1. WHO WE ARE AND SCOPE
ReadyForm B.V. operates the ReadyForm website and video-editing app. Our contact address is Newtonlaan 115, 3584 BH Utrecht, the Netherlands, KVK 42123086. All legal, privacy, cookie, and security communications should be sent to legal@readyform.ai.
This Policy describes browser cookies, local storage, and similar technologies relevant to authentication, app product analytics and session replay, payment security, and website affiliate attribution. Read it with our Privacy Policy and Terms of Service. Processing customer footage for editing is separately described in the DPA; it is not the same activity as recording interactions with the app interface.
2. HOW THESE TECHNOLOGIES WORK
Cookies store small amounts of information in a browser. Local storage can retain identifiers or settings on a device, and session storage generally lasts for the browsing session. Tags and scripts can transmit activity information to a provider. These mechanisms can process personal data even if they do not include a name, and cookie rules can apply to similar device-storage/access technologies.
Session and persistent storage have different lifetimes. Deleting a browser cookie does not necessarily delete records already lawfully sent to a provider. Cookie expiry, product-event retention, replay retention, payment records, and affiliate commission records are separate matters.
3. NECESSARY SERVICE FUNCTIONS
Authentication and session storage support a requested login and access to the app. Supabase provides authentication and database services; identifiers may be stored in cookies or local storage according to the authentication flow. Necessary security state helps protect accounts and prevent abuse. The app also stores consent choices so it can apply those choices rather than ask on every interaction.
Stripe processes payments and supports the billing customer portal. A requested payment flow may use device identifiers for fraud prevention. Stripe documents __stripe_mid and __stripe_sid as fraud-prevention cookies with respective standard lifetimes of one year and thirty minutes. Those are provider descriptions of the payment integration, not a claim that all Stripe cookies occur on every ReadyForm page. Only storage genuinely necessary for the requested payment/security activity is treated as necessary; unrelated measurement or advertising requires the relevant consent.
Vercel hosts and delivers the website/app. Hetzner stores video files and RunPod performs GPU rendering, as explained in the DPA. The presence of an infrastructure provider does not itself mean that provider places tracking cookies in your browser. Anthropic receives transcript text and Pexels stock previews for the editing workflow, not customer video/audio, and its use as an AI provider is not itself browser advertising tracking.
4. POSTHOG APP ANALYTICS AND SESSION REPLAY
PostHog is used in the app for product analytics and session replay with consent. Product events describe navigation, feature use, and interactions. Session replay reconstructs interface state and actions such as clicks, scrolling, and navigation so usability and problems can be investigated. It does not mean the source video being edited is sent to PostHog as the session recording.
PostHog can use browser identifiers, cookies, and local/session storage. Its storage keys are generated for the deployed project and configuration. PostHog's cookie/local-storage mechanisms and the backend retention of events and recordings are distinct. Persistent identifiers last for the configured expiry or until deletion/reset; session storage ends with the browsing session. Specific current storage identifiers and retention information can be requested at legal@readyform.ai.
Analytics and session-replay processing require a meaningful informed choice. The app's consent controls let you refuse optional tracking and withdraw consent. Replay must not silently be presented as anonymous aggregate statistics. Consent should cover the replay purpose and the information involved.
Customer video/audio, transcript text, private project content, passwords, authentication tokens, and full payment details are not authorised inputs to routine analytics or replay. Screens, interface elements, and event payloads containing those data must be excluded or masked. This restriction also applies to error/support tooling; an available supplier feature is not permission to collect all information displayed in the editor.
5. FIRSTPROMOTER WEBSITE AFFILIATE ATTRIBUTION
FirstPromoter supports affiliate referral attribution and related conversion/commission administration. The _fprom_tid cookie records an attribution identifier associated with the referral journey. It is marketing/affiliate tracking, not necessary to provide a requested video edit, login, or payment merely because it helps calculate a commission.
The cookie's persistent lifetime depends on the attribution window selected for the affiliate campaign, subject to browser restrictions and earlier deletion. A referral/conversion record used for contractual or financial administration is not identical to the cookie and can have a separate lawful retention basis under the Privacy Policy. FirstPromoter does not need customer source footage or transcript text for affiliate attribution.
Prior marketing consent is required before loading consent-dependent affiliate tracking or setting its identifiers. Where a website consent mechanism is absent, that tracking must remain disabled. The app's analytics choice must not be treated as automatic permission for website marketing cookies. This Policy does not represent that the website currently offers a cookie banner or that accepting the Terms is affiliate-tracking consent.
6. CONSENT, REFUSAL, AND WITHDRAWAL
Consent-dependent tracking must remain inactive before a free, specific, informed, affirmative choice. Optional categories must not be preselected. Browsing, scrolling, inactivity, account registration, and acceptance of general Terms are not tracking consent. A refusal must be as straightforward as acceptance and must not remove access to the core paid editing service.
Use the app's consent/privacy controls to manage app analytics and replay. Withdrawing consent stops future processing that depends on that consent; it does not retrospectively invalidate processing lawfully carried out before withdrawal. Where website affiliate tracking is activated, an appropriate website choice and withdrawal control are required separately. Browser settings can additionally block or delete cookies and site storage. Contact legal@readyform.ai for help if available controls do not work; an email route does not replace a legally required effective consent/withdrawal mechanism.
Consent signals must also be respected for relevant events sent without persistent cookies or through a server. A technical change from a cookie to another identifier does not automatically remove consent or privacy obligations.
7. PROVIDERS, INTERNATIONAL PROCESSING, AND RETENTION
PostHog receives the consented app analytics/replay data. FirstPromoter receives relevant referral/attribution and conversion information. Stripe handles payment/security and billing information. Supabase and Vercel support authentication/database and app execution respectively. Necessary diagnostic and rate-limiting information is processed by Sentry and Upstash as explained in the Privacy Policy. These are distinct functions and are limited to the data needed for each purpose.
The configured primary Supabase project and Vercel application execution region are Frankfurt. This does not guarantee that every analytics, payment, affiliate, support, backup, or further-provider operation stays in Germany or the EEA. International processing is subject to applicable adequacy arrangements or other lawful safeguards, as described in the Privacy Policy and DPA.
Cookie lifetime does not establish the retention period for information already received by a provider. Product events/replays are limited to the relevant analytics purpose and configured retention, payment records to billing/legal requirements, and affiliate records to their attribution/administration purpose. Consent evidence and suppression records may be kept to demonstrate and honour choices. You may request information or exercise applicable privacy rights at legal@readyform.ai.
8. BROWSER CONTROLS, RIGHTS, AND CHANGES
Browsers generally allow you to block cookies and delete cookies/local storage. Removing authentication state can log you out, and deleting consent preferences can cause the app to ask again. Browser restrictions may shorten storage lifetime. These controls supplement the consent choices rather than prove permission for optional tracking.
Links to supplier sites are governed by their own notices. Embedded third-party content that triggers non-essential tracking requires the appropriate consent or informed activation. The use of stock content in an edited video does not itself constitute permission for third-party browser tracking.
Sections 16 and 22 of the Privacy Policy explain personal-data rights and complaints. You may contact legal@readyform.ai or lodge a complaint with the Autoriteit Persoonsgegevens or another competent supervisory authority. Material new purposes or recipients must be explained before activation and fresh consent obtained where necessary. This Policy is updated when the relevant technology or processing changes.