Privacy policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For all data protection questions, write to brickmagnusvip@gmail.com. We have not appointed a data protection officer because we are not required to. [TODO: confirm no DPO is required]

2. Overview of processing

The table gives a summary. The sections below explain each point in more detail. Legal bases refer to Art. 6(1) GDPR: (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interests.

3. Ordering and delivery

When you order a video, we process:

• your email address, so we can send the confirmation and the video;
• for a Quick Dance (€9): the dance you chose, the recipient’s name (up to 20 characters) and your optional message (up to 60 characters);
• for a Custom Dance (€24.99): your reference video, the prop, optional sign text (up to 40 characters) and an optional note (up to 300 characters);
• order number, date, price, tax and order status;
• the finished video.

Quick Dance videos are rendered automatically on our render server (see section 11). Custom Dance videos are made by hand by our team. We need this data to perform the contract (Art. 6(1)(b) GDPR). We keep order and invoice records for 10 years because Bulgarian accounting and tax law requires it (Accountancy Act, Закон за счетоводството; Art. 6(1)(c) GDPR).

Names and messages may contain personal data about the recipient. Please only enter what is needed for the video. We check texts against a list of blocked words. If a text is flagged, a person on our team reviews the order before it is made (Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse and protecting third parties).

Download links for finished videos work for 30 days. We delete finished videos 90 days after delivery. [TODO: confirm retention period for finished videos]

Shop orders (physical products)

When you buy a physical product, Stripe collects your name, shipping address and email on the payment page and passes them to us. We store them with the order (product, message, quantity, price, order status, tracking number) and use them to pack and ship your order by post, and to email you the confirmation and the shipping notice. The postal carrier receives your name and address. Legal basis: Art. 6(1)(b) GDPR (performing the contract). We keep order and invoice records for 10 years (Art. 6(1)(c) GDPR, Bulgarian Accountancy Act).

4. Reference video uploads

For a Custom Dance, you upload a reference video (MP4 or MOV, up to 60 seconds, up to 200 MB). Magnus recreates the movement. The person in your video never appears in the result. We use the video only to learn the dance for your order. We do not use it to identify anyone, we do not create biometric templates, and we do not use it to train AI models. [TODO: confirm reference videos are not used for AI training]

Before uploading, you must confirm: “I own this video or have permission to use it.” If other people can be seen in the video, you are responsible for making sure they agree to it being sent to us for this purpose.

If you appear in a reference video that someone else sent us, we process your image and movement based on our legitimate interest and the customer’s interest in the order (Art. 6(1)(f) GDPR). You can object at any time. Write to brickmagnusvip@gmail.com and we will delete the video.

Deletion:

• Reference videos are deleted 30 days after delivery.
• Uploads that are never attached to a paid order are deleted after 24 hours.
• If we decline an order, the reference video is deleted after the refund.

Uploads are stored in Supabase Storage in the EU (Frankfurt, Germany).

5. Payments (Stripe)

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When you pay, you enter your payment details directly with Stripe. We never see your full card number. Stripe also calculates VAT (Stripe Tax), which needs your country and, where required, your address.

Stripe processes payment data as its own controller, including for fraud prevention and to meet its legal obligations. Stripe’s privacy policy is at stripe.com/privacy. We receive the payment status, the amount, the tax data and a payment reference. Legal basis: Art. 6(1)(b) and (c) GDPR.

6. Transactional emails (Resend)

We send order confirmations, status updates, delivery emails, sign-in codes and consent confirmation emails through Resend (Plus Five Five, Inc., USA). Resend processes your email address and the content of the email on our behalf. These emails are part of the service, so you cannot unsubscribe from them (Art. 6(1)(b) GDPR). [TODO: verify Resend legal entity and data processing agreement]

7. Sign-up and the meme generator

Anyone can make a meme at /memes. The meme is created in your browser. To download it, you enter your email address. There is no password and no login. The data is stored in our database at Supabase, Inc. in the EU (Frankfurt, Germany).

What we store

• your email address;
• the consent text you agreed to, and the time you signed up;
• a counter of your free downloads (3 per email address), and which templates you downloaded;
• where you signed up (for example the pop-up or the meme page).

A cookie on your device remembers that you signed up, so you do not have to enter your email again. It is strictly necessary for the free downloads and is not used for tracking.

Weekly giveaway

Everyone on the Magnus email list takes part in the weekly “Win Magnus’s Duck” draw (see the giveaway rules). We use your email address to draw the winners at random and to contact the winners. Winners send us their name and shipping address, which we use only to send the prize and keep as long as tax law requires for our records. Legal basis: Art. 6(1)(b) GDPR (running the giveaway you take part in).

Free name video

If you ask for a free video, we store the name you typed with your sign-up, send it to our render server (section 11) to make the video, keep the video in our storage at Supabase (EU) and email you a download link (section 6). The name is checked against a list of blocked words. We keep the name and the video until you unsubscribe or ask us to delete them. Legal basis: Art. 6(1)(b) GDPR (you asked for the video).

Abuse prevention

• Meme text is checked against a list of blocked words before download. [TODO: confirm whether meme text is stored after the check]
• To limit signups (5 per hour per location), we store a salted hash of your IP address, never the address itself. The hash is deleted after 30 days.
• Signups from temporary (disposable) email domains are refused.

