Version 2.1, 11 October 2026
GuifiLab is a trade name of Guifi BV, Oude Apeldoornseweg 41, 7333 NR Apeldoorn, the Netherlands (Chamber of Commerce 56794398). Guifi BV is the controller for personal data processed through guifilab.nl, guifilab.com and our software: Subtitle Studio, edelkrone control and Secret Drop. This policy explains what we process, why, for how long and what your rights are.
In short
- We are a Dutch company. Our website and servers are in the EU (the Netherlands and Germany).
- Your video, audio and subtitles stay on your own Mac. Our software processes them locally.
- We do not sell data and we do not use ad networks. We only measure with your consent.
1. What data do we process?
When you order or create an account
- Name, email address, and for business purchases your company name, address and VAT number.
- Order details: which product, when, the amount, and the status of your subscription.
- Payments are handled by Mollie. We never see or store card or bank details.
- We check your VAT number automatically in the European VIES database.
When you use our software
- Licence check: your licence key, an anonymous device ID, the app version and the time of the check. The app derives this ID from your Mac’s hardware and encrypts it; we do not receive a serial number or hardware data itself, but we do recognise the same Mac.
- Trial: to count the free trial videos per Mac, we store that anonymous device ID with the number of trial videos used and the time of the first start.
- Updates: the app asks our update server whether a new version is available, sending the app version and chosen update channel.
- Your own material (video, audio, transcripts, subtitles) stays on your Mac. We do not receive it.
- Test group: if you take part in our agreed Subtitle Studio test group, the app sends generated and corrected subtitle files to us so we can improve the tool. This only happens for licences we have put on the test list together with you.
- Cloud AI (optional): if you choose a cloud provider in Subtitle Studio (OpenAI, Anthropic, Google or Mistral), the subtitle text goes directly from your Mac to that provider using your own key. We are not in between. That provider’s terms apply to their processing.
- Secret Drop: messages are stored encrypted and expire automatically. No account is needed. To prevent abuse we log when messages are created and opened, with IP address and time, but never the content. We keep that log for 90 days.
When you request the trial
- Your e-mail address, the time, your IP address, and whether you used the download link. We use this to send you the personal download link and to prevent misuse of the trial.
- We refuse disposable addresses. To do so we check the domain of your e-mail address; your address itself is not shared with anyone.
When you contact us or sign up for the newsletter
- Your name, email address and what you write to us.
- For the newsletter: your first name and email address, only if you sign up yourself.
When you visit the website
- Technical data in server logs (such as IP address, browser and time), for security and troubleshooting.
2. Why, and on what legal basis?
- Performance of the contract: delivering your order, activating your licence, offering updates and helping with questions.
- Legal obligation: keeping invoices and VAT records.
- Your request: sending you the trial download link you asked for.
- Legitimate interest: protecting the website, licences and trial against abuse, and fixing problems.
- Consent: the newsletter and taking part in the test group. You can withdraw consent at any time.
3. How long do we keep data?
- Account and licence data: as long as your account or licence is active, plus 1 year.
- Invoices and order data: 7 years, as required by law.
- Server logs: up to 3 months.
- Trial requests: 1 year, after which we delete them automatically. We keep the count of trial videos per Mac as long as the trial exists, because otherwise it would start again.
- Test group files: until we no longer need them for improvements, at most 1 year after receipt, or sooner on request.
- Newsletter: until you unsubscribe.
4. Who do we share data with?
We use a few service providers, each bound by agreements to protect your data.
- Website hosting: Flexwebhosting, the Netherlands.
- Update and licence server: Hetzner, Germany.
- Payments: Mollie, the Netherlands.
- Newsletter: Brevo, France.
- Email: Google Workspace.
- Website security: Wordfence (Defiant Inc.), to block attacks.
Google and Defiant may process data outside the EU, based on the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework. We do not sell data or pass it to advertisers.
5. Cookies
Without consent we only use cookies needed to run the site: for your session, the cart, logging in, your language and remembering your cookie choice.
If you consent to marketing, WooCommerce also sets cookies (starting with sbjs_) that remember how you reached the site, such as a search engine or a link. That information is only stored with your order, so we can see which channels work. It is not shared with third parties and not used for ads. The cookies expire after at most 6 months. You can change your choice at any time via “Cookie settings” at the bottom of every page.
6. Security
All connections to our website and servers are encrypted (https). Access to data is limited to the people who need it for their work. We automatically check our own code every week for known security issues.
7. Your rights
You have the right to access, correct or delete your data, to restrict processing, to object and to data portability. Email us at support@guifi.nl. We respond within one month. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own EU country.
8. Changes
We update this policy when our software or way of working changes. The date at the top shows the latest version.
Contact
