Privacy policy

The controller responsible for data processing on this website and in the customer portal is:

Lou Technologies GmbH Bessemerstraße 51 12103 Berlin Germany Email: lukas (at) caprivideo (dot) com

You can reach us at this email address with any questions about data protection and to exercise your rights.

We only process personal data to the extent necessary to operate the website, maintain your customer account and produce your videos. We use Ahrefs Web Analytics for cookie-free reach measurement (section 5) and Google Ads and the Meta Pixel to measure the success of our advertising (sections 6 and 7). We ask visitors from the European Economic Area, the United Kingdom and Switzerland for consent in the cookie banner first; visitors from other regions see a short notice in which they can decline. We do not sell data and do not use your content to train AI models. PostHog EU Cloud analyzes usage under the same region rule; without consent, PostHog only counts without cookies (section 19).

We operate the website and customer portal on servers of a hosting provider acting as our processor. We also store our database and your files there. When you access the website, the server processes technically necessary data: IP address, date and time, page accessed, referrer, browser and operating system.

We use this data to deliver the website, ensure its security and prevent misuse. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. Log data is deleted after 30 days at the latest unless it is required to investigate a security incident.

The connection is encrypted via TLS. Fonts are served from our own server; no data is transmitted to Google or other font providers in the process.

Technically necessary cookies and storage functions:

• a session cookie to keep you signed in,
• a security cookie to protect against cross-site request forgery (CSRF),
• a language cookie (“cv_lang”) that stores your chosen language,
• a consent cookie (“cv_consent”) that stores your choice in the cookie banner for twelve months,
• a consent cookie (“cv_posthog_consent”) that stores your separate consent or refusal for PostHog usage analytics for twelve months,
• a region cookie (“cv_region”) for visitors outside Europe until the browser is closed, so that our server applies the same region rule as your browser,
• an order draft in your browser’s local storage (localStorage), so that your entries are retained when you reload the page or after you sign in.

The legal bases are Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(b) or (f) GDPR. Consent is not required for this. For visitors from Europe, we only set marketing and analytics cookies of Google Ads, Meta and DataFast and PostHog's analytics identifiers if they consent in the cookie banner; for visitors from other regions, until they object (sections 6, 7, 19 and 20). You can change your choice at any time via “Cookie settings” in the website footer. You can delete the order draft at any time by clearing the site data in your browser.

To understand how our website is used (e.g. which pages are visited and where visitors come from), we use Ahrefs Web Analytics from Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581. When you open a page, a script transmits the page accessed, the referrer, browser, operating system, device type, language setting, and clicks and form submissions to Ahrefs. At most your approximate location at city level is derived from your IP address.

Ahrefs Web Analytics does not set cookies and does not store any information on your device. According to Ahrefs, IP addresses are not stored; unique visitors are counted using a hash value that changes daily, so no profiles are created across days, devices or websites. We only receive aggregated statistics.

The legal basis is our legitimate interest in designing our website according to demand (Art. 6(1)(f) GDPR). You can object to this processing at any time (section 18). Further information: https://ahrefs.com/privacy-policy

We advertise via Google Ads and use the Google tag to measure the success of our ads (conversion tracking) and to show our ads to visitors of our website later on (remarketing). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data as an independent controller.

We use Google’s consent mode. Whether we ask first depends on your browser’s time zone and, on Google’s side, your IP address: visitors from the European Economic Area, the United Kingdom and Switzerland see the cookie banner. Until they consent, the Google tag sets no cookies and only sends cookieless signals (e.g. time, page accessed, browser, consent status and whether a purchase was completed; for technical reasons also the IP address), which Google uses to estimate the number of conversions statistically (conversion modelling). For visitors from other regions, the Google tag is active from the start; a short notice in the cookie banner informs them about it, and they can decline there or later via “Cookie settings”. We treat a Global Privacy Control signal from your browser as an objection.

With consent, or outside Europe until you object, Google sets cookies (e.g. “_gcl_au”, stored for up to 90 days) and receives in particular your IP address, the pages you visit, the time of access, browser and device information and, if you came to us via a Google ad, the click identifier. If you are signed in to Google, Google may associate this information with your Google account. When an order is paid, we also send Google your email address, which your browser first irreversibly encrypts (hashes), so that Google can attribute the purchase to an ad (enhanced conversions); Google only uses it with your consent or, outside Europe, until you object.

