operational notifications (job status only, no personal content).

Where data is transferred to the USA (in particular Vercel, Stripe and Google / Gemini), this is done on the basis of appropriate safeguards (EU Standard Contractual Clauses).

4. YouTube API Services / Google

LucFlow uses the YouTube API Services to upload videos to your own channels and to display statistics for your own channels, at your express request.

By connecting your YouTube account, you agree to the YouTube Terms of Service. The processing of your data by Google is governed by the Google Privacy Policy.

Through Google OAuth sign-in we obtain access to the following data of your account — in each case only to the extent requested:

• Channel information (channel name, channel ID, profile picture) — to select and display your connected channels.
• Uploading videos on your behalf (scope youtube.upload) — only the clips you select, with the titles, descriptions and visibility you set.
• Reading your channel and video statistics (scopes youtube.readonly, yt-analytics.readonly) — to display your analytics data in LucFlow.

Storage: We store the OAuth access and refresh tokens as well as the channel metadata mentioned in order to maintain the connection. We do not share this data with third parties and do not sell it; it is used exclusively to provide the features you requested.

Revoking access: You can end the connection at any time — in LucFlow under Account → Disconnect YouTube— and/or revoke LucFlow's access directly in your Google account via the Google security settings (third-party access). After disconnecting, we delete the stored tokens.

5. Cookies and local storage

LucFlow uses only technically necessary mechanisms: a login session, a local setting for the color theme (lucflow-theme) and a language setting (lucflow-locale). We do not use any tracking or advertising cookies.

Cookieless reach measurement:To see how many people visit LucFlow, we count page views ourselves — without cookies, without advertising tracking, without sharing with third parties. For this, an anonymous identifier is calculated from the IP address, browser identifier and a daily-rotating server key; we do not store the IP address itself. Because the identifier changes daily, recognition across several days or even across websites is ruled out. Only the page visited, date/time, the device class (mobile/desktop) and, where applicable, the domain of the referring website are stored. The legal basis is our legitimate interest in data-minimizing reach measurement (Art. 6(1)(f) GDPR).

6. Legal bases

Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR, e.g. the YouTube connection) and our legitimate interests (Art. 6(1)(f) GDPR, e.g. operational security and the cookieless reach measurement described in section 5).

7. Advertising to existing customers (§ 7 (3) UWG)

If you take out a paid plan with us, we use the email address provided to occasionally inform you about our own similar LucFlow offers (§ 7(3) UWG). The legal basis is our legitimate interest in direct marketing to existing customers (Art. 6(1)(f) GDPR). We point out this use and your right to object already at the time of purchase.

You can object to this use at any time without incurring any costs other than the transmission costs according to the basic rates — e.g. via the unsubscribe link in every such email or informally by message to the contact address given below.

8. Retention period

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. We delete account and connection data after you delete your account or after revocation.

Finished clips are stored for 7 to 30 days depending on your plan and then automatically deleted by our rendering server. The expiry date is shown to you in the project.

9. Your rights

You have the rights to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

10. Contact

For questions about data protection, you can reach us at aronkretschmer01@gmail.com.