Privacy Policy

This policy explains which personal data we process, for what purpose, on which legal basis, to whom we pass it on and when we delete it. It covers our website, the ordering process, the order page and the production of your video. All references to legal provisions refer to the EU General Data Protection Regulation (GDPR) and German law.

1. At a glance

• No cookies, no cookie banner. The public website sets no cookies and stores nothing in your browser. A cookie is only set once you order or sign in to your order page – solely so that signing in works.
• Our own servers in Germany. Website, database and the storage for your material run on our servers in the Hetzner data center in Falkenstein (Saxony).
• Analytics without accessing your device. We count page views with Umami on our own server – without cookies, without browser storage and without recognizing you beyond a calendar month.
• Service providers only where needed. For payment, email delivery, voice-overs and AI features we use carefully selected providers (section 9).

2. Controller

The controller responsible for data processing is:

Motion ToGo UG (haftungsbeschränkt), Drebkauer Straße 5d, 03226 Vetschau/Spreewald

Represented by the managing director: Diana Bartilla

For any questions about data protection and to exercise your rights, you can reach us

• via the contact channels listed in the imprint.

3. Visiting the website

3.1 Providing the website

When you open our website, our server necessarily processes your IP address and details of the request (requested address, time, browser identifier, amount of data transferred). This is the only way to deliver the page and protect it against misuse, for example by limiting unusually high numbers of requests.

• Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and stable operation of the website.
• Storage: We do not keep access logs containing IP addresses. Technical operating logs of the application are overwritten automatically at short intervals.
• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – data center in Falkenstein. Hetzner processes the data as our processor (Art. 28 GDPR).

3.2 Fonts, videos and images

We serve fonts, videos and images exclusively from our own server. No data is transferred to third parties for this while you view the website. The videos under “Work” play in our own player, without embedded platforms.

3.3 Analytics with Umami

To understand which pages are used, we count page views and individual steps in the ordering process (for example “configurator started”) with the open-source software Umami. Umami runs on our own server in Germany; the data does not leave our server.

• No access to your device. We set no cookies for this, store nothing in your browser and read no device characteristics such as screen size or language settings. Our site only reports what it knows itself: the page viewed, the referring page and the page title. We do not load any script from Umami or any other provider.
• Umami derives browser, operating system, device type (phone, tablet or computer) and country on our server from the information your browser sends with every request anyway (user agent, IP address). Your IP address is not stored.
• To count visits, Umami creates a check value (hash) on our server from the IP address and user agent that changes with every calendar month. The page views of a month are assigned to this check value. This shows us how many visitors are new, how many return within the month and which pages these two groups view. The check value is pseudonymous: we cannot attribute it to a person and do not link it to orders or customer data. Recognizing you beyond that month is not possible.
• Addresses are reduced to the path and campaign details (such as “utm_source”). The order page, sign-in and read links, shared quotes, project links and the administration area are never counted.
• If your browser has “Do Not Track” or “Global Privacy Control” switched on, we do not count you.
• Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is improving our offer based on pseudonymous usage data.
• Retention: We keep the measurement data (page views with check value, without IP address) for no more than 24 months.

3.4 Storage in your browser

When you visit the public website, we store nothing in your browser and read nothing from it. Your choice of motion and sound and the video player’s volume only apply while the page is open; after reloading, everything is back to the start.

Something is only stored when you expressly use a function that cannot work without it:

• Configurator (“velva:konfigurator”, the tab’s session storage): your entries, so nothing is lost when you reload or go back. Only after your first entry; deleted as soon as you close the tab.
• Upload on your order page (“velva:uploads:” with the order number in local storage; “uppy-blobs” in IndexedDB, alternatively “uppyState:…” in local storage): so an interrupted upload can resume. The marker lasts until the upload is complete, the upload progress for no more than 24 hours.

