Privacy Policy

IMABIRD is operated by i am a ApS (IMABIRD ApS), CVR 46829336, Lunekrogen 4, 9200 Aalborg SV, Denmark ("IMABIRD", "we", "us", "our"), the data controller for the personal data described in this Privacy Policy.

This policy covers the IMABIRD website, web app, the Birdhouse desktop app, the developer API and connected integrations (the "Service").

Contact us about privacy at hello@imabird.productions.

Account and Profile

• Name, email address, profile picture and Google account identifier when you sign in with Google, or your email address when you sign in with an email and password. Passwords are handled by Firebase Authentication; we never see them.
• Your account status, plan, settings and preferences

Content You Provide

• Video, audio, images, speech and transcripts, prompts, project metadata, and other content you upload, import, generate, or submit
• Source links and access parameters you provide, source file and provider identifiers, available media metadata, and the status and results of import and publishing jobs
• Messages you exchange with the Agent and the edits it proposes or makes
• Communications with us

Payments

• Your plan, billing cycle, payment status, invoices, billing address, country and, if you provide one, your tax ID. You enter card details on Stripe’s payment page; we do not receive or store full card numbers.

Connected Accounts, Desktop App and Developer Access

• For YouTube, Instagram, Twitch and other accounts you connect: the details described in sections 8 to 10
• When you sign in to Birdhouse, our desktop app: a one-time sign-in code that links the app to your account, stored only as a hash and valid for five minutes
• Developer API keys you create and the requests made with them

Automatically Collected Data

• Usage data (features used, interactions, timestamps)
• Device and technical data (IP address, browser type, operating system)
• Log data, diagnostics and error reports

Data We Derive From Your Content

• Analysis we create to provide features, such as transcriptions, scene detection, the positions of faces and subjects used for reframing, semantic embeddings, summaries, and timecoded edit suggestions

We use personal data for these purposes, on the legal bases under the General Data Protection Regulation (GDPR) shown in brackets:

• Providing the Service: your account, processing and analysing your media, AI features, imports, exports, and the publishing you request (performance of our contract with you)
• Payments, invoices and bookkeeping (performance of our contract with you, and our legal obligations under Danish bookkeeping and tax law)
• Keeping the Service secure and reliable: preventing abuse, enforcing plan and rate limits, and diagnosing errors (our legitimate interest in operating a secure service)
• Understanding how the Service is used and improving it, using usage data and diagnostics (our legitimate interest in developing the Service)
• Analytics cookies (your consent, see section 6)
• Communicating with you about your account, purchases and changes to the Service (performance of our contract with you, and our legitimate interests)
• Complying with the law and establishing, exercising or defending legal claims (our legal obligations and legitimate interests)

Where we rely on legitimate interests, you can object, see section 14.

We do not use your content, including uploads, imported media, prompts, and AI-generated outputs, to train machine learning or artificial intelligence models.

To provide AI features, we send the relevant parts of your content, such as frames, audio, transcripts and prompts, to the AI providers listed in section 7, which return results to us.

The Service suggests and makes edits that you can review and change. It does not make decisions about you that have legal or similarly significant effects.

You are responsible for ensuring that you have a lawful basis and any necessary permissions to provide content containing other people's personal data, and for giving required notices and obtaining consent where applicable. This includes footage, voices, names, captions and other identifying information in local uploads or content imported from YouTube, Twitch, Google Drive, Dropbox or connected accounts. Public availability does not remove these responsibilities.

Submitting content or a link instructs us to retrieve and process it for the features you request; it is not consent on behalf of everyone depicted. Our Terms set out your content-rights and permission responsibilities. This Privacy Policy explains our processing and does not transfer our own legal obligations to you or limit any person's data-protection rights. Where we process personal data on your behalf as a processor, applicable data-processing terms and your lawful instructions govern that processing.

We use storage that is strictly necessary for the Service without asking, such as the sign-in session cookie and settings kept in your browser.

We use Google Analytics only after you choose “Accept analytics” in our cookie settings.

Information Collected

• First-party Google Analytics identifiers (including _ga and _ga_<stream-id>)
• Page categories, referral source, approximate location, browser, device, and session information
• Selected product events, such as sign-in, project creation, media upload completion, split generation, and export progress
• An internal Firebase user ID while you are signed in, so activity can be understood across sessions and devices

We do not send names, email addresses, filenames, project IDs, prompts, uploaded content, or typed text to Google Analytics.

Advertising storage, advertising user data, and advertising personalization remain disabled. Google processes analytics data as our analytics service provider.

Your Choice and Retention

Google Analytics cookies expire according to our Google tag settings and browser limits, with a default lifetime of up to two years. Google Analytics Standard supports user-level and event-level retention for up to 14 months; aggregated reports may remain available for longer.

You can reject analytics or withdraw consent at any time through the Cookie settings control. Withdrawing consent stops future analytics collection and removes Google Analytics cookies accessible from this site on that browser.

