Privacy Policy

1. Who we are

This Privacy Policy explains how Acme Tomato Agency ("we", "us", "our") collects, uses, discloses and protects personal information when you visit this website, watch or record a video through it, receive a message from us, or otherwise interact with the Acme Review service (together, the "Service").

We are the controller of the personal information described in this policy. Our contact details appear in the final section. Our registered address is at 2406 Columbia Pike, Arlington, VA, 22204, United States.

If we process personal information on behalf of one of our business customers (for example when a clinic or a firm sends video messages to its own clients), that customer is the controller and we act as its processor. In that case, please direct your request to that customer first; we will assist them in responding to you.

2. Information we collect

We collect information you give us directly, information generated automatically when you use the Service, and information we receive from others.

• Identity and contact data: your name, email address, telephone number, business name, job title and postal address.
• Account data: login credentials, authentication events, role and permission assignments, seat allocation and workspace membership.
• Content data: the videos, audio, still images, captions, scripts, written responses and files you create, upload, request or receive, including video testimonial recordings.
• Recipient data: the names, email addresses and mobile numbers of the people you ask us to send video requests or messages to, together with delivery, open and click events.
• Transaction data: subscription and add-on purchases, invoices, payment status and limited card metadata received from our payment processor. We never store full card numbers.
• Technical data: IP address, device and browser type and version, operating system, language, screen size, crash reports and timestamps.
• Usage data: the pages you visit, the features you use, the buttons you click, the videos you watch, watch duration and referral source.
• Location data: coarse location derived from your IP address, and precise location only where you explicitly grant it.
• Communications data: support tickets, chat transcripts, survey responses and any correspondence with us.
• Marketing preferences: your choices about which communications you receive and through which channel.

3. How and why we use your information, and our legal bases

Where data-protection law requires a legal basis for processing, we rely on the bases set out below. Where we rely on legitimate interests, we have balanced those interests against your rights and expect the processing to be within your reasonable expectations.

• Providing the Service: creating your account, generating and delivering videos, sending your requests and messages, storing your content. Legal basis: performance of a contract.
• Billing and account administration: processing payments, invoices, renewals, seat and location changes, tax records. Legal basis: performance of a contract and compliance with legal obligations.
• Customer support: answering your questions, investigating faults, resolving disputes. Legal basis: performance of a contract and our legitimate interests in running a functioning service.
• Security and abuse prevention: detecting fraud, spam, scraping, unauthorised access and prohibited content; maintaining audit logs. Legal basis: our legitimate interests in protecting you, us and other users, and compliance with legal obligations.
• Service improvement and analytics: understanding feature usage, measuring performance, fixing defects, prioritising roadmap work. Legal basis: our legitimate interests in improving the Service, or your consent where analytics cookies require it.
• Marketing communications: sending product updates, offers and newsletters. Legal basis: your consent, or our legitimate interests in marketing to existing business customers where the law permits it, and always with an unsubscribe route.
• Legal and regulatory compliance: responding to lawful requests, enforcing our agreements, establishing or defending legal claims, meeting record-keeping duties. Legal basis: compliance with legal obligations and our legitimate interests in protecting our legal position.
• Communications you initiate: responding when you contact us. Legal basis: our legitimate interests and, where applicable, performance of a contract.

4. Cookies and similar technologies

We use cookies, local storage and similar technologies. Strictly necessary cookies (session management, security tokens, load balancing, fraud prevention) are set on every visit because the Service cannot function without them. Analytics and advertising cookies are set only where you have consented, and you can change or withdraw that consent at any time through the cookie preferences control on this site or your browser settings.

We honour Global Privacy Control ("GPC") signals as an opt-out of sale or sharing where the law requires us to. Blocking strictly necessary cookies may prevent parts of the Service from working.