This storage is strictly necessary for the function you expressly request (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent is required. Art. 6 (1) (b) GDPR applies to processing the content. You can clear the storage at any time in your browser.

4. Cookies

We set no cookies on the public website. Technically necessary cookies only exist here:

• “velva_session” – signing in to your order page. Set after clicking “Order with obligation to pay” or the sign-in link from the email; lasts 30 days or until you sign out.
• “velva_read” – read link that lets you share the status of your order with colleagues. Set when you open the link; lasts until the link expires, at most 7 days.
• “velva_admin” – signing in to our team’s protected administration area; lasts 12 hours or until signing out.

All three are first-party cookies of our website, cannot be read by scripts (HttpOnly) and are only sent over encrypted connections. They are strictly necessary for the service you request (Section 25 (2) no. 2 TDDDG); no consent is required. The legal basis for the processing is Art. 6 (1) (b) GDPR, and for the administration area Art. 6 (1) (f) GDPR (protection against unauthorized access). Project links with a PIN work without a cookie. We do not use advertising or tracking cookies. Should this change, we will expressly ask for your consent beforehand.

Payment: Only once you have ordered and pay by card, digital wallet, Klarna or PayPal do we load Stripe’s payment form. Stripe sets no cookies on our domain in doing so. Within the payment form itself – an embedded Stripe window – Stripe may set cookies and similar storage under its own domains that are necessary for secure payment and fraud prevention (Section 25 (2) no. 2 TDDDG; section 6.4).

5. Configurator, quote and advice

5.1 Draft and quote

We save what you select in the configurator as a draft. With “Save draft” we email you a link; with “Share quote” we create a quote page with a PDF. Drafts and quotes are valid for 14 days; shortly before they expire we remind you once by email.

• Data: your selection, your core message and – if you provide them – your name and email address.
• Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract at your request).
• Retention: We delete drafts that were not ordered and expired quotes no later than six months after expiry.

5.2 Brand detection

If you enter your website address, our server opens this publicly accessible page once and reads the name, logo, main color, phone number and slogan to prefill your order. No data is passed to third parties. The legal basis is Art. 6 (1) (b) GDPR.

5.3 AI advisor

If you describe freely in the configurator what you need, our AI advisor processes your text, prefills matching fields and writes a summary. For this we transmit your text to the language model Claude by Anthropic (section 9). The advisor does not make decisions about you; price and date are always calculated by our own system according to fixed rules. Please do not enter sensitive data about other people in the advisor.

The legal basis is Art. 6 (1) (b) GDPR.

5.4 Callbacks and inquiries

If you request a callback or send an inquiry (for example for the Studio package), we process your details to reply. The legal basis is Art. 6 (1) (b) GDPR, for general inquiries Art. 6 (1) (f) GDPR. If no order results, we delete the inquiry no later than six months after the last message.

6. Order and payment

6.1 Contract data

For ordering, production, delivery and billing we process:

• email address, name, country and customer type (private individual or business),
• for businesses: company name, billing address, VAT ID if applicable, purchase order number or cost center,
• your phone number if you choose to provide it,
• your selection, your brief, your revision requests and your messages about the order.

Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR for statutory retention obligations.

Without an email address, name and country we cannot accept an order. All other details are voluntary unless marked as required.

6.2 VAT ID check

If you enter a VAT ID as a business from another EU member state, we check it via the European Commission’s VAT Information Exchange System (VIES). Only that VAT ID and our own are transmitted. The legal basis is Art. 6 (1) (c) GDPR in conjunction with our VAT obligations.

6.3 Record of your declarations

We store your declarations in the ordering process – such as acceptance of the terms, your request for production to start early, your assurance regarding the rights to your material or your choice regarding use as a reference (opt-out, objection, embargo) – with wording, text version, time and a cryptographic check value of your IP address (hash value, no IP address in plain text). This allows us to prove what was agreed.

The legal basis is Art. 6 (1) (c) GDPR (accountability obligations) and Art. 6 (1) (f) GDPR (defense and enforcement of claims).