Legal basis: Art. 6(1)(b) GDPR for the free downloads; Art. 6(1)(f) GDPR for abuse prevention (our legitimate interest in keeping a free service fair and free of spam). We keep your sign-up until you unsubscribe or ask us to delete it.

8. Marketing emails

When you sign up, the form says: “By signing up, you agree that Magnus Brick can send you emails with news. You can unsubscribe any time.” By signing up you agree to this.

• What you receive: an email when the personal dance videos open, and after that occasional news and offers about Magnus Brick.
• Proof of consent: we store the exact consent text, the time and where you signed up.
• Resend Audience: your email address is added to a contact list (“Audience”) at Resend, which we use to send these emails.
• Withdrawal: every marketing email has an unsubscribe link. You can also write to brickmagnusvip@gmail.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Legal basis: your consent (Art. 6(1)(a) GDPR). After you withdraw, we remove you from the Audience and keep the consent record for 3 years to be able to prove it (Art. 6(1)(c) and (f) GDPR). [TODO: confirm retention of consent records]

9. Automation (n8n)

We may use the workflow tool n8n to connect our systems, for example to notify our team about new orders or orders that need review. Order events are sent to n8n via a webhook and may include the order number, product, status and email address. n8n runs [TODO: n8n host: self-hosted (where) or n8n Cloud (n8n GmbH, Berlin); delete this section if not used]. Legal basis: Art. 6(1)(b) and (f) GDPR.

10. Hosting and server logs (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes your IP address, browser type, requested pages and timestamps so the site can be delivered and protected against attacks. Logs are kept for [TODO: Vercel log retention]. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the website).

11. Render server (Railway)

Quick Dance videos are rendered on a server hosted by Railway Corporation, USA, running in the EU (Amsterdam, Netherlands). The server receives the chosen dance, the recipient’s name, your message and an order reference, and returns the finished video. It deletes its working files right after rendering. Legal basis: Art. 6(1)(b) GDPR.

12. Analytics

We use PostHog (PostHog, Inc., hosted in the EU in Frankfurt, Germany) to understand how many people visit and sign up, and where they come from. PostHog records which pages you visit, the link or website that brought you here (for example a TikTok link or a Google search), your approximate country and your browser type. When you sign up, we record that a sign-up happened and where it came from, but not your email address. PostHog runs without cookies and without storing anything on your device: it recognises a visit by a one-way hash of your IP address and browser that changes every day, and it does not keep your IP address. Session recording is switched off. Legal basis: Art. 6(1)(f) GDPR (understanding how the website is used and which promotion works).

We also count in our own database (Supabase, EU) visits, the steps of the order page, which version of the sign-up pop-up was shown and whether it was closed or led to a sign-up, together with the traffic source (for example “tiktok”). These counts contain no email address, no IP address and no identifier, so they cannot be linked to you. If you answer the quick questions from Magnus (how your day was, your rating and what you like about him, including anything you type yourself), we save those answers the same way: without your email or name. To show how many people are looking at a product right now, your browser tab sends a random number (kept only for that tab) every 20 seconds while the page is open; we count these numbers for one minute and delete them after a day. Your browser remembers when the pop-up was shown (on your device only) so that it does not appear again for two days. Legal basis: Art. 6(1)(f) GDPR (finding out which sign-up offer works best).

13. Cookies

We use no tracking or advertising cookies. We only set cookies that are strictly necessary:

• a cookie that remembers your sign-up, so your free memes work without entering your email again;
• an admin session cookie for our own team.

These cookies are needed to provide the service you asked for, so no consent is required (Art. 5(3) ePrivacy Directive, as implemented in Bulgarian law). That is why there is no cookie banner. Payment pages are provided by Stripe, which may set its own necessary cookies for fraud prevention.

14. Service providers and recipients

We use the following providers. Where they act on our behalf, we have data processing agreements with them (Art. 28 GDPR).

We also pass data to tax authorities, courts or our tax advisor where the law requires it. We do not sell your data.

15. Transfers outside the EU

Some providers are based in the USA or may access data from there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise, we use the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards by writing to us. [TODO: check each provider’s DPF certification and SCCs]

16. How long we keep data

• Orders and invoices: 10 years (Bulgarian Accountancy Act).
• Reference videos: 30 days after delivery.
• Uploads never attached to a paid order: 24 hours.
• Finished videos: download link valid 30 days; the file is deleted 90 days after delivery. [TODO: confirm 90 days]
• Accounts: until you ask us to delete them.
• Signup IP hashes: 30 days.
• Marketing consent records: while the consent is active, plus 3 years. [TODO: confirm 3 years]
• Server logs: [TODO: Vercel log retention].

If we need data longer to establish or defend legal claims, we keep it only for that purpose.

17. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR).

To use these rights, write to brickmagnusvip@gmail.com. We may ask you to confirm your identity.

You also have the right to complain to a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg. You can also complain to the authority in the EU country where you live or work.

18. No automated decision-making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The blocked-word check only routes an order to a person on our team. A human decides whether an order is declined.

19. Children

Our service is not intended for people under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, please contact us and we will delete it.

20. Changes to this policy

We update this policy when our service or the law changes. The current version is always on this page, with the date of the last update at the top. See also our terms and Impressum.