Privacy Policy

The controller responsible for data processing on this website is:

• E-Mailcaseusdigitalagency@gmail.com
• Websitecaseus.studio

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or erased (Art. 17),
• have its processing restricted (Art. 18),
• receive the data you provided in a structured, machine-readable format (Art. 20),
• withdraw a consent at any time with effect for the future (Art. 7(3)); processing carried out before the withdrawal remains lawful.

An email to caseusdigitalagency@gmail.com is enough to exercise any of these rights.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live, work or where the alleged infringement took place. The authority responsible for us is the Landesbeauftragter für den Datenschutz Sachsen-Anhalt.

On /start we scope your project in a conversation with an AI assistant. This processes your chat messages, any briefing documents you paste or upload, and the project details derived from them (number and length of videos, audience, platform, paid options).

To generate replies we transmit the conversation and attached documents to Google Ireland Limited (Gemini API). Processing on servers outside the EU cannot be ruled out; such transfers are based on the EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Please do not enter special categories of personal data or any credentials into the conversation - the assistant never asks for passwords, confirmation codes or payment details.

We do not store your source footage. It stays in your own cloud storage and is made available to us through a share link; we only check automatically whether that link can be opened.

In the review room of the client portal you can jot down your thoughts on a video in your own words and let the AI sort them into separate notes with timecodes. For this we transmit your text, the length of the cut, the current playback position and the subjects that can still be changed at this stage to Google Gemini. The video itself is not transmitted. We store the resulting notes together with your original text, so the studio can read what was meant. The feature is optional – notes can always be written without the AI. The legal basis is Art. 6(1)(b) GDPR (performance of the contract); what is said above about transfers outside the EU applies.

After delivery you can rate your project in the client portal. We process your score for each service, your optional comment and, if you give them, your name and role. Rating is voluntary and serves quality assurance (Art. 6 Para. 1 lit. f GDPR). Once a minimum number of projects has been rated, the website shows the average of all ratings, without reference to any individual client.

Only if you expressly agree to publication do we show the project as a case study on our website: the finished videos, the company name and logo, your comment with your name and role, your ratings and the price of each video. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR). We record the wording, version and time of your consent and of any withdrawal as proof (Art. 7 Para. 1 GDPR).

The case text is drafted by Google Gemini (Google Ireland Limited) from the facts of the project; email addresses, phone numbers, links and the names known to us are removed first. Before publication your comment is checked automatically for inadmissible content and, like the rest of the text, translated into the website’s languages. What section 5 says about transfers outside the EU applies.

Videos, preview images and logos of published case studies are kept at Supabase in publicly accessible storage.

You can withdraw your consent at any time with one click in the client portal or by email. The case study then disappears from the website at once, and its public files and your logo are deleted. We have no control over copies that third parties such as search engines have already made.

If you have switched reminders on in the portal, we remind you once by email to rate the project (Art. 6 Para. 1 lit. a GDPR); otherwise we do not.

We use the following processors, each bound by a data processing agreement under Art. 28 GDPR:

• Vercel Inc. – hosting and delivery of the website, server logs. Server functions run in Frankfurt am Main; pages are delivered through Vercel’s worldwide network.
• Supabase Inc. – database, user accounts and file storage for briefing documents, project documents and versions, and public storage for the files of published case studies. The data is held in data centres in Frankfurt am Main.
• Google Ireland Limited – AI replies in the briefing conversation, sorting review notes, and drafting, checking and translating portfolio texts (Gemini API).
• Resend, Inc. – sending our emails (confirmations, offer and status notifications, reminders), through servers in Ireland.

Vercel, Supabase and Resend are based in the US, and Google may also process data outside the EU. Where personal data is transferred to a third country, the transfer rests on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR), which form part of each data processing agreement.

Payments are handled by Stripe Payments Europe, Ltd. (Ireland). You enter your payment details directly with Stripe; we never receive them. Stripe processes them as a controller in its own right and may transfer them to Stripe, Inc. in the US; details are in Stripe’s privacy policy at stripe.com/privacy. The legal basis is Art. 6(1)(b) GDPR.

Other recipients

• If you give us a VAT identification number, we check it in the European Commission’s VAT Information Exchange System (VIES); your number and the studio’s are transmitted (Art. 6(1)(c) and (f) GDPR).
• Some older case-study videos are hosted on YouTube (Google Ireland Limited). They load only when you click “Load video from YouTube”. Only then are your IP address and device information sent to Google, and YouTube may use cookies or similar technologies (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Google may also process this data in the US.
• The studio’s editors, colourists and sound designers see the project data they need for their work. Anyone who is not employed by us is bound by contract to confidentiality and to process data only on our instructions.

The legal basis for using these providers is Art. 6(1)(b) GDPR for performing the contract and Art. 6(1)(f) GDPR for operating the website securely and reliably.

Two kinds of storage are used on this site. The first is what the site needs in order to work, and is set without asking:

• a signed, httpOnly cookie that ties your briefing in progress to your browser (30 days);
• cookies for signing in to the client portal, set by our provider Supabase;
• local browser storage for the briefing you are writing, your acceptance of the terms, and your cookie choice itself.

The second only runs if you allow it in the cookie banner, and is switched off until you do:

• Preferences — where you dragged the panels in the client portal, so the board opens the way you left it. Likewise, whether you write review notes yourself or let the AI sort them.
• Statistics — anonymous page-speed measurement by Vercel Speed Insights. It sets no cookie and stores no identifier.
• Marketing — which advert or link first brought you here (UTM parameters and referrer), kept in your browser’s local storage.

The legal basis for the necessary group is section 25(2) no. 2 TDDDG together with Art. 6(1)(b) and (f) GDPR. The optional group runs on your consent under section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw it at any time using the “Cookie settings” link in the footer; a withdrawal takes effect immediately and deletes what the declined category had stored.