Privacy Policy

How we handle personal data on our websites, in our tools, apps and plug-ins, and on our social media profiles.

Last updated: 2026-11-02

At a glance

This policy explains what personal data Codebase Media UG (haftungsbeschränkt) processes when you use EditingTools.io: our websites, the web tools, your account, our apps and plug-ins, and our profiles on social networks. It explains why we process the data, how long we keep it, who else receives it, and what rights you have.

EditingTools.io is used by individuals and by companies. If you use it on behalf of your employer or a client, some of what you upload is processed on that organisation's instructions rather than ours. The section on roles below explains the difference.

The short version: our own servers are in Germany, and traffic passes through the network of Cloudflare (USA) for fast delivery and protection against attacks. Files you upload to a converter or an AI tool are deleted straight after processing. Results are kept only for the period you choose. We set no advertising or analytics cookies, we do not sell data, and we do not use your files to train AI models.

Where this policy applies

This policy applies to the websites at editingtools.io, editing.tools, editingtools.com, editingtools.eu and editingtools.de, including all of their subdomains, to the EditingTools.io apps in the Apple App Store, to our extensions and plug-ins on Adobe Exchange, and to our profiles on Instagram, Threads, LinkedIn, YouTube and X.

It does not apply to the websites and services of other providers that we link to, or to the processing that the app stores, payment providers and social networks carry out under their own responsibility. Where that matters, this policy says so and points you to their privacy notices.

Controller

The controller within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) is:

Company
Codebase Media UG (haftungsbeschränkt)
Address
Im Mediapark 5, 50670 Köln, Germany
Email
[email protected]

Data protection officer

We are not required to appoint a data protection officer under Article 37 GDPR or section 38 of the German Federal Data Protection Act (BDSG), and we have not appointed one voluntarily. Data protection enquiries go to [email protected] and are handled by the management.

Your rights

Under the GDPR you have the following rights in respect of your personal data:

Right to object. Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we use your data for direct marketing, you may object at any time without giving reasons, and we will stop using it for that purpose.

To exercise any of these rights, write to [email protected]. We answer within one month, as required by Article 12(3) GDPR. We may ask for information to confirm your identity, and we ask only for what is needed to be sure we are not disclosing your data to somebody else.

You also have the right to lodge a complaint with a supervisory authority under Article 77 GDPR, in particular in the member state where you live or work or where the alleged infringement took place. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Server log files

Whenever you open one of our pages or use one of our tools, our servers automatically record information that your browser or app transmits:

Purpose and legal basis: delivering the websites and tools, diagnosing faults, and defending against attacks and automated abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a service that works and is secure. We do not combine this data with other sources and do not use it to profile visitors.

Retention: log files are deleted after 14 days. An individual entry needed to investigate a specific security incident is kept until that investigation is closed.

Hosting and infrastructure

Our websites, the tools and your account data run on servers in Germany. Hosting and infrastructure are provided by IONOS SE (Montabaur), IONOS Cloud GmbH (Berlin) and Hetzner Online GmbH (Gunzenhausen). IONOS also hosts our own mail server, through which we send and receive email.

They act as our processors under Article 28 GDPR, under data processing agreements, and process data only on our instructions. The legal basis is Article 6(1)(b) GDPR where hosting is needed to perform a contract with you, and otherwise Article 6(1)(f) GDPR, our legitimate interest in reliable and secure infrastructure.

Content delivery network and attack protection

We use Cloudflare as a content delivery network and to protect our servers against attacks. All requests to our websites, tools and apps, including uploads, form entries and sign-ins, pass through Cloudflare's worldwide network first. The connection is encrypted between your browser and Cloudflare and again between Cloudflare and our servers (TLS with certificate validation, "Full (strict)" mode). To route requests, filter attack traffic and cache files, Cloudflare decrypts the traffic within its network. It therefore processes your IP address, the requested URL, technical connection data and the content transmitted, and it caches static files. Cloudflare may set strictly necessary security cookies to tell people from bots (see Cookies).

