Privacy Policy

Who we are

Clip Critic Studio is a service operated by UNIHOLIX OÜ, a private limited company registered in Estonia (registry code 17479878), Sepapaja tn 6, 11415 Tallinn, Estonia. We are the controller of the personal data described in this policy. Contact: ceo@uniholix.com.

What we process and why

In short: your videos are opened in your browser and are never uploaded. When you use a critique, only eight reduced still frames of that video and your optional notes are sent to us to write it, and we do not keep them or the critiques.

• Your videos. You add short videos from your device. Your browser opens them, runs the free check (shape, resolution, length, black screen, frozen picture and black bars) and takes eight still frames from each video. The video files never leave your device.
• The frames and your notes. When you use a critique, your browser sends our server eight still frames of that video, reduced in size, their times in the video, the video's size and length, and the optional notes you gave: where you will post, what the videos are for, your brand notes and one brand reference image. Our server passes them to our AI model provider to write the critique, one video at a time. We do not keep the frames, the notes or the critiques after they have been produced. Your pack's payment record keeps short one-way fingerprints of the last few videos critiqued with it, so that the same video sent again within a day is not counted twice. They cannot be turned back into the frames.
• People in your videos. If your videos show people, the frames may contain their image. The critique looks at the video, not at who is in it: we do not try to recognise or identify anyone, and we do not create any biometric template or profile of a person.
• Payment data. Our payment processor handles your payment. We receive your email address, your country, the amount, the currency, the pack you bought and the payment status, together with your confirmation that you asked for immediate delivery. The payment record also keeps how many of the pack's critiques you have used, and a one-way fingerprint of your pack code, never the code itself. Your card details go only to the payment processor and never reach us.
• Your UNIHOLIX account and Critic Pass Monthly. Only Critic Pass Monthly needs an account. We keep your email address (and the name an outside sign-in shares with us), your customer identifier at our payment processor, your subscription's status, price and renewal date, and how many critiques you used in each paid month, with nothing of what you sent.
• Emails to us. If you write to us, we use your email address and your message to answer you.
• Technical data. Our server uses your IP address for a short time to limit the number of requests and to keep the service secure. Our hosting provider keeps standard request logs, such as the IP address, the time and the page requested. These logs do not contain your videos, frames or notes.
• Data on your device. While you pay, the page keeps your videos' frames, the free check, their file names and your notes in your browser's storage, so that they are still there when you come back from the payment page. It removes them once your critiques are delivered, when you start over, or after 24 hours if you do not come back. It also keeps your last critiques, with the file names and the free check, your pack codes with how many critiques they have left, and your language in your browser's local storage. This data stays on your device. You can delete it at any time in your browser settings.
• No tracking. We do not use analytics or advertising cookies, and we do not use any analytics or advertising trackers.

Add only videos you may share. Videos can show other people, documents, screens, number plates or unreleased material. Add only videos you made or have the right to use, and leave out other people's personal data and confidential material. Before you pay, the page shows you the frames that would be sent.

If the frames or notes contain personal data about other people, such as people who appear in your videos, you decide why and how it is processed. We then process it only on your behalf and on your instructions, to produce your critiques, as a processor under GDPR Art. 28. Business customers who need a data processing agreement can write to ceo@uniholix.com.

Your critiques are produced by AI for your own information. They can be wrong, and they are not professional advice. We do not use them to make any decision about you.

We do not sell your personal data, we do not use it for advertising, and we do not use your frames, notes or critiques to train AI models.

The service is for people aged 13 or older (or the higher minimum age in their country), people under 18 may use it only with the permission of a parent or guardian, and we do not knowingly process personal data of younger children.

Legal bases

• Contract (GDPR Art. 6(1)(b)): producing your critiques, running your account and your subscription, taking your payment and answering your questions about a purchase.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing fraud and abuse, and answering other messages.
• Legal obligations (Art. 6(1)(c)): keeping accounting records, including payment records, as Estonian law requires.

Who processes it for us

We use service providers that process personal data on our behalf and on our instructions. We describe them here by category.

• Payment processor: takes payments and emails your receipt. It also processes payment data as an independent controller for its own legal duties, such as fraud prevention, under its own privacy policy.
• AI model provider: produces your critiques from the frames and your notes. We use only a commercial service that does not use your data to train its models. It may keep inputs and results for a limited time to detect misuse, under its own terms.
• Hosting provider: runs the website and keeps request logs.
• Account and database provider: runs our sign-in and stores your account and subscription records.
• Email provider: receives and stores the emails you send us, and sends the confirmation when you withdraw from a subscription.

Some of these providers process data outside the European Economic Area, for example in the United States. Where they do, the transfer relies on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses.

How we protect it

All connections to the service and to our providers are encrypted. Access to our systems is limited to the people who need it and is protected by two-step sign-in. Card details are handled only by our payment processor.

How long we keep it

• Your videos: never received by us.
• The frames, your notes and the critiques: not kept. They are used only while your critiques are being produced.
• Payment records, including your pack's count, the fingerprints of the last videos critiqued with it and your confirmation of immediate delivery: 7 years, as the Estonian Accounting Act requires.
• Your account and subscription records: until you delete your account.
• Emails to us: as long as we need them to deal with your request, and no longer than 2 years after it is closed, unless they are part of accounting records.
• Request and security logs: up to 2 years. Data used to limit requests is held in memory only, for a few minutes.

Your rights

You can ask us to give you access to your personal data, to correct it or delete it, to restrict its processing or to stop processing it, and to give you a copy in a portable format.

To use these rights, email ceo@uniholix.com. We answer within one month. If a request is complex, we may need up to two more months, and we will tell you so within the first month. You can also delete your account yourself in your account page. Because we do not keep your frames, notes or critiques, we usually hold no personal data about you other than payment records, your account if you subscribed, and emails you sent us.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI, www.aki.ee) or to the data protection authority in the country where you live or work.

Additional notices for some regions

California. If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect, use and disclose, the right to have it deleted, the right to have it corrected, and the right not to be discriminated against for using these rights. We do not sell or share your personal information, as those terms are defined in that law. To use your rights, email ceo@uniholix.com.

United Kingdom. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you the rights described above. You can also complain to the Information Commissioner's Office (ICO).

Brazil. If you are in Brazil, the General Personal Data Protection Law (LGPD) gives you rights that include confirmation that we process your data, access, correction, anonymisation, blocking or deletion, portability, and information about who we share it with. To use these rights, email ceo@uniholix.com. You can also complain to the National Data Protection Authority (ANPD).

Republic of Korea. If you are in the Republic of Korea, the Personal Information Protection Act (PIPA) gives you the right to access your personal information and to ask us to correct it, delete it or stop processing it. To use these rights, email ceo@uniholix.com. Your personal information is processed outside Korea by the service providers described in this policy.

Changes

We may update this policy when the service or the law changes. The current version is always on this page. If a change significantly affects how we process your personal data, we will announce it on the service before it takes effect.