We do not sell your personal data. We share it only as needed to run the Service, with these service providers, which process it on our behalf under data-processing terms:

• Hostinger: the servers in Germany that run the Service and its database
• Google: sign-in and some app data (Firebase), file storage in Belgium (Cloud Storage), which also receives uploads directly from your browser, database backups, video and audio understanding (Gemini API), servers in the United States that fetch media from links you import, error reporting, and, with your consent, Google Analytics
• RunPod: GPU processing for exports, reframing and previews
• OpenAI: text generation features
• Anthropic: the Agent
• ElevenLabs: speech transcription
• TypeSafe: classifying transcript text to remove filler words and to split captions
• Replicate: image and video generation, including storyboard pictures and video in Birdhouse
• Stripe: payments, invoices and tax calculation

When you import from a link, we contact the source provider (such as YouTube, Twitch, Google Drive or Dropbox) with the link and any access parameters you supplied. When you publish, the selected content and post details go to the destination platform you chose. Those platforms process data under their own privacy policies.

We may also disclose data to authorities where the law requires it, and to a buyer or successor if our business is reorganised or sold, in which case this Privacy Policy continues to apply to your data.

IMABIRD uses YouTube API Services. Connecting a YouTube channel is optional and is used only to publish videos you choose. When you connect, you also agree to the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy.

What We Access

• View your YouTube account: your channel ID, name, description, custom URL, profile picture, channel link and subscriber count, so we can show which channel is connected.
• Manage your YouTube videos: we upload only the videos you choose to publish, with the title, description, tags, privacy setting, made-for-kids setting and subscriber notification setting you choose.
• We do not read, edit or delete your other videos, and we do not read your comments or messages or import video from your channel.

How We Store and Share It

• Your Google access and refresh tokens and channel details are stored encrypted on our servers and used only to show your connection and to publish what you ask us to publish.
• Channel details are refreshed from YouTube each time you open your connections.
• For each publish, we keep the job record, including the link to the resulting YouTube video, so you can see what was published.
• We do not sell YouTube data, use it for advertising, or use it to train AI models. We share it only with the infrastructure providers that host the Service, or where the law requires.
• IMABIRD's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and Revoking Access

Disconnecting YouTube in your IMABIRD profile deletes the stored tokens and channel details immediately. You can also revoke IMABIRD's access at any time in your Google Account security settings; IMABIRD then deletes the stored connection the next time it tries to use it. To delete publishing records or your account, contact us (see Section 14).

Connecting an Instagram professional account (Business or Creator) is optional and is used only to publish videos you choose. Meta processes your data under the Instagram Privacy Policy.

What We Access

• Your Instagram user ID, username, name, profile picture and follower count, so we can show which account is connected.
• Publishing: we publish only the videos you choose, with the caption you write. Instagram fetches each video from a temporary, signed link on our servers, and we read back the link to the published post.
• We do not read your other posts, comments, messages or insights.

How We Store and Share It

• Your Instagram access token and account details are stored encrypted on our servers and used only to show your connection and to publish what you ask us to publish.
• For each publish, we keep the job record, including the link to the resulting Instagram post, so you can see what was published.
• We do not sell Instagram data, use it for advertising, or use it to train AI models. We share it only with the infrastructure providers that host the Service, or where the law requires.

Disconnecting and Deleting Your Data

Disconnecting Instagram in your IMABIRD profile deletes the stored token and account details immediately. You can also remove IMABIRD under Settings, Apps and websites in Instagram. To delete publishing records or your account, email hello@imabird.productions (see Section 14); we delete the data within 30 days and confirm by email.

Twitch and other accounts you connect work the same way: we store the account identifier and name and the access tokens needed for the actions you request. Disconnecting an account in your IMABIRD profile deletes those tokens, and you can also remove IMABIRD’s access in the platform’s own settings.

To have other data from a connected account deleted, email hello@imabird.productions.

We run the Service in the EU: our servers are in Germany and your files are stored in Belgium. Some of our service providers, including Google, RunPod, OpenAI, Anthropic, ElevenLabs, TypeSafe, Replicate and Stripe, process data in the United States or other countries outside the EU/EEA.

Where they do, we rely on the EU-U.S. Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

• Account data: while your account exists. When you ask us to delete your account, we delete it and your content within 30 days, except as described below.
• Your content and projects, including uploads, imports, cuts, exports, transcripts, analysis and Agent conversations: until you delete them or your account is deleted.
• Temporary files: upload files are deleted within 2 days, and download files are removed after the import attempt.
• Connected-account tokens: until you disconnect the account or your account is deleted.
• Payment and invoice records: five years from the end of the financial year they relate to, as Danish bookkeeping law requires.
• Server logs and error reports: normally no longer than 30 days.
• Database backups: deleted data can remain in backups for up to 30 days before they are overwritten.
• Analytics data: as described in section 6.

An imported file is a separate stored copy. Deleting the original or changing its sharing permissions at the source does not automatically delete the copy held by IMABIRD or a post already sent to another platform.

We protect data with measures including encryption in transit (HTTPS), encrypted storage at our cloud providers, access limited to the people who operate the Service, and monitoring.

No system is completely secure. If a breach of your personal data is likely to result in a high risk to you, we will tell you without undue delay.

Under the GDPR, you have the right to:

• Access your data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing before you withdrew it

To exercise your rights or to delete your account, email hello@imabird.productions from the address on your account. We answer within one month.

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the data protection authority where you live or work.

The Service is not intended for children under 13, or under the higher minimum age that applies in your country. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Privacy Policy. We will post the new version here with a new effective date and, for material changes, tell you in the Service or by email before they take effect.

i am a ApS (IMABIRD ApS), CVR 46829336, Lunekrogen 4, 9200 Aalborg SV, Denmark

hello@imabird.productions