6.4 Payment via Stripe

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Depending on country and amount, card payment, digital wallets, Link, Klarna and PayPal are available. You enter your card and account details directly with Stripe; we do not receive them. From Stripe we only receive the payment status, the payment method and the details needed for invoices and refunds.

• If you choose Klarna, the necessary data goes to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
• If you choose PayPal, the necessary data goes to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg.
• Stripe, Klarna and PayPal partly process data as independent controllers, for example for fraud prevention, credit checks for invoice or installment purchases and to meet financial regulatory obligations. Their own privacy notices also apply.
• Businesses in the EU can also pay by invoice and bank transfer; we then process the payment details from your transfer.

The legal basis is Art. 6 (1) (b) GDPR and, for statutory obligations, Art. 6 (1) (c) GDPR.

6.5 Invoices

We create invoices ourselves as PDFs with an electronic invoice (ZUGFeRD) and provide them on your order page. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Section 14 of the German VAT Act (UStG), Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

6.6 Customer care

To look after customers and prospects properly, we keep an internal customer record. In addition to the contract data, it holds: contacts (name, role, email, phone), company, industry, website and address, how you found us (source), tags, internal notes on conversations and follow-up dates. This information comes from you (for example from a conversation or an email) or from publicly available sources such as your company website. It is visible only to our team and is not passed on.

Legal basis: Art. 6 (1) (b) GDPR where it concerns your order, otherwise Art. 6 (1) (f) GDPR. Our legitimate interest is personal and reliable customer care. You can object at any time (section 12); we then delete this additional information unless we need it for the contract or statutory retention.

7. Material and production

7.1 Upload and storage

You upload your material – videos, photos, audio recordings, documents – on your order page directly into our own non-public storage on our servers at Hetzner in Germany. We automatically check every file for file type, technical properties and malware. If you provide a share link instead of a file (for example from a cloud storage service), our server downloads the files from there.

Access is only possible via time-limited, signed links and only for you and our team.

7.2 Production

For production, our production software loads the order onto a computer in our studio. The disks of these computers are encrypted, the order folder is never stored in a cloud storage service, and access keys are kept only in the system’s protected keychain.

• For analyzing your material, the script and controlling the production we use the language model Claude by Anthropic.
• For the voice-over we transmit only the script text to ElevenLabs. We do not clone your voice or anyone else’s.
• We review every result ourselves before you receive it.

Legal basis: Art. 6 (1) (b) GDPR. If your material shows other people, you obtain their consent (see the terms). For businesses, we process people in the material as a processor under our data processing agreement.

7.3 Your video as a reference

We show finished videos as work samples on our website, on our own social media channels and in presentations – unless you have opted out or objected. The rules are set out in the terms (Part A § 16). For this use we are a controller ourselves, not a processor.

• Your name: For businesses we state the company name and show the logo. If the company name contains the name of a person, for example for sole traders, this is personal data. For private individuals we do not state any name.
• Contact persons: We never publish names, email addresses or other details of your contact persons and employees.
• People in the video: If the video shows identifiable people or the real voice of a person can be heard, we only show it with their separate consent (Art. 6 (1) (a) GDPR). Consent is voluntary and can be withdrawn at any time with effect for the future (Art. 7 (3) GDPR). Without consent we show at most excerpts in which no one can be recognized or heard.
• Social media: If we show a video on our social media channels, it is public there; the platform operators also process published content under their own terms. On our website the video plays in our own player without third parties (section 3.2).

The legal basis for company name and logo is Art. 6 (1) (b) GDPR (the agreed use as a reference) and Art. 6 (1) (f) GDPR; our legitimate interest is to show our work with real examples. You can object at any time – with the “Don't show as a reference” switch on your order page, via the link in our notice email or informally by email. We then remove the video from our website and our own channels within 7 days.