For visitors from Europe, the legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); for visitors from other regions, it is likewise their consent if they click “OK” in the notice. For the cookieless signals before a decision and for visitors from other regions who have not made a choice, the legal basis is our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR). You can withdraw your consent or object at any time with effect for the future via “Cookie settings” in the website footer; we then also delete the Google Ads cookies set on our domain. Google also processes data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Further information: https://policies.google.com/privacy and https://business.safety.google/privacy/

We advertise on Facebook and Instagram and use the Meta Pixel to measure the success of our ads and to show our ads to visitors of our website later on (Custom Audiences). The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

For visitors from the European Economic Area, the United Kingdom and Switzerland (determined from the browser’s time zone), the Meta Pixel is only loaded after they have clicked “Accept” in the cookie banner; before that, no data is transmitted to Meta. For visitors from other regions, it loads from the start; a short notice in the cookie banner informs them about it, and they can decline there or later via “Cookie settings”. We treat a Global Privacy Control signal from your browser as an objection; the pixel then does not load. While the pixel is active, Meta sets cookies (e.g. “_fbp” and, if you came to us via a Meta ad, “_fbc”, each stored for up to 90 days) and receives in particular your IP address, the pages you visit, the time of access and browser and device information. If you are signed in to Facebook or Instagram, Meta may associate this information with your account.

We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR); the details are set out in Meta’s Controller Addendum (https://www.facebook.com/legal/controller_addendum). Meta is solely responsible for any further processing. You can also exercise your rights directly against Meta.

For visitors from Europe, the legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); for visitors from other regions, it is their consent if they click “OK” in the notice and, without a choice, our legitimate interest in measuring and delivering our advertising (Art. 6(1)(f) GDPR). You can withdraw your consent or object at any time with effect for the future via “Cookie settings” in the website footer; we then also delete the Meta cookies set on our domain. Meta also processes data in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. Further information: https://www.facebook.com/privacy/policy

For a customer account, we process your email address, your name and, if you set one, your password, which we store exclusively as a cryptographic hash. To verify your email address, for sign-in via magic link and to reset your password, we send you emails containing time-limited links.

The legal basis is the performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). This information is required for registration; without it, we cannot create an account. We store the data for as long as your account exists.

When you order a video, we process your briefing (e.g. project description, company name, website, target audience, script, tone), the options you selected, your materials, your comments and acceptances in the review, and our communication with you. If you provide links to publicly shared files (e.g. on Google Drive or Dropbox), our server downloads these files. We store uploaded and imported files as well as finished videos privately on our servers. Only you, our production team and, where necessary, the processors named in this privacy policy have access to them.

The legal basis is Art. 6(1)(b) GDPR. If your materials contain personal data of third parties (e.g. photos of employees), you are responsible for ensuring that you are lawfully permitted to provide us with this data; we process it on your behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

To create your videos, we use AI models (including Claude by Anthropic) via the Amazon Bedrock service, as well as computing capacity from Amazon Web Services (AWS) for rendering. In the process, the parts of your briefing and materials required for production are transmitted to AWS. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, which acts as our processor.

Under the AWS terms, content processed via Amazon Bedrock is neither used to train models nor shared with the model providers. Intermediate files generated for rendering are temporary and are kept separate from our permanent data store.

We generate voice-overs using the ElevenLabs service of Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA, acting as our processor. For this purpose, we transmit only the text to be spoken and the selected voice.

For research into publicly available information, for example about your industry, our production system uses the web search of Firecrawl (SideGuide Technologies, Inc., USA), acting as our processor. In doing so, we only transmit search terms, which may be derived from your briefing, but no files.

Every result is reviewed and approved by a person before delivery. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. The legal basis is Art. 6(1)(b) GDPR.

We process subscriptions, payments and invoices via Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes and stores your payment data (e.g. card details) as an independent controller; we do not receive full card numbers, only Stripe references for the customer account, subscription and saved payment method, the subscription and payment status, the amount and the billing details. The saved payment method is used for the monthly subscription payments and for payments you expressly initiate in the portal.

