FrameSense

Privacy Notice

How FrameSense handles account data, uploaded media, analysis results, billing records, and operational communications.

Version
2026-10-17.2312510f432b
Effective
17 October 2026
Release ID
Not approved

1. Who is responsible for your data

The operator identified below controls account, authentication, security, billing, support, and service-administration data. For personal data contained in media, scripts, or supporting materials that a customer uploads on its own instructions, that individual customer—or an organisation separately approved and identified under the DPA—is normally the controller, and the operator acts as its processor. Users may not upload organisation-controlled personal data without that prior approval. The release gate keeps public registration closed and marks this page as a draft until the operator identity and required legal, transfer, retention, backup, DPA, and terms reviews have all been recorded.

Operator
Martin Simon
Registration identifier
I?O 11979500
Registered address
Kbelnice 42, 336 01 Letiny, Czech Republic

2. Data FrameSense processes

  • Account and authentication data, including your name, email address, session, and security records.
  • Uploaded video, audio, optional scripts and supporting materials, pasted text, file metadata, analysis settings, generated previews, findings, transcripts, timestamps, evidence summaries, optional Review insights, and your decisions about those findings. Supporting materials can include PDF, DOCX, TXT, MD, CSV, XLSX and EML files, and PNG, JPEG or WebP images such as moodboards or storyboards.
  • Project names, links between video versions, shot timings, visual and audio comparison features, and text recognised locally from selected video shots for version comparison.
  • Technical and security data, including request identifiers, timestamps, service logs, device or browser information, and network identifiers needed to operate and protect the service.
  • Billing data, including Stripe customer and subscription identifiers, invoice and payment status, plan state, and the FrameSense credit ledger. FrameSense does not store full payment-card details.
  • Email delivery metadata and the content of account, security, and operational messages.

3. Why the data is used

Data is used to create and secure accounts, provide the requested analysis, display and retain results, prevent abuse, diagnose failures, communicate about the service, administer subscriptions and credits, and meet legal or accounting obligations.

For data the operator controls, the applicable bases are performance of the service agreement; legitimate interests in securing, supporting, and reliably operating the service; compliance with billing, accounting, and other legal duties; and consent only where FrameSense asks for it separately. When FrameSense processes personal data in customer content, the customer determines its lawful basis and documented instructions and FrameSense acts as processor under the DPA.

4. Service providers and international processing

FrameSense shares data only as needed with the providers below under applicable service and data-protection terms. Processing is kept in the EEA where the configured service permits it. A transfer outside the EEA must rely on an applicable adequacy decision or approved contractual safeguards, such as the European Commission standard contractual clauses, together with supplementary safeguards where the transfer assessment requires them.

Vercel

Hosts and delivers the web application and runs its server-side web functions.

The beta web runtime may process requests outside the European Economic Area.

Neon

Provides the PostgreSQL database for accounts, analysis and source state, findings, quoted evidence, project and version-comparison metadata, recognised shot text, credits, and billing state.

The private-beta database is configured in the EU Central (Frankfurt) region.

Amazon Web Services

Provides private object storage, work queues, analysis workers, and operational security logs.

FrameSense private-beta workloads use AWS eu-central-1 (Frankfurt).

OpenAI

Receives extracted audio for transcription, optional bounded script/transcript comparison windows, and up to six reduced-size sampled video frames, bounded transcript excerpts, completed-check evidence and selected findings for visual/content advice, suggested chapters and alternative wording when a user requests enabled Sense Review. Optional supporting documents, images and pasted text add bounded extracted text, source names and locations, and up to 20 reduced-size images or rendered document pages to the same insights request. The original video is not sent to OpenAI as a file, and complete attachment files are not uploaded; selected image or page samples can still contain personal or confidential information. Comparison and insights requests set application-state storage to false; provider abuse-monitoring logs may ordinarily be retained for up to 30 days, or longer for legal or safety needs, unless approved provider retention controls apply. Sense Fast does not call OpenAI.