8. Emails

8.1 Emails about your order

We send the order confirmation, production start, preview, delivery, invoice and deletion notices via the email service Resend, with sending from the EU. The legal basis is Art. 6 (1) (b) GDPR.

8.2 Review request and similar offers

After delivery we use your email address to ask you once for a review and to inform you about our own similar offers (Section 7 (3) of the German Act against Unfair Competition, UWG). You can object to this use at any time – via the link in every email or informally by email – without incurring any costs other than the transmission costs at basic rates. After your objection we will no longer send you such emails.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is direct marketing to existing customers.

9. Recipients and service providers

We only pass on data where necessary for the purposes described. Service providers that process data on our behalf are contractually bound under Art. 28 GDPR.

Service provider	Task	Seat
Hetzner Online GmbH	Servers, database, storage for material and outputs, analytics (Umami, self-hosted) – data center in Falkenstein	Germany
Stripe Payments Europe, Limited	Payment, refunds	Ireland
Klarna Bank AB (publ)	Payment, only if you choose Klarna	Sweden
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment, only if you choose PayPal	Luxembourg
Resend, Inc.	Email delivery (sent from the EU)	USA
Anthropic (Anthropic PBC or Anthropic Ireland, Limited)	Language model Claude for the AI advisor, analysis and script	USA / Ireland
Eleven Labs Inc. (ElevenLabs)	Synthetic voice-over from the script text	USA

Beyond this, we only pass on data if we are legally obliged to (for example to tax authorities) or if it is necessary to enforce our rights (for example to tax advisors or lawyers bound by professional secrecy).

10. Transfers to third countries

Some service providers are based in the USA or process data there. Transfers only take place if an adequate level of data protection is ensured: on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the recipient is certified under it, and otherwise on the basis of the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR). You can obtain a copy of these safeguards on request.

11. Retention

We keep data only as long as necessary for the respective purpose or required by law.

Data	When we delete it
Your uploaded material (raw material)	30 days after delivery; can be extended once by 30 days. We remind you seven days before.
Finished videos and delivery package	24 months after delivery
Local copies on the production computers	3 days after delivery
Working data of the AI tools on the production computers	after 7 days
Drafts and shared quotes that did not lead to an order	no later than 6 months after expiry
Callback and contact requests without an order	no later than 6 months after the last message
Contract data, messages and records of your declarations	after the statutory limitation period, usually three years after the end of the year in which the order was completed
Invoices and accounting records	10 years (legally at least 8 years under Section 147 AO, Section 257 HGB; we keep them 10 years so that audits and corrections remain verifiable after the deadline), then personal details are removed
Business correspondence subject to retention	6 years (Section 147 AO, Section 257 HGB)
Your video as a reference	no more than three years from delivery; after opting out we do not show it, after an objection we remove it within 7 days
Consents of people shown, for use as a reference	as evidence until the limitation period expires after the end of use or the withdrawal
Analytics measurement data (Umami)	no more than 24 months
Customer care (contacts, internal notes, follow-ups, source)	together with the contract data; without an order, once the purpose no longer applies or you object

Retention periods begin at the end of the calendar year in which the record was created.

12. Your rights

You have the right at any time to

• access the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a retention obligation applies,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation, and at any time to direct marketing (Art. 21 GDPR),
• withdraw any consent given, with effect for the future (Art. 7 (3) GDPR).

An informal message is sufficient:

• via the contact channels in the imprint.

Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg Data Protection Commissioner), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de

13. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Our system calculates prices, dates and guarantee refunds according to fixed rules that are the same for everyone and that we disclose in advance.

14. Security

We protect your data with technical and organizational measures under Art. 32 GDPR, including encrypted connections (TLS), encrypted backups, encrypted disks on the production computers, access only via time-limited links and two-factor sign-in for our team.

15. Changes

We update this policy when our processing or the law changes. The version published here applies; the date is shown at the top.