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the security and availability of the service, in particular protection against denial-of-service attacks and automated abuse.

Cloudflare, Inc. is based in the United States. It is certified under the EU-US Data Privacy Framework, and we have also concluded the European Commission's Standard Contractual Clauses with it.

Cookies and local storage

We use no analytics, no advertising and no tracking cookies, and no third-party tracking tools. We store only what is strictly necessary to provide the service you asked for:

Storing and reading this information is strictly necessary to provide the service you have expressly requested, so it requires no consent under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Any personal data involved is processed under Article 6(1)(b) GDPR (to provide your account) and Article 6(1)(f) GDPR (security). You can delete cookies in your browser settings at any time; you will then be signed out.

Your account

You can use many tools without an account. For paid features, for storing results and for the project tools you need one. When you register and use your account, we process:

Signing in with Google, Apple or Adobe: if you choose to, the provider (Google Ireland Limited, Apple Distribution International Ltd. or Adobe Systems Software Ireland Ltd.) confirms your identity to us and passes us your name and email address, or with Apple a relay address if you choose to hide yours. We receive no password. The provider learns that you signed in to EditingTools.io. Members of an enterprise account can sign in through their organisation's single sign-on, in which case their organisation's identity provider confirms their identity to us. The providers' own privacy notices apply to their processing.

Checks against abuse: to protect accounts against takeover and the service against abuse, we check at registration whether an email address exists and whether it belongs to a provider of temporary or disposable addresses, and we keep a list of such domains for that purpose.

Legal basis: Article 6(1)(b) GDPR for providing the account and the contract; Article 6(1)(f) GDPR for the IP address, the abuse checks and the security log, our legitimate interest being in preventing misuse and proving that a registration took place.

Retention: account data is kept for as long as your account exists. Accounts are not deleted just because a subscription ends; they continue as free accounts. You can delete your account at any time in your account settings. Free accounts without AI Credits, licences, a subscription or stored projects that show no sign-in, no tool use and no payment for 36 months may be deleted after we have warned you by email at least 30 days in advance. Security log entries are deleted after 12 months. Data we must keep for tax and commercial law reasons is kept for the statutory period described under accounting, and is blocked for every other use.

Files you process with our tools

When you use a tool, we process the files you upload and the results we generate for you. These may contain personal data, for example the voices and faces of people in a recording, names in a script or an edit list, or metadata. How long we keep them:

Legal basis: Article 6(1)(b) GDPR, because processing your files is the service you asked for. Where the files contain personal data of other people, you are responsible for being allowed to process it; where you use EditingTools.io for an organisation, we process those files on its behalf (see roles below).

We do not look at your files in the ordinary course of business. Access happens only on your request, for example to investigate a support case, or where necessary to restore the service, and it is logged.

We do not use your files or results to train artificial intelligence models, and we do not sell or publish them.

Files may also contain special categories of personal data (Article 9 GDPR), for example voices or images from which health or ethnic origin can be inferred. We do not seek out, analyse or evaluate such data. It is processed only as part of the processing you start, automatically and without evaluation, and is deleted as described above. If you upload recordings of other people, make sure you are entitled to do so.

Music metadata from libraries and publishers

To identify music in cue sheets, our Cue Sheet Converter and Cue Sheet Manager use catalogue metadata that music libraries, publishers and labels provide to us or have published with their recordings: file names, track titles, catalogue numbers and the names of composers, artists, arrangers, publishers and labels. Names of people are personal data even when they have already been published. We show them to users whose edit contains the track, so that the cue sheet names the right rights holders.

Source: the music library, publisher or label concerned, or the published credits of the recording. Legal basis: Article 6(1)(f) GDPR. Our legitimate interest, which the rights holders and our users share, is in correct cue sheets, so that music use is reported and the rights holders are paid. Retention: for as long as the track is part of the catalogue the library or publisher provides. We correct or delete an entry when the supplier asks us to or when you show us that it is wrong. You can object under Article 21 GDPR (see Your rights below).