5. When we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose information only in the circumstances below.

• Service providers and processors: third-party infrastructure providers that process information on our behalf under written data-processing terms, including cloud hosting and storage, video transcoding and content-delivery networks, transactional email delivery, payment processing, customer-support tooling, error monitoring and product analytics. Each is bound by a written agreement limiting its use of your information to providing services to us.
• Business customers: if your account was created by, or belongs to, one of our business customers (for example an agency, a clinic or an employer), that customer can see the content and activity associated with its workspace.
• Recipients you choose: when you send a video request or message, the people you address receive the content you intended them to receive.
• Professional advisers: lawyers, auditors, insurers and accountants where necessary and under duties of confidentiality.
• Corporate transactions: a prospective or actual buyer or investor in connection with a merger, acquisition, financing or sale of assets, under confidentiality obligations.
• Legal requirements and protection: where we believe disclosure is necessary to comply with law or a valid legal process, to enforce our agreements, to investigate fraud or security incidents, or to protect the rights, property or safety of any person.
• With your direction or consent: any other sharing you ask us to make.

6. International transfers

We and our service providers may process information in countries other than the one you live in, including the United States, the European Economic Area, the United Kingdom and the Asia-Pacific region. Where we transfer personal information out of a jurisdiction that restricts transfers, we rely on an appropriate safeguard: an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary technical and organisational measures where required.

You may ask us for a copy of the relevant safeguard by contacting us using the details below.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, to comply with our legal obligations, to resolve disputes and to enforce our agreements. Indicative periods:

• Account and workspace records: for the life of the account, then for as long as needed to close it down and meet record-keeping duties.
• Video content and campaign records: until you delete them or your retention setting expires them. Where a plan imposes a storage window (for example 30 days, 90 days or one year), content is deleted at the end of that window.
• Recipient and delivery records: for the life of the campaign plus a reasonable period for delivery diagnostics and dispute resolution.
• Invoices, tax and payment records: for the period required by tax and accounting law in the relevant jurisdiction.
• Security and audit logs: typically 12 months, longer where an investigation is open.
• Support correspondence: typically 24 months after the matter is closed.
• Marketing preferences and suppression lists: retained so that we can continue to honour an opt-out.

8. Security

We use administrative, technical and physical safeguards designed to protect personal information against unauthorised access, alteration, disclosure, loss and destruction. These include encryption in transit, encryption at rest for stored media, least-privilege access controls, credential and secret management, logging and monitoring, vendor due diligence, and contractual security commitments from our processors.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant regulator and, where required, you, without undue delay.

9. Your rights

Depending on where you live, you may have some or all of the following rights. We will not charge a fee for a reasonable request, and we will not discriminate against you for exercising a right.

• Access: confirmation of whether we process your information, and a copy of it.
• Correction: rectification of inaccurate or incomplete information.
• Deletion: erasure of information we no longer have a lawful reason to keep.
• Restriction: limitation of how we use your information while a concern is investigated.
• Objection: objection to processing based on legitimate interests, and an absolute right to object to direct marketing.
• Portability: a machine-readable copy of information you provided to us, where technically feasible.
• Withdrawal of consent: at any time, without affecting processing that already took place.
• Automated decisions: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions about you.
• Complaint: to lodge a complaint with your local data-protection authority. We would appreciate the chance to resolve your concern first.
• California residents: the right to know the categories and specific pieces of personal information we collected, the right to delete, the right to correct, the right to opt out of sale or sharing (we do neither), the right to limit the use of sensitive personal information, and the right to use an authorised agent.

10. Information you must provide

Where we need information to enter into or perform a contract with you (for example your account details and payment method), or to comply with law (for example tax reporting), you must provide it. If you do not, we may be unable to provide the Service. All other information is provided voluntarily, though some features will not work without it.

11. Sensitive information and health data

Some of our customers operate in regulated sectors. If you are a healthcare, dental or wellness provider, our agreement with you identifies the categories of protected health information that may be processed, and we act as a business associate (or equivalent processor) under the applicable rules. We will only process that information on your documented instructions.