The legal bases are Art. 6(1)(b) GDPR and, for the retention of invoices, Art. 6(1)(c) GDPR. Further information: https://stripe.com/privacy

We send transactional emails (e.g. sign-in links, status updates on your order) via the Resend service of Plus Five Five, Inc., San Francisco, USA, acting as our processor. In the process, your email address and the content of the message are processed. The legal basis is Art. 6(1)(b) GDPR. We do not send marketing emails without your consent.

To book consultation calls, we integrate the Cal.com service of Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Only when you click a call-booking link does the website load a script from Cal.com to open the booking pop-up; at that point, your IP address is transmitted to Cal.com. Simply visiting our pages does not load this script. If you book an appointment, Cal.com processes the data you enter (e.g. name, email address, preferred time).

The legal basis is our legitimate interest in simple appointment scheduling (Art. 6(1)(f) GDPR) or, in the case of a booking, Art. 6(1)(b) GDPR. Further information: https://cal.com/privacy

If you contact us by email or through the inquiry form, we process your name, email address and message in order to respond to your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data as soon as it is no longer required and no retention obligations apply.

Some of the service providers named are based in the USA or may process data there. Transfers take place on the basis of the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the recipient is certified, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Ahrefs Pte. Ltd. and JustShipIt Pte. Ltd. (DataFast) are based in Singapore; transfers there are also based on the EU Standard Contractual Clauses. DataFast mainly uses service providers in the USA. We will provide you with a copy of the Standard Contractual Clauses on request.

We store personal data only for as long as necessary for the stated purposes. We delete account, order and project data after termination of your account, unless statutory retention obligations prevent this. We retain invoices and other accounting records for eight years, and commercial books and annual financial statements for ten years (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)).

You have the following rights:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR).

An email to lukas (at) caprivideo (dot) com is sufficient to exercise your rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, https://www.datenschutz-berlin.de

If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal objection by email to lukas (at) caprivideo (dot) com is sufficient.

We use PostHog EU Cloud to measure pageviews, steps in the ordering form and successful customer portal actions, such as submitting an order, starting checkout, requesting changes and approving a video. For visitors from the European Economic Area, the United Kingdom and Switzerland (determined from the browser’s time zone), usage analytics with device, session and account identifiers start only after they explicitly click “Accept” in the cookie banner; an earlier choice for Google Ads or Meta does not count. For visitors from other regions, they start from the beginning, like the Meta Pixel; a short notice in the cookie banner informs them about it, and they can decline there or later via “Cookie settings”. We treat a Global Privacy Control signal from your browser as an objection; PostHog then records nothing. For visitors from Europe, the legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); for visitors from other regions, it is their consent if they click “OK” in the notice and, without a choice, our legitimate interest in measuring reach, campaign success and the ordering flow (Art. 6(1)(f) GDPR).

We transmit only sanitized page paths without URL parameters, fragments, sign-in tokens or order identifiers, event timestamps, and random device and session identifiers. If you arrived through a link tagged for a campaign (e.g. from a Google ad), we additionally transmit the five campaign parameters “utm_source”, “utm_medium”, “utm_campaign”, “utm_term” and “utm_content” (shortened to 100 characters); click identifiers such as “gclid” are not transmitted. After sign-in, a pseudonymous account identifier links browser and backend events within the same usage journey. PostHog stores browser identifiers in localStorage. Names, email addresses, form inputs, briefs, files and videos are not transmitted; automatic click/form capture is disabled. As part of this usage analytics (with your consent or, outside Europe, until you object) we also record anonymised session recordings (Session Replay): page layout, mouse movements, clicks and scrolling, so that we can spot usability problems. Input fields, email addresses, names and comments are masked in your browser before transmission, videos are not recorded and page addresses are sanitized as described above; console and network data are not captured. There is no session recording in cookieless mode. Internal team accounts are excluded from product analytics. We also distinguish the coarse device category (computer, phone or tablet) and the two briefing sections, “Language and format” and “Materials and notes”. We do not collect the device model, screen dimensions or your input content for this purpose; no device category is transmitted in cookieless mode.