AI tools and specialised processing services

Most of our tools run on our own servers in Germany. For a few tools we use specialised providers, and only when you start that tool. Your file, or the text concerned, is then sent to the provider, processed, and the result returned to us:

These providers act as our processors under Article 28 GDPR. They may use the data only to provide the service to us and not for their own purposes, including training their models. The legal basis is Article 6(1)(b) GDPR, because the processing is needed to carry out the tool you started.

Where a provider's group includes companies outside the EEA, any access from there is covered by the European Commission's Standard Contractual Clauses. The current list of every provider, with address and purpose, is on our sub-processor page.

AI results are generated automatically and can be wrong. Our AI tools do not make decisions about you; see automated decision-making below.

Purchases and payment

Purchases on our website are processed by Paddle as merchant of record and authorised reseller. Paddle sells you the licence, takes payment, issues the invoice and handles taxes. Depending on where you are, the seller is:

Paddle is an independent controller for the payment and tax data it collects; its privacy notice applies at paddle.com/legal/privacy. We never see your full card or bank details. We receive your name, email address, country, the product bought, and the payment status. When a page shows prices, your browser contacts Paddle to load them in your currency, and Paddle receives your IP address for that purpose; the legal basis is Article 6(1)(f) GDPR, our legitimate interest in showing correct prices, and Article 6(1)(b) GDPR once you start a purchase.

In exceptional cases, for example for orders agreed individually, payment is processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland, as payment service provider; in those cases we are the seller. Stripe's privacy notice applies at stripe.com/privacy.

Legal basis: Article 6(1)(b) GDPR for concluding and performing the contract, and Article 6(1)(c) GDPR for the records tax and commercial law require.

Checkout reminders: if you started a purchase and did not finish it, and you agreed to receive reminders, we may send you one email with a link to continue. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Apps and plug-ins

Apple App Store: our apps are distributed through the App Store of Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apps, in-app purchases and in-app subscriptions are sold by Apple. Apple processes your Apple ID, payment and download data under its own responsibility, and we receive no personal payment data from Apple, only anonymised sales and crash reports. Apple's privacy policy applies at apple.com/legal/privacy.

Device permissions: an app asks for access to your files, microphone, camera or other device functions only where a feature needs it, and only when you use that feature. You can withdraw permissions at any time in your device settings. Processing that runs locally on your device does not send the data to us; where an app uses one of our online tools, the data is processed as described for the tools above.

Adobe Exchange: some of our plug-ins are also offered on Adobe Exchange, operated by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. Purchases there are handled by Adobe and its e-commerce vendor, who process your Adobe account and payment data under their own responsibility. Adobe's privacy policy applies at adobe.com/privacy. When a plug-in uses one of our online tools or your EditingTools.io account, it connects to our servers and the data is processed as described in this policy.

Legal basis for our own processing in apps and plug-ins: Article 6(1)(b) GDPR for providing the functions you use, and Article 6(1)(f) GDPR for security and error analysis.

Emails from us

Service emails: we send emails that are necessary for your account and your contracts, such as confirmations, invoices, security notices, warnings before deletion, and important changes to the service or these documents. These are not marketing and you cannot unsubscribe from them while you have an account. Legal basis: Article 6(1)(b) and (c) GDPR.

Optional emails: with your consent we send the emails you selected:

Subscription uses a double opt-in: after you sign up we send an email asking you to confirm, so that nobody can sign up someone else. We record the time of sign-up and confirmation and the IP address used, to be able to prove your consent. The legal basis is your consent (Article 6(1)(a) GDPR); the record of it rests on Article 6(1)(f) GDPR, our legitimate interest in proving it.

