Privacy policy
Last updated: October 2026 (replaces the version of 19 September 2024)
1. Data controller
The controller for this website and the Canva app "Video Captions by Capiii" is:
Kevin Michael Schindler, Lindenstrasse 8, 73035 Göppingen, Germany
Email: [email protected] · Phone: +49 1525 2053309
We take care of your personal data and only process as much as is necessary to run the website and the app.
2. Visiting this website
Hosting by Cloudflare
This website is served via Cloudflare Pages by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary connection data (e.g. IP address, date and time, page requested, browser information) to deliver the website and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Cloudflare is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses also apply.
No cookies, no tracking
This website sets no cookies, uses no analytics, advertising or tracking services and loads no fonts or content from third parties. Fonts are served locally.
Contacting us by email
If you email us, we process your email address and message to answer your request (Art. 6(1)(b) GDPR for questions about a purchase, otherwise Art. 6(1)(f)). We delete the data once your request is resolved, unless statutory retention obligations apply.
3. The Canva app "Video Captions by Capiii"
Capiii runs as an app inside Canva. Canva's own privacy policy applies to your use of Canva. When you use Capiii, we process:
- User identifier: the Canva user ID provided by Canva, to identify your Capiii account. From it we create a pseudonymous identifier (SHA-256 hash) used to match purchases to your account.
- Account data: your minute balance, your saved caption settings (font, colours, position) and the account creation date.
- Video and audio data: the video you want to caption and the audio track extracted from it, to generate captions and add the captioned video back to your design.
- Payment data: when you buy minutes, the data you enter at Stripe (e.g. email address, payment method). We only receive the purchase confirmation and the pseudonymous identifier from Stripe, not your full payment details.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and, for accounting, Art. 6(1)(c) GDPR (statutory retention obligations).
4. Service providers
- Amazon Web Services (AWS), Amazon Web Services EMEA SARL, Luxembourg / Amazon Web Services, Inc., USA: processing and temporary storage of videos (server functions, storage, WebSocket connection). Processing takes place in an AWS data centre in the USA (region us-west-1). Uploaded video and audio files are deleted after processing; leftover files are additionally removed automatically after one day at the latest.
- OpenAI, OpenAI Ireland Ltd. / OpenAI, L.L.C., USA: transcription of the audio track via the Whisper API. OpenAI only receives the audio file.
- Google Firebase (Cloud Firestore), Google Ireland Ltd. / Google LLC, USA: storage of your Capiii account (identifier, balance, settings) and authentication.
- Stripe, Stripe Payments Europe, Ltd., Ireland: payment processing. Stripe is an independent controller for certain data; Stripe's privacy policy also applies.
5. Transfers outside the EU
Some of these providers process data in the USA. Transfers are based on the EU-US Data Privacy Framework (where the provider is certified) and/or the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
6. Retention
Videos and audio tracks are only stored for the duration of processing (see above). Account data is kept as long as you use Capiii; we delete your account on request. Purchase records are kept for the statutory periods (up to 10 years under German tax and commercial law).
7. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). No automated decision-making within the meaning of Art. 22 GDPR takes place. Just email [email protected].
You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
8. Information security
We protect your data with appropriate technical and organisational measures, including encrypted transmission (TLS) and access restrictions. However, no data transmission over the internet can be guaranteed to be fully secure.
9. Links to other websites
This website links to other websites, such as Canva. Their operators are responsible for their privacy practices.
10. Legal disclosure
We only disclose data where required by law, e.g. by order of an authority or court, or where necessary to protect our rights or investigate fraud.
In case of doubt, the German version of this policy prevails.