Privacy notice

[PLACEHOLDER] This page is a draft placeholder. This notice has not been reviewed or approved by the controller or its data protection officer, and it is not the notice required by Articles 13 and 14 of the GDPR yet. The page exists so that its address, its links and its structure are in place for review. (Register: deferred.md C190.)

Privacy notice

[placeholder] This notice describes how personal data is processed in this service.

Controller

[placeholder] The controller is [placeholder: expected to be Aalto University], contact [placeholder: address]. The data protection officer is reachable at [placeholder: DPO address].

What is processed, and why

[placeholder] For each account: name, email address, sign-in events and active sessions, preferences, and the things the account has done in the service (uploads, shares, notes, marks). For media: the files themselves, including any personal data inside them, and technical metadata read from them. Viewing statistics are collected without identifying the viewer. [placeholder: purposes and legal bases per category.]

Recipients

[placeholder] Processing happens on the operator's own systems. Audio sent for automatic transcription is processed on [placeholder: the operator's transcription processor]. A daily operational digest is delivered to [placeholder: the configured webhook recipient]. No personal data is sold or used for advertising.

Retention

[placeholder: retention periods per category, including the backup window.]

Your rights

[placeholder] A signed-in person can export the data held about their account and ask for its erasure from their Settings page. [placeholder: the other GDPR rights and how to exercise them, and the right to complain to the Data Protection Ombudsman.]

People depicted in media

[placeholder] Media depicting people is personal data of the people depicted. Requests from depicted persons are handled through [placeholder: contact address and procedure].

Cookies

[placeholder] The service sets one session cookie, which is strictly necessary for signing in, and stores interface preferences for the signed-in account. Nothing is used to track visitors, which is why there is no consent banner.