Events are sent to PostHog’s EU infrastructure. For direct browser connections, your IP address is technically visible for the connection; storing it as an analytics attribute and location enrichment are disabled. You can withdraw consent anytime through “Cookie settings” in the footer. We then stop new transmissions, abort ongoing browser requests and remove locally stored analytics identifiers. This does not retroactively delete data already lawfully transmitted. Further information: https://posthog.com/privacy

As long as there is no consent, i.e. before you make a choice in the cookie banner or after you decline, PostHog only records pageviews and steps in the ordering form, each with a sanitized page path, a timestamp and, where present, the five campaign parameters. We store nothing in your browser apart from the consent cookie and use no device, session or account identifier; internal team accounts remain excluded. So that visits on the same day can be counted together, PostHog computes a hash on its EU servers from your IP address, browser identifier (user agent) and domain together with a secret random value that changes daily, and then discards the IP address and user agent. You are not recognized across days. The legal basis is our legitimate interest in data-minimizing measurement of reach, campaign success and the ordering flow (Art. 6(1)(f) GDPR). You can object to this processing at any time (section 18); we treat a Global Privacy Control signal from your browser as an objection, and PostHog then records nothing.

We use DataFast to count visits to our website and to see which pages, referrers and campaigns lead to inquiries and orders. The provider is JustShipIt Pte. Ltd. (trading as DataFast), Singapore. DataFast processes the data on our behalf (Art. 28 GDPR).

DataFast loads under the same rules as the Meta Pixel: for visitors from the European Economic Area, the United Kingdom and Switzerland only after they have clicked “Accept” in the cookie banner; for visitors from other regions from the start, unless they decline or their browser sends a Global Privacy Control signal (section 7). While DataFast is active, a script transmits the page you visit and the referring page, your IP address (from which your country is derived), browser, device and operating system information and random identifiers to DataFast. It sets cookies with these identifiers: “datafast_visitor_id”, “datafast_visitor_first_seen_at” and “datafast_visitor_session_count” for up to twelve months and “datafast_session_id” for 30 minutes.

For visitors from Europe, the legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); for visitors from other regions, it is their consent if they click “OK” in the notice and, without a choice, our legitimate interest in measuring the reach of our website (Art. 6(1)(f) GDPR). You can withdraw your consent or object at any time with effect for the future via “Cookie settings” in the website footer; DataFast then stops recording and we delete its cookies set on our domain. DataFast and its service providers process data mainly in the USA (section 15). Further information: https://datafa.st/privacy-policy

We run ads on Facebook, Instagram and TikTok that let you fill in a contact form directly in the app (“lead form” or “instant form”). When you submit such a form, we receive the details you provide or confirm: name, email address, phone number, your website link, your answers to our questions (for example whether you are the owner or in charge of marketing, and what you need the video for), and which ad and platform the request came from. The platform may prefill some fields from your profile; you can change them before submitting.

The providers are Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. For users outside the European Economic Area, other entities of the platforms may be responsible. The platforms also process your data under their own privacy policies and may transfer data to countries outside the EU. Further information: https://www.facebook.com/privacy/policy and https://www.tiktok.com/legal/privacy-policy-eea

We use your details to contact you about your explainer video request and to prepare an offer. To do so, we create a customer account without a password for your email address and prepare an order draft with your details (for example company name and website). You receive an email with a personal sign-in link to this draft, followed by up to four reminders within ten days (sent via Resend, section 12); the link in each of these emails lets you unsubscribe from further reminders. If you provided a phone number, we may also call you about your request. If you provided a mobile number from Germany, Austria, Switzerland or the USA, you also receive a text message with a personal link to your draft and, whenever a video preview is ready for you, a text message with a personal link to the preview. It is sent via Telnyx LLC, Austin, USA, as our processor; your phone number and the text of the message are processed for this (transfers to the USA: section 15). The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

If no order follows, we delete your details and the account created for you as soon as they are no longer required to handle your request and no retention obligations apply. You can object to being contacted and request deletion at any time, for example by emailing lukas (at) caprivideo (dot) com.

We will update this privacy policy if our services or the legal situation change. The version published on this page at the relevant time applies.