Privacy policy

1. Who is responsible

LogicBoostKit Media is operated by Bacosca Iulian PFA (the “Controller”), a sole trader (persoană fizică autorizată) established in Romania (EU). LogicBoostKit is its brand. The Controller decides how the personal data described here is used:

• Bacosca Iulian PFA
• Trade Register no.: F40/4818/2022
• Sole registration code (CUI): 46937352
• Registered office: Str. Ion Câmpineanu nr. 24, Sector 1, Municipiul București, Romania
• Contact: contact [at] logicboostkit [dot] com

2. Visiting the public pages

The public pages set no cookies and load nothing from other sites. There are no analytics, no advertising networks, no trackers, and no third-party scripts or fonts. Typefaces are served from our own origin.

The pages are delivered by Cloudflare, which necessarily processes your IP address, request metadata and TLS connection details in order to route and secure the request.

The sign-up and sign-in pages are the one exception. They load the sign-in form from Clerk, our sign-in provider. Clerk may run a bot check when you sign up (Cloudflare Turnstile), and sets the cookies that keep you signed in.

3. Your account and sign-in

Sign-in is handled by Clerk. Clerk holds your email address, your name if you give it, your sign-in credentials and your sessions, including session details such as device and IP address. We never see your password.

We keep your account’s name and id, when it was created, its status, how it is billed, and which sign-ins belong to it. The console shows the people in an account to each other by name and email address.

4. Payments

Card purchases are made through Link, Stripe’s merchant-of-record service, which sells to you on our behalf. Link holds your card details, the billing name, address and tax id you give it, your order history and your invoices, and is responsible for that data as an independent controller under its own privacy policy. We never see or store card numbers.

We keep the ids that link your account to its Stripe customer and subscription. For each charged request we send Stripe its GB-seconds, its request id and the time it completed, so that Stripe can prepare your invoice.

5. API keys

A key’s secret is shown once and stored only as a SHA-256 hash, so we cannot show it again. We keep the key’s name, its first characters, its id, and when it was created, last used, set to expire or revoked.

6. Your files and tasks

The service keeps what you send only as long as it takes to do the work.

• Files. File contents live only in storage and on the job’s machine while it runs. A directory and its files are deleted when its TTL expires (24 hours by default, 7 days at most; a sweep runs every 5 minutes) or when you delete them. The job machine’s disk is erased when the job ends.
• Tasks. A job’s task and webhook URL are kept until the job ends and its webhook is delivered or given up (up to 6 attempts over about 2 hours). File names go when their directory does.
• Billing lines. After that, only one billing line per charged request remains: request id, account, key id, completion time, machine size and seconds, bytes in and out, GB-seconds, the amount charged, and our own cost of running the request. A billing line never holds a file name, path, URL, option, filter, webhook URL or error text. Billing lines are kept 24 months, then deleted.
• Logs. Our logs hold the request id, account and key ids, the method and route, the status, sizes, durations and the class of any error. They never hold a file name, URL, FFmpeg option, filter or webhook body.

The files you process may contain personal data about other people. You decide what to send and why. We process it only to run the task you asked for, and delete it as described above. If your use of the service needs a data processing agreement, write to privacy [at] logicboostkit [dot] com.

7. When you write to us

If you write to privacy [at] logicboostkit [dot] com, we process your email address, your name if you give it, and what you put in the message, in order to reply and to resolve what you raised. Messages are held by our email provider, Microsoft (Outlook).

8. Lawful basis

• Your account, your requests and billing: performance of a contract (GDPR Art. 6(1)(b)).
• Invoices and accounting records: a legal obligation (Art. 6(1)(c)).
• Security, stability and preventing abuse: our legitimate interest in keeping the service available and safe (Art. 6(1)(f)).

9. Processors

We keep this list short on purpose. Each provider has its own privacy policy and data-protection terms.

• Cloudflare: hosting, storage and compute. It delivers the pages and the API, stores your files while they exist, runs your jobs, and holds our database and logs. It processes request metadata, including IP addresses.
• Clerk: sign-in. It holds email addresses, names, sign-in credentials and sessions.
• Microsoft: email (Outlook). It holds the messages you send to us and our replies.
• Stripe: payments and invoices, and through Link the sale of card purchases as merchant of record. It holds card details, billing details, invoices and payment history, and the usage figures we send it.

No personal data is sold, and none is shared with advertisers.

10. International transfers

Cloudflare, Clerk and Stripe are headquartered in the United States and operate globally. Where personal data leaves the European Economic Area to reach them, the transfer is covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, under each provider’s data-protection terms.

11. How long we keep it

• Files, tasks and billing lines: as section 6 says.
• Your account, its people and its keys: while the account is open. Closing an account revokes every key, deletes every file and directory, and deletes the sign-in of everyone in it. The account’s name and id and its billing lines remain, the billing lines for 24 months.
• Invoices and payment records: for as long as tax and accounting law requires.
• Logs: retained by Cloudflare under its own retention schedule.
• Correspondence: for as long as needed to handle what you raised.

12. Cookies

The public pages set no cookies. Signing in sets the cookies Clerk needs to keep you signed in and to protect sign-up from bots. The console uses only what signing in and protecting its forms require. There are no analytics or advertising cookies, so there is no consent banner.

13. Your rights

Under the GDPR you have the right to access, correct, delete, export, restrict or object to the processing of your personal data. You may also lodge a complaint with a supervisory authority, such as the National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania, where the Controller is established.

To exercise any of these rights, write to privacy [at] logicboostkit [dot] com from the email address on your account. We respond within 30 days.

14. Security

Traffic to the service is HTTPS-only. API keys are stored as hashes. Upload and download links are signed and expire after 5 minutes; links to a job’s results expire after 1 hour. Each job runs on its own machine, whose disk is erased when the job ends. We disclose any confirmed personal-data breach to affected people without undue delay.

15. Children

The service is a business service and is not directed at people under 16. We do not knowingly process children’s data.

16. Changes

Material changes will be posted on this page with a new date. If a change materially affects how we handle your data, we tell account holders by email before it takes effect.

17. Contact

Privacy questions, rights requests and breach reports all go to privacy [at] logicboostkit [dot] com.