Please do not include health information, financial account numbers, government identifiers, or other special-category data in a video recording unless your agreement with us expressly permits it and you have obtained the consents the law requires. Where special-category data is processed, we rely on your explicit consent or another condition permitted by applicable law.

12. Children

The Service is intended for businesses and adults. It is not directed to children, and we do not knowingly collect personal information from children below the age at which they can consent to data processing in their jurisdiction. Where a video features a minor, the adult who submits it is responsible for obtaining any required parental or guardian consent. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Automated processing and AI features

Some features use machine learning to transcribe speech, suggest captions or copy, detect prohibited content, or rank and summarise activity. These features support human decision-making; we do not use them to make decisions that produce legal or similarly significant effects about you. Where content is automatically screened, a human review route is available on request.

14. Marketing, messaging and how to opt out

Where we send marketing email or SMS, we do so in line with applicable consent requirements, including the TCPA and CAN-SPAM Act in the United States, CASL in Canada, the Spam Act in Australia, PECR in the United Kingdom and the ePrivacy Directive in the EU. Every marketing message includes an unsubscribe or STOP route, and we honour opt-outs promptly. Service and transactional messages (receipts, security alerts, delivery failures) are not marketing and cannot be unsubscribed from while you hold an account.

15. Regional disclosures

The following disclosures apply in addition to the rest of this policy where the relevant law applies to you.

• European Economic Area, United Kingdom and Switzerland: you may contact your national supervisory authority (in the UK, the Information Commissioner’s Office). Our representative for data-protection matters can be reached using the details at the end of this policy.
• California: we do not sell personal information and do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA.
• Thailand: under the Personal Data Protection Act B.E. 2562 (2019) you may request access, correction, deletion, restriction, portability and objection, and you may withdraw consent. You may complain to the Personal Data Protection Committee.
• Singapore: under the Personal Data Protection Act 2012 you may access and correct your data, withdraw consent, and register on the Do Not Call Registry. You may contact our data protection officer using the details below.
• Brazil: under the Lei Geral de Proteção de Dados (LGPD) you may confirm processing, access, correct, anonymise, port, delete and object, and you may petition the ANPD.
• Australia: under the Privacy Act 1988 and the Australian Privacy Principles you may access and correct your information and complain to the OAIC. We comply with the Notifiable Data Breaches scheme.
• Canada: under PIPEDA, and in Quebec under Law 25 (including its confidentiality, consent and portability requirements), you may access and correct your information, withdraw consent, and request portability where applicable.
• New Zealand: under the Privacy Act 2020 and the Information Privacy Principles you may access and correct your information and complain to the Office of the Privacy Commissioner.
• Japan: under the Act on the Protection of Personal Information (APPI) you may request disclosure, correction, suspension of use and third-party provision records.
• India: under the Digital Personal Data Protection Act 2023 you may access, correct, erase and nominate, and you may complain to the Data Protection Board of India. Our grievance officer can be reached using the details below.

16. Changes to this policy

We may update this policy to reflect changes to the Service or to legal requirements. We will post the updated policy on this page with a revised effective date, and where a change is material we will give additional notice (for example by email or an in-product notice) before it takes effect.

17. Contact us

If you have questions about this policy, want to exercise a right, or wish to complain about how your information has been handled, please contact Acme Tomato Agency by emailing support@getvidthanks.com or calling +1 5551212. You can also write to us at at 2406 Columbia Pike, Arlington, VA, 22204, United States.

This policy is governed by the laws of the United States of America, without prejudice to any mandatory consumer or data-protection rights you have where you live.

• Data controller: Acme Tomato Agency.
• Data-protection contact: John Davies.
• Privacy enquiries: support@getvidthanks.com.
• Telephone: +1 5551212.
• Postal address: 2406 Columbia Pike, Arlington, VA, 22204, United States.

18. Controller and processor roles in detail

Where Acme Tomato Agency determines the purposes and means of processing, it acts as a controller and this policy applies directly. That is the case for visitors to this website, for people who receive a message we send on our own behalf, and for the account, billing and security records of our customers.

