Privacy Policy

1. Who is responsible for your data

Arum Prior SRL, Nikolai Ostrovski 42, mun. Bălți, MD-3100, Republic of Moldova. Data protection enquiries: privacy@topscale.io.

Moldova is not part of the European Union. As we offer services to people in the EU, the General Data Protection Regulation (GDPR) applies to the corresponding processing of their data. Alongside it applies Law No. 195/2024 of the Republic of Moldova on personal data protection, which transposes the GDPR rules into Moldovan law.

2. What you provide

• Email address — for sign-in and for job and security notifications.
• Password — we keep only an irreversible hash, so we cannot read your password or tell it to you; it can only be replaced.
• Username and display name.
• Interface language and the retention period you choose.
• Correspondence with us, if you write to support: your messages and their attachments.
• Email, password and username are required — the Service cannot be used without them. Everything else you provide at your discretion.

3. What arises from use

• The video you upload and the results of processing it.
• Your file names, durations, resolutions, sizes and codecs.
• Thumbnail frames extracted from your footage to show in the job list.
• Job details: timing, settings, cost in credits, errors. For uploads by link — the link address itself.
• Your charge and top-up history.
• If you link Telegram — your chat number, kept until you unlink it. The one-time link key is erased as soon as linking completes.
• The IP address a job was created from — for handling complaints and responding to lawful requests. Kept for 90 days.
• The time of your last sign-in — it tells us whether you have ever signed in at all; without it we could not tell someone else signing into a long-dormant account from your own first sign-in. Kept while the account exists.
• The IP addresses your account was signed in from, and the time of each sign-in — so we can warn you about a sign-in from an unfamiliar address, and so we can answer a payment provider in a card dispute. Kept for 90 days; we remember the last 20 addresses.
• The staff access log: which of our staff opened your jobs, and when. Visible in your dashboard. Kept for 1 year.
• Sign-in sessions and personal API access tokens, if you issue them.
• The invites you issue; the invite you joined through holds your address and the inviter’s note about you.
• Technical operation logs; these contain your account identifier, the storage path of the file and the network address the request came from.

4. Our legal bases

Under the regulation every processing operation must rest on a named legal basis. Here they are:

• Performance of our contract with you: the account, uploading and processing footage, job records, the charge history, job emails, Telegram notifications if you link it, support correspondence and invites.
• Our legitimate interest — protecting accounts and infrastructure, preventing abuse, investigating failures and disputes: sign-in addresses and alerts about them, the job IP address, the staff access log, technical logs. You may object to this processing (section 10).
• Legal obligation: bookkeeping records and responses to lawful requests from authorities.
• We currently rely on consent for no processing at all; should consent-based processing ever appear, we will ask for it separately, and it will be revocable.
• We make no solely automated decisions with legal or similarly significant effects on you: video processing is a technical operation, and account decisions are made by a person.

5. What we do not do

There are no trackers: no visitor counters, no advertising pixels, no analytics systems, no third-party scripts. We do not follow your behaviour for advertising and build no profiles; the technical logs from section 3 exist only to run and protect the Service. We send no marketing email: we write only about your jobs, balance, security and changes to these documents — and we reply when you write to us. That is also why there is no cookie consent pop-up: the site has no optional cookies, so there is nothing to ask about. Your browser stores only what is strictly necessary for sign-in — an exemption that requires no consent; it is not used for advertising, analytics or tracking. The checkout window is the exception: it is shown by the payment provider taking the payment and may use its own cookies; it opens only when you start a purchase yourself. Staff have a single internal cookie for the admin panel. If the site ever gains optional cookies, a consent window with a choice will appear first.

6. People in your footage

Home video usually contains other people: relatives, children, passers-by. Their images and voices are personal data too. We process such footage on your instructions and in your interest: we do not review its content, do not recognise faces, do not match people across recordings, and do not use it to train neural networks. Processing is automated; a staff member may open a recording only when their work requires it — for example, when investigating your complaint or a failure — and such access goes into the log you can see in your dashboard. We do not scan or pre-screen the content of recordings; we act on violations upon complaints and lawful requests, as the terms describe. Footage may incidentally contain special categories of data (visible health conditions, for example): we do not extract or analyse them — they are processed only insofar as they appear in the recording, and only to fulfil your order.

If you appear in someone else’s recording and want it deleted, write to us and we will consider your request. Please note: we cannot show you another person’s file or tell you who uploaded it — that would disclose another person’s data.

7. Who we share data with

We do not sell data and do not share it for advertising. Data is processed by suppliers without whom the Service cannot run: Cloudflare R2 (storage of uploaded footage), iDrive e2 (storage of results), Bunny CDN (thumbnail frames only; video files are never sent there), rented GPU servers in Europe (processing; temporary files are deleted when it finishes), and our own mail server (sending email). If you link Telegram, notifications travel through it — they contain your file names, job numbers and a frame from the finished video; you can unlink it in your settings and everything goes back to email. Telegram is a third-party service with servers in various countries, including outside the EU: by linking it you choose that channel yourself. Payments are taken by Creem, a payment provider acting as merchant of record: it is independently responsible for payment data under its own privacy policy, while we receive only the payment confirmation, its reference and the amount; we never see or store your card number.

We may disclose data on the lawful request of a competent authority. We notify you of such requests unless the law prohibits it.