You can unsubscribe from each type at any time through the link in every email, in your account settings, or by writing to us. After you unsubscribe we may keep your address for up to three years to prove that consent was given, and in a blocklist for as long as needed to make sure you receive nothing further.

We send all emails ourselves, from our own mail server hosted by IONOS SE in Germany. We do not use a newsletter service and we do not track whether or when you open our emails.

We send marketing emails only with your consent. We do not use the email address from a purchase or a free account for advertising unless you have opted in.

Please note that email is generally encrypted on its way between servers but not end-to-end. For confidential material, use the upload in your account rather than an email attachment.

Contact and support

When you contact us, we process what you send: your name, email address, the content of your request and any technical details or files you include so that we can reproduce a problem. Where we need to, we translate support requests with DeepL or Google Cloud Translation.

Legal basis: Article 6(1)(b) GDPR where the request relates to a contract with you or its preparation, and otherwise Article 6(1)(f) GDPR, our legitimate interest in answering the people who write to us.

Retention: support correspondence is kept for three years from the end of the year in which the matter was closed, so that we can recognise a recurring problem, and then deleted, unless it has to be kept longer as a business letter under commercial or tax law.

Cancellations and withdrawals

If you cancel a contract through our cancellation page or withdraw from a contract through our withdrawal page, we process your name, the information identifying the contract, your email address, the content of your declaration and the date and time we received it, and we send you a confirmation of receipt. The same applies to reports of illegal content through our reporting form, where we also process the location of the content and your explanation. To prevent abuse we count submissions per connection using a value derived from your IP address with a secret key; it is kept for at most one hour.

Legal basis: Article 6(1)(c) GDPR in conjunction with sections 312k and 356a of the German Civil Code (BGB) and Article 16 of the Digital Services Act, and Article 6(1)(b) GDPR for processing the cancellation or withdrawal. Retention: three years from the end of the year in which the contract ended or the report was decided, the regular limitation period, so that we can prove receipt; longer only where tax law requires it.

Video calls

For calls with customers we use Zoom, provided by Zoom Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA. Zoom processes the participants' names, email addresses, IP addresses, device information, and audio and video during the call. We do not record calls unless everyone agrees beforehand; a recording is deleted after 30 days unless it is needed longer for the purpose agreed. Invitations and notes are kept as business correspondence for up to six years where commercial law requires it, otherwise deleted when no longer needed.

Legal basis: Article 6(1)(b) GDPR where the call relates to a contract or its preparation, and otherwise Article 6(1)(f) GDPR, our legitimate interest in efficient communication. Zoom is certified under the EU-US Data Privacy Framework, and we have concluded a data processing agreement with Standard Contractual Clauses with it.

Embedded YouTube videos

Some pages show tutorial videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video is not loaded when you open the page; you see a preview image, and only when you click it is the player loaded from youtube-nocookie.com. From that moment Google receives your IP address and information about the page, may store information on your device, and may link the visit to your Google account if you are signed in.

Legal basis: your consent by clicking play (Article 6(1)(a) GDPR and section 25(1) TDDDG). You can avoid it by not starting the video. For the loading of the player we and Google are jointly responsible (Article 26 GDPR); Google is solely responsible for its further processing.

Google may transfer data to the United States; Google LLC is certified under the EU-US Data Privacy Framework. Google's privacy policy applies at policies.google.com/privacy.

Our profiles on social networks

We have profiles on the following networks, to present EditingTools.io and to communicate with people there:

When you visit our profiles, the network processes your data under its own responsibility, usually including for advertising and to create usage profiles, and possibly in countries outside the EU. We see what you share with us publicly or send us, and anonymised statistics about visits to our profile. For these statistics ("Page Insights") we are jointly responsible with Meta for Instagram and with LinkedIn for LinkedIn, under Article 26 GDPR; the networks have agreed to take primary responsibility for informing you and for handling your rights requests, and their agreements are available on their websites.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in presenting our products and communicating with interested people. Where a network asks for your consent, its consent applies.

