Privacy
Policy.

We collect the minimum personal data needed to deliver our services. In practice, this means:

• ●
  Contact form submissions

  Name, work email, company, role, YouTube channel URL, and any free-text message you provide. You give us this data voluntarily when you reach out to us.

• ●
  Email correspondence

  If you email us or we email you, we retain those messages and any contact details they contain.

• ●
  Customer engagement data

  Once you become a customer, we hold the information needed to deliver and bill for the service: contracts, invoices, payment records, campaign briefs, and reporting outputs.

• ●
  Website analytics

  Basic, privacy-respecting analytics on website traffic (which pages get visited, roughly where visitors come from). We do not use third-party tracking pixels or cross-site advertising trackers.

• ●
  Server logs

  Standard technical logs from our hosting provider (IP addresses, request timestamps, browser type). These are retained briefly for security and debugging.

We do not collect special-category personal data (health, race, religion, political opinions, etc.) and we do not knowingly collect data about anyone under 18.

We use personal data for the following purposes, each with a legal basis under GDPR:

• ●
  To respond to your inquiry

  When you submit our contact form or email us, we use your data to reply and discuss whether we can help. Legal basis: legitimate interest (responding to your request).

• ●
  To deliver the service

  If you become a customer, we use your data to run campaigns, send reports, and invoice you. Legal basis: performance of a contract.

• ●
  To meet legal obligations

  We retain certain records (invoices, contracts, tax records) for as long as required by Swedish and EU law. Legal basis: legal obligation.

• ●
  To improve our services

  We may analyze aggregated, non-identifying patterns to improve how we work. Legal basis: legitimate interest.

We do not sell, rent, or trade your personal data. We do not use it for unrelated marketing without explicit consent.

We share data only with the third-party services we need to operate. These "subprocessors" are vetted for their security and data protection practices. The main ones:

• ●
  Google (YouTube Ads)

  Campaign delivery and targeting platform. We may share customer-supplied audience data (such as email lists for lookalike audiences) for the purpose of campaign execution, where contractually permitted and lawful.

• ●
  Resend

  Email delivery for transactional messages (such as the email we send when you submit our contact form).

• ●
  Vercel

  Hosting infrastructure for our website. Standard server logs pass through Vercel.

• ●
  Banking and accounting providers

  Used for invoicing, payments, and required financial record-keeping.

We may also disclose data when required by law, court order, or to protect the safety, rights, or property of Videolifter, our customers, or the public.

Some of our subprocessors are located outside the European Economic Area, including in the United States (notably Google and Vercel). Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or equivalent safeguards as required by GDPR.

We keep personal data only as long as needed for the purposes described above. In practice:

• ●
  Contact form submissions and prospect data

  Up to 24 months from last contact, unless you ask us to delete it sooner.

• ●
  Customer records

  For the duration of the engagement plus a retention period required by Swedish accounting and tax law (currently 7 years for financial records).

• ●
  Email correspondence

  For as long as it's needed to maintain the working relationship, or to comply with legal obligations.

• ●
  Server logs and analytics

  Short-term retention only (typically 30–90 days), in aggregated or pseudonymized form.

Under GDPR, you have the following rights over your personal data:

• ●
  Access

  You can ask for a copy of the personal data we hold about you.

• ●
  Correction

  If something we hold is wrong or out of date, you can ask us to fix it.

• ●
  Deletion

  You can ask us to delete your data, subject to any legal obligations we have to retain it (such as accounting records).

• ●
  Restriction

  You can ask us to limit how we use your data in certain circumstances.

• ●
  Portability

  You can ask for a copy of your data in a structured, machine-readable format, and to have it transferred to another controller where technically feasible.

• ●
  Objection

  You can object to our processing your data on the basis of legitimate interest. Where you object, we will stop processing unless we have compelling grounds that override your objection.

• ●
  Complaint

  You have the right to lodge a complaint with the Swedish data protection authority (Integritetsskyddsmyndigheten / IMY) or your local EU data protection authority.

To exercise any of these rights, email privacy@videolifter.com. We will respond within one month (extendable to three months for complex requests, in which case we'll let you know).

Our website uses minimal cookies. We do not use advertising cookies, retargeting pixels, or cross-site tracking. We do not need to display a consent banner because we do not store non-essential cookies on first load.

If we add analytics or other tracking in the future that requires consent, we will display a clear, granular consent banner before any non-essential cookies are set.

We take reasonable technical and organizational measures to protect personal data from loss, misuse, unauthorized access, and disclosure. These include encryption in transit (HTTPS everywhere), encryption at rest where our subprocessors support it, access controls limiting who on our team can see customer data, and regular reviews of our practices.

No system is perfectly secure, and we can't guarantee absolute protection. If we ever become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected individuals where required by law.

Our services are designed for businesses and their employees. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, contact us at privacy@videolifter.com and we will delete it.

We may update this Privacy Policy from time to time. The most recent version is always at videolifter.com/privacy, with a "last updated" date at the top.

Material changes will be communicated to active customers by email at least 14 days before they take effect. Minor changes (clarifications, formatting) may be made without notice.

General questions: hello@videolifter.com

Privacy or data rights requests: privacy@videolifter.com

We'll respond within one business day for general questions, and within the timeframes required by GDPR for formal data rights requests.