8. Where data is stored

The main storage and processing servers are located in Europe. The system is administered from the Republic of Moldova, for which the European Commission has not adopted an adequacy decision; transfers outside the EU rest on the European Commission’s Standard Contractual Clauses (SCC, Decision 2021/914) and other Article 46 GDPR safeguards — a copy is available on request; the exception is Telegram (section 7): that transfer rests not on SCC but on Article 49(1)(b) GDPR — it is necessary to perform the notification delivery you requested, and it stops as soon as you unlink. The delivery network caches thumbnail frames on nodes in various countries, including outside the EU, for no longer than 48 hours.

9. How long we keep it

• Uploaded footage and results — you choose: from immediate deletion to 30 days after the job completes. Default is 30 days.
• Files in your personal library — your permanent storage on the Service, where it is available to you — your retention period, counted from upload; a day, if your period is shorter.
• Thumbnail frames in the delivery network — up to 48 hours in cache.
• Temporary files on processing servers — deleted when the job finishes, including on failure or cancellation.
• Job records (without files) — your order history in the dashboard: kept until you delete the job or the account.
• Upload IP address — 90 days.
• Sign-in IP addresses — 90 days.
• Staff access log for your files — 1 year.
• Technical operation logs — 30 days.
• Invites: the ones you issue — while your account exists; the invite row you joined through — while the inviter’s account exists.
• Sign-in sessions and personal access keys — until you close or revoke them, and no longer than the account lives; password reset requests — until used or their short expiry passes.
• Support correspondence — in the support mailbox; deleted on your request.
• Bookkeeping records — for the periods required by the accounting and tax law of the Republic of Moldova.
• The account itself — until you delete it (or until we do, in the cases named in the terms — for example an account created by a minor).

10. Your rights

You have the right to obtain a copy of your data, correct inaccuracies, delete it, restrict processing, object to processing based on legitimate interest (section 4 names which processing rests on it), receive your data in a machine-readable form where the regulation provides for it, and withdraw consent should any processing ever rest on it (none does today — section 4); withdrawal takes effect from that moment, not retroactively.

A data export is available in your dashboard; the file includes: your account (including the Telegram link), jobs and their status history, transactions, invitations you issued, the addresses your account was signed in from, and the staff access log for your files. The video itself is not included: it is downloaded from the dashboard separately. The dashboard also shows which of our staff opened your jobs, and when.

To delete your account or correct your details, write to privacy@topscale.io from the address the account is registered to. We respond within one month; in complex cases the regulation allows an extension of up to two further months, in which case we will tell you in advance. This request is handled by a person — the service is small, and we would rather say so honestly than promise a delete button that does not exist.

Deleting your account erases: the account itself (name, username, email address, password), all your jobs and their records, files in both storage tiers and in your personal library, sign-in addresses, sessions, personal access tokens, password reset requests, the invites you issued, and your address and the note about you in the invite you joined through. If any file cannot be deleted, the erasure is not treated as complete: we repeat it rather than report success falsely.

Only the items below remain — with the reason for each. This is everything we deliberately keep. The nightly database backup (not files) lives no longer than 14 days and is stored encrypted: remnants of deleted data may outlive deletion by at most those two weeks, then erase themselves.

• Records of money movements: date, operation type, service, length in minutes, amount, remaining balance and the payment reference at the payment provider. The name, email address and file names are erased from them; what remains is the internal number of the former account — separated from any name or email, yet still an identifier, so we continue to treat these records as personal data. Kept for the periods required by the accounting and tax law of the Republic of Moldova — for bookkeeping and reconciliation with the payment provider.
• The invite row you joined through: it is kept to account for the inviter’s quota and lives as long as THEIR account exists. Your address and the note about you are erased from it.
• If you worked for us: records that a staff member opened someone else's files. They are kept for the owners of those files — their answer to “who looked at my footage” — until the log's one-year period runs out. Your name in them is replaced with “former staff member”.
• Support correspondence, if you wrote to us: it stays in the mailbox in case the matter continues; write to us and we will delete that too.
• Technical records of the service's operation — up to 30 days, after which they are erased automatically.

If you believe we are infringing your rights, you may lodge a complaint with a data protection supervisory authority — in the EU country where you live, work or where you believe the infringement occurred, or with the National Centre for Personal Data Protection of the Republic of Moldova.

11. Security

Passwords are stored as irreversible hashes. Files are accessed through signed links with a limited lifetime. Data is exchanged over secure channels. Staff access is limited to what their work requires and is recorded in a log you can inspect.

We apply reasonable security measures but cannot promise absolute security — no one can. A file link, once obtained, works until it expires: do not forward it to people you do not want to see the footage. If a breach occurs that creates a risk to your rights, we will notify the supervisory authority without undue delay — and, where feasible, within 72 hours of becoming aware of it — and will inform you too if the risk is high; where notifying someone personally is impossible — say, a person in someone else’s footage whose contacts we do not have — we will make a public announcement.

12. Children

The Service is intended for people aged 18 or older; we do not knowingly register children as users, and we will delete an account we discover was created by a minor. Adult users’ footage does, however, contain children — their images are processed as described in section 6: automatically, with no viewing and no recognition.

13. Changes to this policy

The date of the current version is shown at the top. We will announce material changes in advance — in the dashboard or by email. Should we ever intend to use data for a new purpose, we will first explain it and its legal basis — before such processing begins.