Potheon Privacy Policy
Last updated: [DATE].
In short: Potheon works on your computer. Your footage, transcripts, search index, faces and searches stay there. We never receive them. The app has no analytics, tracking or advertising. It goes online only to download its AI models, check your licence, check for updates, and fetch a show's characters when you ask it to.
1. Who we are
Ryan Lee Kai La, an individual trading as Potheon, of [ADDRESS] ("we", "us") makes Potheon and is the controller of the personal data described in sections 3 and 4. Privacy contact: privacy@potheon.com. ICO registration number: [ICO REGISTRATION NUMBER]. [EU REPRESENTATIVE: name and address, or remove this sentence if the lawyer confirms none is needed.]
Paddle (Paddle.com Market Limited and its group companies, such as Paddle.com Inc. in the USA) sells Potheon to you as our Merchant of Record. Paddle is a separate controller of the data it collects at checkout, under its own privacy notice.
2. What stays on your computer
The app processes these only on your computer, and doesn't send them to us or anyone else:
- your video, audio and subtitle files, and the folders you add, including their names;
- transcripts and translations of speech in your footage;
- the search index: "vectors" (numbers describing each shot or line), thumbnails, tags and descriptions;
- faces found in your footage, grouped by likeness, and the names you give them;
- your searches, the results you used or marked, picked clips and exports;
- your settings and the app's log files.
They're stored in the folder shown in Settings, Storage, and you can delete them at any time. The app's background service accepts connections only from your own computer, protected by a random key, so other devices on your network can't reach it.
We can't see, access, export or delete this data, because we don't have it. You control it.
Faces. Character finding is built for animation. If your footage shows real people, the app may process their faces, which can count as biometric data. That happens only on your computer and under your control, and you can turn it off in Settings (Find characters: Off). See section 4.3 of the EULA.
3. What leaves your computer, and why
| When | What is sent | To whom | Why |
|---|---|---|---|
| The first time a feature needs an AI model or helper program | A request to download a file: your IP address, the file's name and standard request details (such as the software version) | Our download server on Cloudflare; until it's ready, and as a fallback, Hugging Face and GitHub | To download models and programs that then run on your computer |
| You look up a show to name its characters (only if you do) | The show name you type, then requests for the cast and the character and cover pictures of the show you pick, with your IP address | AniList (anilist.co), directly from your computer | To find the show's characters and pictures. AniList's own privacy policy applies to these requests |
| You activate a paid licence, then about once a week | Your licence key, a machine ID, the app version, a name for the computer only if you type one, and your IP address | Our licence server, run on Cloudflare | To check your licence, how many computers use it, and whether it has been refunded |
| The app checks for updates (at start and once a day) | The app version, Windows version and processor type, and your IP address | Our update server, run on Cloudflare | To offer updates |
| You send us a problem report (only if you choose to) | What you write, plus the report you see before sending: the app version, a hardware summary and the end of the app's log. Your user name, e-mail addresses, licence details and the folder and file names of your footage are taken out before it's shown to you and again on our server | Us: it becomes an issue in our private issue tracker on GitHub (GitHub, Inc., in the USA) | To fix your problem |
The machine ID is made of three one-way codes (hashes) calculated from your Windows installation ID, your system drive's serial number and your processor model. The original values never leave your computer, and the codes can't be turned back into them.
The app never sends your footage, transcripts, index, faces, searches, or the names of your files except inside a problem report you choose to send.