You can exercise your rights against us or directly against the network; the network is usually better placed to act, because only it has access to the underlying data. The networks' own privacy policies apply.

Blog

Our blog has no comment function and sets no additional cookies. Reading it involves only the server log files described above.

Custom development and projects for clients

For custom development and project work we process the contact details of our clients' contact persons, the content of our communication and the project documents. The legal basis is Article 6(1)(b) GDPR where the client is the contact person, and otherwise Article 6(1)(f) GDPR, the legitimate interest of both sides in carrying out the project.

Where we process personal data on our client's behalf in such a project, we do so as its processor under a data processing agreement, and the client is the controller.

Accounting and tax

We process billing contacts and transaction records to invoice, keep our books and file our taxes. For accounting we use lexoffice, provided by Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany, as our processor, and we pass records to our tax adviser, who is bound by professional confidentiality.

Legal basis: Article 6(1)(b) and (c) GDPR. Retention: books, annual financial statements and the documents needed to understand them are kept for ten years, accounting vouchers such as invoices for eight years, and business letters for six years, each from the end of the calendar year concerned (section 147 of the German Fiscal Code (AO), section 257 of the German Commercial Code (HGB)). These are statutory obligations that a deletion request cannot shorten; the data is blocked for every other use.

Whose data we process, and in which role

Who is responsible for your data depends on how you use EditingTools.io:

If you use EditingTools.io through your employer and want access to or deletion of data in your organisation's account, please contact your employer first. We will forward any such request that reaches us and let you know.

Recipients of your data

We disclose personal data only where we have a legal basis. Recipients are:

The list of our processors, with each company's address, purpose and the data it receives, and of the payment providers and other service providers that receive data, is published and kept current on our sub-processor page. The app stores, sign-in providers, social networks and professional advisers named above are described in the relevant sections of this policy.

We do not sell personal data and do not share it for anyone else's advertising.

Transfers outside the EEA

Our own servers are in Germany, and traffic passes through Cloudflare's network (see above). Some providers are located outside the European Economic Area, or belong to groups that are:

You can request a copy of the safeguards from [email protected].

Information for users in the United States

We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar US state laws. We do not use sensitive personal information to infer characteristics about you.

Our websites treat Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing, although there is nothing to opt out of. You may request access to, correction or deletion of your personal information as described under "Your rights" above, and we will not discriminate against you for doing so.

Data security

All connections to our websites, tools and apps are encrypted with TLS. We apply technical and organisational measures appropriate to the risk under Article 32 GDPR, including multi-factor authentication for administrative access, encryption of stored data and encrypted, tested backups (kept for 30 days), and we review them as the service changes. They are described in Annex 2 of our data processing agreement.

Do you have to provide data?

You do not have to give us any personal data to read our websites. Where a form marks a field as required, we need the data to conclude or perform a contract with you or to answer your request. Without it we cannot do that; there is no other consequence.

Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR), and we do not profile you. At registration, disposable email addresses are rejected automatically; this only asks you to use a different address. If you think it has affected you wrongly, write to us and a person will look at it.

Children

Our services are not directed at children under 16. We do not knowingly process the personal data of children under 16 without the consent of a holder of parental responsibility.

Language versions and machine translation

Our legal documents are published in several languages. The English text is the original. The other language versions were produced with the assistance of machine translation and AI-based translation tools, and a translation can lose a nuance the original carried.

Where a translation differs from the English original, the original prevails. This does not restrict any right that mandatory consumer protection law gives you.

Article 12(1) GDPR requires us to give you this information in a concise, transparent, intelligible and easily accessible form, using clear and plain language. If any part of this policy is unclear to you in any language, write to [email protected] and we will explain it and fix the wording.

Changes to this policy

We update this policy when the service or the law changes. The date of the last change is shown at the top. If a change materially affects how we handle your data, we will tell account holders by email in advance.