Blind Editor — Privacy Policy
Effective date: 31 July 2026
Version: 1.0
0. In plain words (not part of the legal text)
You upload videos so our AI can edit them. To do that, we store your files, create a text transcript of the audio, and take still images from the video. We send text and images derived from your video to our AI provider — a third-party provider located in the United States — to work out your edit. Faces and voices can be sensitive personal data, so we treat them with care and rely on your confirmation that you have the right to upload them. We host your data within the EU/EEA. We also keep statistics about how the product is used (which features, how often — never the content of your videos or prompts) to understand and improve it. We do not sell your data, and we do not use your content to train AI models unless you opt in. You have rights over your data, including the right to get a copy and to have it deleted, and the right to complain to Iceland's data-protection authority.
1. Who is responsible for your data (controller)
Argon ehf. ("we", "us") is the data controller for the personal data described in this policy when you use Blind Editor as an individual.
- Registered address: Hjálmholt 4, 105 Reykjavík, Iceland
- Company registration number: 421210-0630
- Data-protection contact: argon@argon.is
If you are a business customer putting other people's personal data through the Service, you are generally the controller of that data and we act as your processor — see section 9 and the Data Processing Addendum.
2. The personal data we process
2.1 Data you give us
- Account data: email address, password (stored only as a strong hash), and account settings.
- Billing data: records of credit purchases and balances. Card details are handled by our payment processor, not stored by us.
- Support and communications: messages you send us.
2.2 Content you upload and what we derive from it
- Your uploaded videos and images ("Your Content").
- Transcripts — text generated from the audio.
- Still images taken from the video.
- Edited output files, and the conversation and job records describing what you asked for and what the agent did.
2.3 Data we collect automatically
- Technical and usage data: IP address, device/browser information, and logs of requests and actions, used for security, abuse prevention, rate limiting, and operating the Service.
- Product-analytics events: records of business actions tied to your account — for example that you created a project, ran a job, or bought credits — with technical properties such as durations, sizes, and outcomes. These events never contain the content of your videos, transcripts, frames, or prompts.
- Security/audit records: for example, authentication events. We minimise and protect the personal data held in these logs.
3. Why we process it, and our legal basis (GDPR Article 6)
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account; perform the edits you request; process Your Content, transcripts, and frames | To provide the Service you asked for | Performance of a contract (Art. 6(1)(b)) |
| Process the data of other people who appear or can be heard in Your Content | To perform the requested edit on content that depicts people | Legitimate interests (Art. 6(1)(f)), supported by your confirmation that you hold the consents the law requires (Terms section 9); where such processing uniquely identifies a person, an Art. 9 condition applies |
| Take payment and keep billing records | To charge for the Service and meet accounting duties | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Secure the Service, prevent abuse, enforce limits, keep logs | To keep the Service safe and reliable | Legitimate interests (Art. 6(1)(f)) |
| Record product-analytics events about how the Service is used | To understand which features are used and improve the Service | Legitimate interests (Art. 6(1)(f)); you can object (section 8) |
| Respond to support requests | To help you | Contract / legitimate interests |
| Comply with legal requests and obligations | Because the law requires it | Legal obligation (Art. 6(1)(c)) |
| Use Your Content to train or improve AI models — only if you opt in | To develop and improve the Service and our models | Your consent (Art. 6(1)(a); and an Art. 9 condition where the content is special-category), which you can withdraw at any time |
We do not use Your Content for advertising, and we do not use it to train AI models unless you have opted in.
4. Who we share data with (recipients and sub-processors)
We do not sell your personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it:
| Provider | What they do | Where | Notes |
|---|---|---|---|
| Our AI provider | Processes text and images derived from your video to reason about your edit | United States | Contractually required not to train on your content (unless you opt in) and to retain it only as long as needed to perform your edit |
| Our cloud infrastructure provider | Hosts the application; stores your files and data | EU/EEA | Data encrypted at rest |
| Our payment processor | Processes card payments | EEA (card-network transactions may involve transfers outside the EEA under appropriate safeguards) | Handles card data directly; we do not store full card numbers |
| Our product-analytics provider | Stores the product-analytics events described in section 2.3, plus your email, name, and billing country on your profile | EU/EEA (the EU data-residency service of a US-headquartered provider) | Never receives your videos, transcripts, frames, or prompt text |
We send our AI provider only the data needed to perform your edit — text and images derived from your video.