4. What we receive when you buy, sign up or contact us
| Data | Where it comes from | Why we use it | Legal basis (UK GDPR) | How long we keep it |
|---|---|---|---|---|
| Email address, name (if given), country, what you bought, price, currency, order and subscription IDs and status, refunds | Paddle, when you buy | To issue and manage your licence, help you, and keep business records | Contract; legal obligation (tax and accounting) | Active plan plus 6 years (UK tax records) |
| Licence key, machine IDs, activation and check times, app version | Your app (section 3) | To check licences and stop abuse | Contract; legitimate interests (preventing licence sharing and fraud) | Active licence plus 12 months, then deleted |
| IP addresses seen by our licence, update and download servers | Your app | Security and preventing abuse | Legitimate interests | Not stored by us beyond Cloudflare's short-term security logs |
| A one-way code made from your IP address and the date, when you send a problem report | Your app | Stopping report spam (a daily limit per network) | Legitimate interests | Deleted after 2 days; it can't be turned back into your address or linked across days |
| Your email address and the computer details you give (processor, memory, graphics card, Windows version, language) | You, on the waitlist or beta sign-up form | To email you when your beta spot is ready, and choose a range of computers to test. Anything more (such as launch news) only if you agree to it | Consent (you can withdraw it at any time) | Until you ask us to delete it, or 12 months after launch at most |
| Your messages and problem reports | You | To answer you and fix problems | Legitimate interests (support), or contract for customers | Messages: 3 years after the last one. Problem reports (already without personal details) stay in our private issue tracker for 2 years at most; the log part is removed once the problem is fixed |
| Why you cancelled or asked for a refund (optional) | You, when cancelling or asking for a refund | To understand and improve the product, and to handle the refund | Legitimate interests; contract for the refund | What you wrote: 2 years. The reason you picked: kept only as a count |
| E-mails waiting to be sent (they can contain your licence key) | Us | To deliver your licence and account e-mails | Contract | Deleted after 30 days |
We don't sell your data, use it for advertising, or make automated decisions about you. We receive no card or bank details: Paddle handles payment.
Emails. We send emails you need (licence keys, renewal reminders, important changes). We send news or offers only if you agreed, and every such email has an unsubscribe link.
Website. Our website uses no cookies, analytics or tracking, and loads nothing from other sites. Our host, Cloudflare, processes visitors' IP addresses to deliver the pages and protect against attacks. The checkout (Paddle) may use its own cookies; its cookie notice applies.
5. Who else handles the data
We use these service providers, who process data only on our instructions (processors), or are separate controllers where stated:
- Paddle: checkout, payment, tax, invoices and refunds (separate controller; UK, with group companies in the USA, Ireland and Canada).
- Cloudflare: website hosting, our licence, update and download servers, and email forwarding (processor; USA and worldwide).
- [EMAIL PROVIDER]: the mailbox that receives support email (processor).
- our own sign-up server on Cloudflare: the waitlist and beta sign-up form, if we use one (processor).
- AniList, Hugging Face, GitHub: only for the requests your app makes to them directly (section 3). They're separate controllers; we don't receive that data.
- Our professional advisers (lawyer, accountant), and authorities where the law requires.
International transfers. Some of these providers process data outside the UK, mainly in the USA. Where they do, the transfer is covered by UK adequacy regulations (such as the UK-US data bridge, for certified companies) or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
6. Security
Licence tokens are signed, so they can't be forged. Our servers hold only the data in section 4. We use strong, unique passwords and two-factor sign-in on our accounts, limit access to what's needed, and use encrypted connections. If a breach puts your data at risk, we'll tell the ICO and you as the law requires.
7. Your rights
You have the right to ask for a copy of your personal data, and to have it corrected, deleted, restricted, or sent to you or another company in a common format. You can object to our use of it based on legitimate interests, and withdraw consent at any time. Email privacy@potheon.com. We reply within one month, and may ask you to prove it's you (for example, from the email address on your order).
If you're unhappy with how we've handled your data, please tell us first: we'll acknowledge your complaint within 30 days and look into it. You can also complain to the UK's Information Commissioner's Office (ico.org.uk, 0303 123 1113), or the data protection authority where you live.
8. Children
Potheon isn't directed at children under 13, and we don't knowingly collect their data. Buyers must be 18 or over, or have a parent's or guardian's permission. If you think a child has given us data, contact us and we'll delete it.
9. Changes
We'll update this policy when the app's networking or our services change, and change the date at the top. We'll tell you about important changes in the app, and by email if you're a customer, before they take effect.
10. Contact
Ryan Lee Kai La, [ADDRESS]. Privacy: privacy@potheon.com. Everything else: support@potheon.com.