Privacy Policy

Who we are

SendRec is an async video messaging platform operated from the European Union. The data controller is Neamtu Alexandru PFA, Bucharest, Romania — see our imprint for full company details. This policy covers the SendRec platform (app.sendrec.eu) and the sendrec.eu website.

What data we collect

If you have an account

When you create an account, we collect your name, email address, and password (stored as a bcrypt hash). When you record and upload videos, we store the video files and associated metadata (title, duration, timestamps). If you subscribe to a paid plan, we store a subscription and customer reference from our payment provider — we never see or store your card details.

If you watch a shared video

You do not need an account to watch a video someone shares with you, but we do record information about the view so the sender can see their analytics: browser and device type, a category of referrer (for example "Email" or "Slack" rather than the full URL), which parts of the video were watched, and any comments or reactions you leave.

We also store a viewer identifier derived by hashing your IP address together with your browser's user agent. This lets the sender distinguish one viewer from another without us keeping your IP address in the analytics record. It is a pseudonym rather than anonymous data, and we treat it as personal data.

If the sender turns on the email gate for a video, we store the email address you enter before watching and show it to the sender.

Server logs

Our servers write a request log that includes the IP address of each request, for security, abuse prevention, and debugging. These logs are separate from the analytics described above.

Newsletter

If you subscribe to our newsletter, we collect your email address only.

How we store your data

Account data is stored in a PostgreSQL database on a server we rent from Hetzner Online GmbH, a German company, in their Helsinki region in Finland. Video files sit in S3-compatible object storage on the same machine. Mailing lists are managed in our own Listmonk instance, which also runs there. Your videos, account data and analytics are stored in the European Union.

We do not sell your data, and we do not share it with advertisers or data brokers. The processors we do rely on are listed below.

Processors we share data with

To run the service we rely on the following providers. Each receives only what it needs for its specific purpose. The full list, with where each one sits, is on our sub-processors page, and the terms we hold them to are in our data processing agreement.

Creem — payment processing for paid plans. Creem acts as merchant of record and receives the information needed to take payment, along with an identifier for your account or workspace so we can apply your subscription. If you only use the free plan, no data reaches Creem. See Creem's privacy policy.

Transcription — on app.sendrec.eu your recording is transcribed automatically after upload. This runs on our own EU servers using whisper.cpp. The audio is never sent anywhere else.

Mistral AI — summaries, chapters and title suggestions. Once a recording has been transcribed, the text of that transcript is sent to Mistral AI, a French company, to generate them. This happens for every transcribed recording on app.sendrec.eu, and it is the transcript text that is sent, never the audio or the video. We use Mistral's European endpoint, so the transcript is processed in the European Union. Mistral may route it through its own sub-processors under the safeguards its terms describe. See Mistral's privacy policy. If you run SendRec yourself, this feature is off unless you turn it on.

Brevo — email delivery. Running our own Listmonk decides how mail is composed, not who carries it: the messages themselves are relayed by Brevo, operated by Sendinblue SAS in France, which receives the recipient's address and the contents of the message. That covers sign-up confirmations, view and comment notifications, workspace invitations and the newsletter. Brevo hosts within the European Union. See Brevo's privacy policy.

Cloudflare — our domain and our inbox. Cloudflare answers DNS queries for sendrec.eu and routes mail sent to our @sendrec.eu addresses, so a message you send us passes through it. It is a United States company, and it is the one provider here outside the EU. It is not in the path of your videos or your account data: we do not proxy traffic through Cloudflare, and both sendrec.eu and app.sendrec.eu resolve straight to the server above. See Cloudflare's privacy policy.

Optional integrations you configure — if you connect Slack, a webhook, Jira, GitHub, or a single sign-on provider, data flows to that service because you asked it to. Those services act under their own privacy policies, not ours.

Analytics

We use Umami, a privacy-friendly, cookie-free, open-source analytics tool. We self-host Umami on the same Hetzner server as the rest of SendRec. No personal data is collected. No cookies are set. No data is shared with third parties. Umami is fully GDPR compliant without requiring a cookie banner.

Cookies

The sendrec.eu website does not use cookies. The SendRec application (app.sendrec.eu) uses a strictly necessary HttpOnly cookie to maintain your login session. This cookie is not used for tracking and does not require consent under GDPR.

External resources on this website

This website does not load any external fonts, CDN scripts, tracking pixels, or third-party resources. All assets (fonts, images, scripts) are served from sendrec.eu.

Your rights

Under the GDPR, you have the right to access, correct, or delete your personal data, to object to or restrict processing, and to receive your data in a portable format. To exercise any of these rights, email us at privacy@sendrec.eu. We will respond within 30 days.

These rights apply whether or not you have an account. If you watched a shared video and want the view records associated with you removed, contact us at the same address.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), and you may also complain to the authority where you live.

Data retention

Account data and videos are retained for as long as your account is active. You can delete individual videos at any time. Account holders can also set an automatic retention period, after which videos are deleted for them automatically.

View records, including the viewer identifier and any email-gate address, are kept for as long as the video they belong to. Deleting a video deletes its analytics. Server request logs are kept on a short rolling window for security and debugging.

Newsletter subscribers can unsubscribe via the link in any email, and their data will be deleted within 30 days.

Changes to this policy

We may update this policy as our product develops. Material changes will be communicated via email. The "last updated" date at the top reflects the most recent revision.

Contact

For privacy-related questions, contact privacy@sendrec.eu.