Where a business customer uses Acme Review to collect or send content to its own clients, employees or patients, that customer decides who to contact, what to record, how long to keep it and which recipients receive it. That customer is the controller (or business associate, in HIPAA terms) and Acme Tomato Agency acts as its processor (or subcontractor business associate), processing only on documented instructions.

Where we act as a processor, we will: process personal data only on the controller's documented instructions, including for transfers, unless required otherwise by law (in which case we will inform the controller unless legally prohibited); ensure personnel are bound by confidentiality; implement the security measures described in section 8; assist the controller in responding to requests and in meeting its own compliance obligations; notify the controller of a personal-data breach without undue delay; and delete or return personal data at the end of the provision of services.

We will promptly inform the controller if, in our opinion, an instruction infringes applicable data-protection law. We are not responsible for the lawfulness of the controller's own instructions or for the accuracy of the data it supplies.

19. Subprocessors and supplier governance

We use the following categories of subprocessors: third-party infrastructure providers that process information on our behalf under written data-processing terms, including cloud hosting and storage, video transcoding and content-delivery networks, transactional email delivery, payment processing, customer-support tooling, error monitoring and product analytics. A current list, including the processing location for each, is available on request and is maintained as part of our records of processing.

Every subprocessor is bound by a written agreement that imposes data-protection obligations no less protective than those we owe to our own customers, including confidentiality, security, breach notification, assistance and audit commitments, and restrictions on onward transfer.

Where a Data Processing Agreement requires it, we will give advance notice of any new subprocessor and a reasonable opportunity to object on reasonable data-protection grounds. If an objection cannot be resolved, the controller may terminate the affected services without penalty.

We conduct risk-based due diligence on subprocessors before onboarding and on a periodic basis thereafter, and we review their security certifications, breach history and sub-processing arrangements.

20. International transfers and safeguards

Personal information may be processed in the United States, the European Economic Area, the United Kingdom, and the Asia-Pacific region. Where personal data is transferred out of a jurisdiction that restricts transfers, we rely on one or more of the following safeguards:

• An adequacy decision of the relevant authority (for example the European Commission adequacy decisions, UK adequacy regulations, or the UK Extension to the EU-US Data Privacy Framework where applicable).
• The European Commission Standard Contractual Clauses (2021 modules), supplemented by a transfer impact assessment and, where required, additional technical and organisational measures such as encryption in transit and at rest, pseudonymisation and access controls.
• The UK International Data Transfer Addendum to the EU Standard Contractual Clauses, where UK GDPR applies.
• The Swiss addendum to the Standard Contractual Clauses, where the Swiss FADP applies.
• Binding Corporate Rules or an approved certification mechanism, where we adopt one for a particular transfer.

21. Records of processing, impact assessments and prior consultation

We maintain records of our processing activities as required by Article 30 GDPR and equivalent provisions, including the categories of processing, the purposes, the recipients and the security measures applied.

Where a controller is required to carry out a data-protection impact assessment or a prior consultation with a supervisory authority in connection with the services, we will provide reasonable assistance, including the information about our processing that the controller reasonably needs, subject to confidentiality and to a reasonable charge where the assistance is extensive or bespoke.

We will inform the controller without undue delay if we become aware that a processing activity is likely to result in a high risk to the rights and freedoms of individuals.

22. Personal-data breach notification

We maintain an incident-response plan tested at least annually. If we become aware of a personal-data breach affecting personal data we process for a controller, we will notify that controller without undue delay and, where feasible, within seventy-two (72) hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Our notification will include, to the extent then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a point of contact for further information. Where not all information is available at the time of the initial notification, we will provide it in phases without undue further delay.

We will cooperate with the controller's own notification obligations to regulators and affected individuals, and will not notify regulators or individuals on the controller's behalf unless instructed to do so in writing.

We will document each breach, the facts, its effects and the remedial action taken, and will make that documentation available to the controller on reasonable request.