We may also disclose data where required by law, to respond to valid legal requests, to protect our rights, safety, or property or those of others, or in connection with a merger or sale of the business (with your data continuing to be protected under this policy).
We keep a current list of sub-processors and will give reasonable notice before adding a new one that processes your personal data (see the DPA for business customers).
5. International transfers
Sending data to our AI provider in the United States is a transfer of personal data outside the EEA. Our AI provider is certified under the EU–U.S. Data Privacy Framework (DPF), and we rely on the European Commission's adequacy decision for that framework as the primary safeguard for the transfer, with the Commission's Standard Contractual Clauses (SCCs) and supplementary measures as a fallback safeguard should the DPF cease to apply to the transfer. In addition, our payment processor may transfer card-transaction data outside the EEA in limited cases (for example, to complete cross-border card-network transactions), also under appropriate safeguards. Our product-analytics provider stores its data within the EU/EEA; because it is US-headquartered, any access from outside the EEA is safeguarded in the same way (DPF certification or SCCs). All other hosting and storage takes place within the EU/EEA.
6. How long we keep it (retention)
- Your Content, transcripts, frames, outputs, and conversation/job records: kept while your account is active so you can keep working with them. Our storage is designed so your source of truth is retained in durable storage while a hot working copy is cached and evicted as needed. When you delete a file or your account, we delete the corresponding content (see section 8.2).
- Account and billing records: kept for as long as your account is active and afterwards as needed to meet legal, accounting, and tax obligations.
- Purchase receipts: kept for seven years from the end of the financial year, as Icelandic accounting law requires (20. gr. laga nr. 145/1994). A receipt records the billing name, address, and amount that were on it when issued. This retention duty overrides a deletion or erasure request (GDPR Art. 17(3)(b)): if you delete your account we sever the link between the receipt and your login, but we cannot delete the receipt itself. You can view and download your receipts from your account at any time.
- Security/audit logs: kept for no longer than one year and then deleted.
- Product-analytics events: kept while your account is active; the profile data our analytics provider holds (email, name, billing country) is deleted when your account is deleted.
7. How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, strong password hashing, access controls, and measures to isolate and limit access to the environment where your content is processed. No system is perfectly secure, but we work to protect your data and to notify you and the authorities of a personal-data breach where the law requires (see section 10).
8. Your rights
8.1 Rights under GDPR
Subject to the conditions in the law, you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and, where we rely on consent, to withdraw consent at any time (without affecting processing already carried out). To exercise these rights, contact argon@argon.is. We will respond within the time the law allows (normally one month). We may need to verify your identity first.
8.2 Deleting your content and account
You can delete individual uploaded files and outputs from within the app, and you can delete your entire account, which permanently deletes your projects, uploaded files, and conversations. As explained in the Terms, deleting your account does not entitle you to a refund of unused credits, except where required by law.
8.3 Complaints
If you think we have mishandled your data, please tell us first at argon@argon.is so we can try to put it right. You also have the right to complain to the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is), or to the supervisory authority in your EEA country of residence.
9. Business customers
Where you use the Service to process personal data on behalf of your own customers or users, you are the controller and we are your processor for that data. The Data Processing Addendum governs that relationship and forms part of our agreement with you.
10. Data breaches
If a personal-data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify Persónuvernd without undue delay and within 72 hours where feasible, and will notify affected individuals where the law requires.
11. Cookies and similar technologies
We use strictly necessary cookies/sessions to keep you logged in and to operate the Service. Our product analytics is server-side — it does not use cookies, browser trackers, or an analytics script on your device; it is described in sections 2.3, 3, and 4. If we ever add analytics or other non-essential cookies, we will update this policy and provide a cookie notice and, where required, ask for your consent.
12. Children
The Service is for adults: account holders must be at least 18 (Terms section 3). We do not knowingly collect personal data from anyone under that age. If you believe a minor has provided us data, contact argon@argon.is and we will delete it.
13. Changes to this policy
We may update this policy. We will post the new version with an updated effective date and, for material changes, give reasonable notice. Your continued use after a change takes effect means you accept the updated policy, so far as the law allows.
14. Contact
Data-protection questions and requests: argon@argon.is
Argon ehf. · Hjálmholt 4, 105 Reykjavík, Iceland · Reg. no. 421210-0630