Privacy Policy

Who we are

EditorFlow is operated by Scucci Projects, registered with the Dutch Chamber of Commerce (KvK) under number 95910352, registered address Ruijgenhoeksepolder 50, 3453 NG De Meern, VAT number NL867385984B01. In this policy, “we”, “us”, and “EditorFlow” refer to Scucci Projects.

What we collect

Your account. Your email address, business name, and what you add in Settings: logo, brand color, KvK and VAT number, preferences. Your password is stored only as a secure hash by our sign-in provider — nobody at EditorFlow can read it.

Your clients’ data. What you enter to run your client work: names, email addresses, phone numbers, company details, notes, proposals, contracts (including the name typed as a signature, the time and the IP address it was signed from), invoices, feedback and drawings on your videos, and testimonials. You decide what goes in — for this data we are your processor, see below.

Files you upload (Pro). Review copies of your cuts and the final files you deliver to clients. We don’t store raw footage, project files or archives.

Your subscription. Stripe handles payment for your Pro plan. We keep your Stripe customer and subscription reference and your plan status — never your card details.

Security data. IP address and browser details in server logs. To stop abuse we also record attempts to log in, sign up, reset a password, send an enquiry, request or enter a portal login code: the IP address, the time, whether it worked, and for accounts a one-way hash of the email address — kept for two days. On signup, password reset and after repeated failed logins, Cloudflare Turnstile checks signals from your browser to tell people from bots.

Visitor statistics. On the public pages only — the homepage, the demo and signup — Vercel Web Analytics counts visits: which page, where the visit came from (the referring site), country, and the kind of device and browser. It sets no cookies and stores no IP address; visits are only told apart by a hash that changes every day. Two clicks in the demo are counted the same way. Nothing is measured inside the app, in client portals or on intake forms.

Google Analytics, only if you agree. On those same public pages we ask whether we may use Google Analytics. Only if you choose Accept does your browser load it; it then sets cookies (_ga and _ga_…, kept for up to two years) and sends Google which pages you view, how you got here, your approximate location, and your device and browser. We use it only to see how the site is used — advertising features are switched off. Google Ireland Ltd. and Google LLC (United States) process this data; the transfer relies on the EU–US Data Privacy Framework. Decline, and nothing is loaded. You can change your choice at any time with “Cookie settings” at the bottom of the homepage. We don’t run advertising trackers.

What we don’t do

• We never process or hold your clients’ payments. You paste your own payment link onto each invoice, and the money goes directly to you.
• We don’t sell data or share it with anyone beyond the providers named on this page.
• We don’t email your clients on our own initiative — only what you send, or what you’ve switched on yourself.
• We don’t send you marketing email without your say-so.

Why we use it

To provide the service you signed up for — your account, the client portal, the emails it sends and your subscription (performance of our contract with you). To meet legal obligations, such as keeping invoices for the Dutch 7-year retention period. And to keep the service secure and working, such as limiting login attempts and blocking bots (our legitimate interest). Google Analytics on the public pages runs only on your consent, which you can withdraw at any time.

Who processes it for us

We use these providers to run EditorFlow, each under their own data processing terms:

• Vercel Inc.

  Hosting and serving the app; visitor statistics on the public pages

  Server functions in Dublin, Ireland, behind a global network. US company.

• Supabase Inc.

  Database, sign-in, and storage for logos and thumbnails

  Ireland (eu-west-1). US company.

• Cloudflare Inc.

  Video review copies (Stream), final files (R2), bot protection (Turnstile), DNS

  Global network. US company.

• Resend Inc.

  Sending emails from the app

  Ireland (eu-west-1). US company.

• Stripe Payments Europe Ltd.

  Billing for EditorFlow’s own Pro subscription

  Ireland.

Where a provider is based in the United States, transfers of personal data rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Acting as a processor for your client data

For your clients’ data, you are the controller and we are your processor. The terms of that are in our Data Processing Agreement, which is part of our Terms of Service and applies automatically — no signature needed. Clients of an editor who want to exercise their rights should contact that editor first; we help the editor respond.

How long we keep it

• Account and client data: for as long as your account is open, and removed within 30 days after you close it — except the part an invoice has to show, below.
• Invoices: 7 years, as Dutch tax law requires, also after you close your account. An invoice names two businesses, so your own company details and the name and address of the client it was sent to stay with it for those 7 years. Their email address, phone number and any notes you kept about them do not.
• Review copies of videos: cleared 7 days after a project closes. You get an email before that happens and can extend it by 30 days. After a free trial without a subscription, review copies of open projects are cleared 14 days after the trial's 30 days are up, again with an email first.
• Final files: available to your client for 90 days, then removed.
• Security records of login, signup, reset, enquiry and portal login-code attempts, and the login codes themselves (stored as a one-way hash): 2 days.

Cookies

EditorFlow only uses strictly necessary cookies: to keep you signed in, to give a client portal link access to the right client’s data, to remember that a device already entered a portal login code, and to remember the language you chose for these pages. Your light or dark mode choice is stored in your own browser. Turnstile’s bot check is a security measure, not tracking, and Vercel’s visitor statistics on the public pages work without cookies. None of this requires your consent. The one exception is Google Analytics on the public pages, described above: its cookies are only set after you choose Accept, and your choice itself is remembered for a year in a cookie of its own (ef_consent).

Your rights

Under the GDPR (AVG), you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to how it’s used, and receive it in a portable format.

• Get a copy of your data: email us and we’ll send your clients, projects, invoices and the comments on your cuts as one machine-readable file.
• Close your account: email us from the address on your account. You get that copy first. Then your projects, video, final files, proposals, contracts, contacts, templates and portal links are removed, along with every client you never invoiced, and the account is locked so no one can sign in again. What remains is the invoice record the law obliges us to keep, and the least it can be read with: your company details, and the name and address of each client you invoiced.
• Anything else: email us and we’ll respond within 30 days.

Write to support@editorflow.app. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Access to data is enforced by the database itself (row-level security), not just by the interface — a bug on a page can’t show one editor’s or one client’s data to another. Connections are encrypted. Videos and final files are only reachable through private links that expire within hours. Logins, signups and forms are rate-limited and protected against bots, and a client portal asks for a login code sent to the client's email address the first time it is opened on a device.

Changes to this policy

If we make a material change, we’ll email you before it takes effect. The date at the top of this page always reflects the latest version.

Contact

Questions about this policy or your data: support@editorflow.app, Scucci Projects, Ruijgenhoeksepolder 50, 3453 NG De Meern.