This policy describes how ThoseTimes, operator of the Those Times service (the « Service »), processes the personal data of its users (« you »). The data controller can be reached at contact@thosetimes.app.
1. Data we collect
- Account data: email address, password (hashed), theme preference, language.
- Content you entrust to us: uploaded photographs, descriptions and dates, generation instructions, projects, generated videos.
- Payment data: Stripe customer ID, purchase history, invoices. Card data never transits through our servers and is not stored on our side.
- Technical data: IP address, device type, browser, error logs, product usage events.
2. Purposes and legal bases
- Providing the Service (contract performance, GDPR 6.1.b): authentication, photo storage and processing, video generation, wallet management.
- Billing and accounting obligations (legal obligation, 6.1.c): retention of invoices and payment evidence.
- Service improvement and aggregate analytics (legitimate interest, 6.1.f): performance and audience measurement, error detection.
- Communications (legitimate interest or consent): transactional information about your account.
3. Sub-processors and hosting
We rely on the following providers:
- Supabase (Germany, EU): authentication and database.
- Cloudflare R2 (EU): storage of photographs and generated videos.
- Stripe(Ireland, United States): payment processing. Transfers outside the EU are covered by the European Commission's standard contractual clauses.
- OpenAI (United States): montage planning and, where applicable, photo animation.
- Replicate (United States): AI photo animation.
- PostHog: product usage and performance analytics.
- Contabo (Germany, EU): application hosting.
Photographs and descriptions transmitted to AI providers are used solely to produce the requested output. We do not permit their reuse for model training. You remain the sole owner of your content.
4. Retention
- Account data: for as long as the account is active; deleted within thirty (30) days of account deletion.
- Photos, videos and projects: while the account is active; deleted at the latest thirty (30) days after account deletion.
- Invoices and accounting: ten (10) years (legal requirement).
- Technical logs and usage events: up to thirteen (13) months.
5. Your rights
Under the GDPR you have rights of access, rectification, erasure, restriction, portability, objection, and the right to give directives regarding the fate of your data after your death. Exercise any of them by writing to contact@thosetimes.app.
You may also lodge a complaint with the French data-protection authority (CNIL — www.cnil.fr) or your local supervisory authority.
6. Cookies
The Service uses only cookies strictly necessary for its operation (notably authentication and theme preference). No advertising cookie is set. The analytics tooling used is configured in an anonymised manner that does not require a consent banner under the relevant guidance.
7. Security
We implement appropriate technical and organisational measures to protect your data: password hashing, TLS in transit, restricted access to production data, isolated environments.
8. Contact
For any question relating to your personal data or to this policy, write to contact@thosetimes.app.