WaffleFramePrivacy Policy
Who we are
WaffleFrame is operated by Fundamental Branding, based in Belgium. Fundamental Branding is the data controller for the personal data described in this notice, which means we decide why and how it is processed.
Your files stay on your device
WaffleFrame processes your video, audio and image files entirely inside your web browser. Your files are never uploaded, transmitted or stored on any server we operate.
What we collect and why
- Account data (email address, login credentials or Google sign-in identifier): to create and secure your account. Legal basis: performance of a contract.
- Credit and usage data (credit balance, number of exports per day, purchase history): to provide 5 free daily exports and keep your paid credits. Legal basis: performance of a contract.
- Technical data (IP address, browser and device information, error logs): for security, fraud prevention and fixing problems. Legal basis: legitimate interests.
- Support messages you send us: to answer you. Legal basis: legitimate interests.
- Analytics and ad cookies: only if you accept them. Legal basis: consent, which you can withdraw at any time.
Who we share data with
- Paddle.com, our Merchant of Record, which sells the credit packs, processes payments, handles tax and invoicing. Paddle receives the data needed for your order. We never see or store your card details.
- Service providers that host our website, accounts database and login system.
- Public CDNs (jsDelivr, Google Fonts) that deliver the processing engine and fonts and may log standard request data like your IP address.
- Professional advisers (legal, accounting) where needed, and authorities when required by law.
International transfers
Some providers may process data outside the EEA. Where that happens, we rely on adequacy decisions or Standard Contractual Clauses to protect your data.
How long we keep it
Account, credit and usage data is kept while your account exists. When you delete your account it is deleted or anonymised within 30 days, except purchase records we must keep for legal and tax reasons (up to 7 years). Technical logs are kept for up to 90 days.
Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), encrypted storage, and strict access controls so each user can only read their own account data.
Cookies and local storage
Essential storage keeps you logged in and remembers your settings and theme. Analytics and ad cookies are only used if you accept them in the cookie banner, and you can change your choice at any time.
Your rights
Under the GDPR you have the right to access, correct, delete, restrict or port your data, to object to processing, and to withdraw consent at any time. We respond within one month. You also have the right to complain to a supervisory authority, such as the Belgian Data Protection Authority (dataprotectionauthority.be).