Privacy Policy

1. Controller

2. Scope of this demo

Videoflix is a non-commercial portfolio demonstration of a video platform. This policy explains how personal data is processed when you visit the site, create an account, sign in, use the guest demo or request an account activation or password reset.

3. Data we process

• Account data: email address, password hash, activation and account status.
• Authentication data: short-lived access and refresh tokens in HttpOnly cookies and a readable CSRF cookie used to protect form submissions.
• Communication data: email address and technical delivery information when an activation or password-reset email is requested.
• Technical data: IP address, date and time, requested path, browser information, response status and error information in server and security logs.

The guest demo does not require you to provide an email address. Videoflix does not use advertising, analytics, profiling or non-essential tracking cookies.

4. Purposes and legal bases

Account and authentication data is processed to provide the requested demo functions and account workflows (Article 6(1)(b) GDPR). Technical logs and security controls are processed for the legitimate interests of operating a stable service, preventing misuse and diagnosing errors (Article 6(1)(f) GDPR). Where processing is required by law, Article 6(1)(c) GDPR applies.

5. Cookies and local browser storage

The application uses only cookies that are necessary for login and request protection. Access and refresh tokens are stored as HttpOnly cookies and cannot be read by regular page scripts. The CSRF cookie is readable so the browser can send its value with protected requests. A temporarily entered registration email may be stored locally in your browser until registration is opened or browser storage is cleared.

6. Hosting, email delivery and recipients

The planned production deployment uses Google Cloud Compute Engine in the Frankfurt region (europe-west3). Google Cloud EMEA Limited acts as a service provider under its data processing terms. Technical support and subprocessors may involve processing outside the European Economic Area subject to the safeguards described by the provider.

Account emails are delivered through ALL-INKL.COM – Neue Medien Münnich. This provider receives the recipient address and message delivery data. Data may also be disclosed where required by law. Personal data is not sold.

7. Retention

• Account data is retained while the account is active and deleted when it is no longer required or after a valid deletion request, unless a legal duty requires longer retention.
• Access tokens expire after 30 minutes and refresh tokens after 24 hours. Activation and password reset links expire after one hour.
• Container logs are rotated by size (up to three files of 10 MB per container). Their actual time span depends on traffic.
• Production backups are retained for no more than seven days and are then deleted or overwritten.

8. Your rights

Subject to the applicable conditions, you may request access, correction, deletion, restriction, data portability and object to processing based on legitimate interests. You may also lodge a complaint with a data protection authority. In North Rhine-Westphalia, the competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

Send privacy requests to contact@dennis-dumin.net. You can also use the LDI NRW complaint form.

9. Security and automated decisions

The application uses encrypted HTTPS transport in production, protected authentication cookies, CSRF protection, restricted guest permissions and rate limiting. No automated decision-making or profiling with legal or similarly significant effects takes place.

10. Changes to this policy

This policy will be updated when the hosting, email delivery, retention rules or application functions change. The date at the top identifies the current version.