OpenAI may process data outside the European Economic Area under the operator's applicable provider terms and transfer safeguards.

Stripe

Processes checkout and subscription events. FrameSense stores billing identifiers, subscription state, invoices, and credit-ledger records, but not full card details.

Stripe may process payment and fraud-prevention data in the regions described in its privacy documentation.

Resend

Delivers account verification, password reset, and operational email. Email content and delivery metadata are shared only as needed to send those messages.

Email delivery data may be processed outside the European Economic Area under the operator's applicable provider terms and transfer safeguards.

Seznam.cz, a.s.

Hosts the monitored privacy mailbox and therefore receives rights-request email, the requester's reply address, and related delivery metadata.

Czech Republic / European Economic Area

5. Cookies

FrameSense uses only essential authentication and security cookies. It does not currently set analytics or marketing cookies, so no optional-cookie consent banner is shown.

Essential cookies keep users signed in and protect account flows. If analytics, advertising, or other optional cookies are introduced later, this notice and the consent mechanism must be updated before they are enabled.

6. Retention and deletion

Uploaded media uses the retention choice shown in FrameSense: 24 hours, 7 days, or 30 days after an analysis first reaches a terminal state. Playback stops at the stored deadline; physical deletion may complete asynchronously. Original attachments, their extracted text and normalized content, playback previews and stored shot-preview JPEGs follow that media deadline. Analysis findings, quoted evidence, project and version-comparison metadata, locally recognised shot text, and necessary audit, security, billing, and accounting records can remain after media deletion.

For Sense Review, FrameSense sends extracted audio to OpenAI's transcription endpoint and sends bounded script/transcript comparison input only when an optional script is supplied. When Review insights are enabled, up to six reduced-size video-frame samples, selected transcript excerpts, check evidence, and findings are sent for visual/content advice, suggested chapters and alternative wording. Optional supporting materials add bounded extracted text, source names and locations, and up to 20 reduced-size images or rendered document pages to that insights request. The original video and complete attachment files are not uploaded to OpenAI as files. A selected image or page is sent as a reduced-size image and may still contain personal or confidential information. Sampling and extraction limits mean some pages, spreadsheet rows, email attachments, or embedded content may not be reviewed; the result reports available coverage and limitations.

Document extraction and optional text recognition from video shots run in FrameSense workers. The document-preparation worker does not call OpenAI. The reduced-size video and reference samples sent for AI review are transient processing data, distinct from the stored shot-preview JPEGs used for version comparison. These comparison and insights requests set application-state storage to false. OpenAI documents no application-state retention for audio transcription, while abuse-monitoring logs for comparison requests may ordinarily be retained for up to 30 days, or longer where required by law or safety needs, unless the FrameSense project has approved Zero Data Retention or Modified Abuse Monitoring. This provider-side period can therefore outlast a 24-hour or 7-day FrameSense media selection.

Account, result, security, billing, and accounting data may remain after media expires. Rights requests, including account deletion, should be sent to the legal contact listed above. There is currently no self-service account-deletion portal. Requests are handled through the monitored mailbox after identity verification; records that must be kept for legal, security, dispute, or accounting purposes may be retained. The operator must approve the retention schedule, provider backup settings, and handling of remaining operational records before public registration is opened. This draft does not promise a daily account-data purge or a fixed deletion time that the service has not implemented.

7. Your choices and rights

Subject to applicable law, you may ask for access, correction, deletion, restriction, portability, or an objection to processing. You may also complain to the competent data-protection authority.

Send a request to framesense@seznam.cz. FrameSense may need to verify your identity before acting on a request.

If your data appears in content uploaded by a FrameSense customer, that customer is normally responsible for your request. Contact the uploader where possible; FrameSense will assist the controller and will not disclose another customer's content without an appropriate basis.

8. Changes to this notice

Material changes will receive a new version and effective date. Where law requires it, users will be notified or asked for fresh consent before the change applies.