Privacy policy
1. Who is responsible
The controller for the personal data described here is Qraft Holding B.V., Beeldhouwersdijk 43, 3541 AP Utrecht, Nederland, Chamber of Commerce (KvK) 54873576. For privacy questions or requests, write to privacy@vambel.com.
When a business uses vambel, the people and content in its workspace (for example photos and voices of presenters, or names in scripts) are processed by us on behalf of that business. For that data the business is the controller and we are its processor under our Data Processing Addendum. If you appear in someone else's video, please contact that business first; we will help them handle your request.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, e-mail address, password (stored only as an argon2id hash), workspace name, terms acceptance | Create and run your account, confirm your e-mail address, send service messages | Contract, Art. 6(1)(b) |
| Workspace content: scripts, uploads, brand kits, generated media, renders, voice recordings, photos of people and their consent records | Provide vambel: store, edit, generate and render your projects | Contract, Art. 6(1)(b). For people in a business's workspace: on the business's instructions (Art. 28) |
| Content sent to Anthropic (Claude), with your own key, when you use the in-app assistant, read a brand manual or draft a project from a website | Provide those features | Contract, Art. 6(1)(b) |
| Content sent to AI providers with your own API keys | Transmit it on your instruction under your own contract with that provider | Contract, Art. 6(1)(b) |
| Usage records: provider, model, units, cost | Show you transparently what was generated and what it cost | Contract, Art. 6(1)(b), and legitimate interest in transparency, Art. 6(1)(f) |
| Subscription and billing data: plan, payment status, invoices (card details are handled by Stripe) | Take payment, keep accounts | Contract, Art. 6(1)(b); legal obligation for invoices, Art. 6(1)(c) |
| Security logs: IP address, user agent, timestamps | Protect accounts and the service, investigate abuse | Legitimate interest in security, Art. 6(1)(f) |
| Failed sign-in attempts (kept in memory only, never stored) | Slow down password guessing | Legitimate interest in security, Art. 6(1)(f) |
| Marketing e-mails (only if you ticked the optional box) | Send news about vambel | Consent, Art. 6(1)(a); you can withdraw it at any time |
| Reports of illegal content and our handling of them | Handle notices and keep a record of decisions | Legal obligation (Digital Services Act), Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) |
You must give us the account data to use vambel; without it we cannot provide the service. We do not use automated decision-making that has legal or similarly significant effects on you. We do not use your content to train AI models.
3. Who we share data with, and international transfers
We host vambel on our own server in the Netherlands (EU). Speech transcription (Whisper) runs on that server, so recordings do not leave it for transcription. We use these processors:
| Recipient | What for | Data | Location and safeguard |
|---|---|---|---|
| Tailscale Inc. | Network relay for HTTPS traffic | Encrypted traffic and connection data such as IP addresses. TLS ends on our own server, so Tailscale does not see content. | United States; Standard Contractual Clauses (Tailscale's data processing addendum) |
| Stripe (Stripe Payments Europe Ltd, Stripe, Inc.) | Payments | Name, e-mail address, payment and billing data | Ireland (EU) and United States; EU-US Data Privacy Framework and Standard Contractual Clauses |
| [e-mail provider] | Sending e-mails (confirmation, service and billing messages, marketing if you opted in) | Name, e-mail address, message content | [to be confirmed] |
Providers you connect yourself (ElevenLabs, OpenAI, xAI, BytePlus, OpenRouter, Anthropic) are not our processors. When you use your own API key, we transmit the content on your instruction under your own contract with that provider, and its privacy terms apply.
When a brand kit needs a web font, our server downloads the font file from Google Fonts. No visitor data goes to Google. We use no analytics, no advertising trackers and no third-party cookies.
We may disclose data where the law requires it, for example to a court or authority, and only to the extent required.
4. How long we keep data
| Data | Retention |
|---|---|
| Account data and workspace content | As long as your account exists |
| After you delete your account | Content of workspaces you solely own is deleted within 30 days; backups rotate out within 30 more days |
| Unconfirmed sign-ups | Deleted after 7 days |
| Security logs | 30 days |
| Failed sign-in attempts | In memory only, not stored |
| Invoices | 7 years (Dutch fiscal law) |
Workspaces you share with others but do not solely own remain with their other owners.
5. Your rights
You have the right to:
- access your personal data;
- rectification of incorrect data;
- erasure of your data;
- restriction of processing;
- data portability: download a JSON export yourself with the plan button at the top right of the studio (Account and subscription);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting processing before the withdrawal.
Write to privacy@vambel.com. We respond within one month; if a request is complex we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own country.
6. California residents (CCPA/CPRA)
Notice at collection
In the last 12 months we collected, and we continue to collect, these categories of personal information, for the purposes and periods described in sections 2 and 4:
- Identifiers: name, e-mail address, IP address, workspace name.
- Commercial information: subscription and billing records.
- Internet or network activity: security logs (user agent, timestamps) and usage records.
- Audio, visual and similar information: voice recordings, photos and videos you upload or generate.
- Sensitive personal information: account log-in (e-mail address with password). We use it only to provide and secure your account, not to infer characteristics about you.
Sources: you directly, people in your workspace, and the providers you instruct. We disclose personal information for business purposes only to the service providers listed in section 3.
We do not sell or share personal information
We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16. Because we do neither, there is nothing to opt out of; browser opt-out signals such as Global Privacy Control are respected automatically.
Your California rights
You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for using these rights. Send requests to privacy@vambel.com or use the self-service options in Settings. We verify requests by matching them to your account e-mail address. An authorised agent may make a request for you with your signed permission.
7. Children
vambel is only for people aged 18 or older. It is not directed at children, and we do not knowingly collect personal data from children under 13. If we learn that we have, we delete it. Contact privacy@vambel.com if you believe a child has given us data.
8. Security
- Passwords are stored only as argon2id hashes.
- Your AI provider API keys are encrypted at rest with XChaCha20-Poly1305 and never logged.
- All traffic is encrypted with TLS, which ends on our own server.
- Workspaces are isolated from each other at row level in the database.
- Access is controlled by roles, security events are logged, and we make regular backups.
If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.
9. Changes
We update this policy when our processing changes. We tell you about important changes by e-mail before they apply.