23. Handling data-subject requests

Individuals may send requests to exercise their rights to us directly or to the business customer that operates the workspace. Where we receive a request relating to data we process as a processor, we will refer it to the relevant controller without undue delay, and we will not respond substantively to the individual except to confirm the referral, unless instructed otherwise.

Where we act as controller, we will respond to a verifiable request within the period required by applicable law — one month under GDPR and UK GDPR, extendable by two further months where the request is complex; forty-five days under the CCPA/CPRA — and will tell the individual if an extension is needed and why.

We may ask for information needed to verify identity. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, explaining our reasons. We will not discriminate against an individual for exercising a right.

Where we process data as a processor, we will provide the technical and organisational assistance reasonably needed for the controller to respond within its own statutory deadline, including export tooling for access and portability requests and deletion tooling for erasure requests.

24. Retention schedule, deletion and return of data

Our indicative retention periods are set out in section 7. The following table expresses the same commitments in the form enterprise reviewers usually require; where a customer's contract specifies a different period, the contract prevails for that customer's data.

• Active account and workspace records: retained while the account is open.
• Content and generated videos: retained until deleted by the customer or until the plan's storage window expires, whichever is earlier; then deleted from primary storage and purged from backups within thirty-five (35) days.
• Recipient lists and delivery events: retained for twelve (12) months after the last campaign, unless a longer period is required for dispute resolution.
• Billing, invoice and tax records: retained for seven (7) years or the period required by local tax law, whichever is longer.
• Security and audit logs: retained for twelve (12) months, and longer where an investigation is open.
• Support tickets and chat transcripts: retained for twenty-four (24) months after closure.
• Backups: encrypted, retained on a rolling thirty-five (35) day cycle, and restored only for disaster recovery.
• Legal holds: data subject to a legal hold, litigation or a regulatory request is retained until the hold is released, even where the ordinary period has expired.

25. Artificial intelligence and machine-learning processing

Some features use machine learning to transcribe speech, generate captions or suggested copy, detect prohibited content, deduplicate records and summarise activity. These features assist human decision-making; we do not use them to make decisions that produce legal or similarly significant effects about an individual.

We do not use customer content to train general-purpose or third-party foundation models. Where we use a model provider, we configure the integration so that customer content is not retained or used for model training by that provider, and we document those configurations as part of our subprocessor review.

Where automated screening flags content, a human review route is available on request. Individuals may object to a solely automated decision and request human intervention, express their point of view and contest the decision.

Aggregated and de-identified statistics may be derived from usage data for operating, benchmarking and improving the services, provided they cannot reasonably be used to re-identify any individual, customer or client.

26. Government and law-enforcement requests

We respond to requests for personal data from law enforcement, regulators and courts only where the request is valid on its face, is limited in scope, and is issued by a body with competent authority. We review each request for legal validity and proportionality, and we challenge or narrow overbroad requests where we have grounds to do so.

Where we are permitted to do so, we will notify the affected customer before disclosing data, to give it an opportunity to object or seek a protective order. Where we are prohibited from notifying, we will seek the prohibition's removal and, failing that, disclose only the minimum data required.

We publish a transparency report, at least annually, summarising the number and categories of requests received and the proportion complied with in whole or in part, to the extent the law permits disclosure.

27. Complaints, feedback and contact

If you have a concern about how your personal information has been handled, please contact Acme Tomato Agency by emailing support@getvidthanks.com or calling +1 5551212 first. You can also write to us at at 2406 Columbia Pike, Arlington, VA, 22204, United States.

We will acknowledge a complaint promptly and aim to resolve it within thirty (30) days, telling you if we need longer and why. If you are not satisfied, you may complain to your local supervisory authority or data-protection regulator (for example the Information Commissioner's Office in the United Kingdom, your national authority in the EEA, the California Privacy Protection Agency, or the Personal Data Protection Committee in Thailand).

This policy is governed by the laws of the United States of America, without prejudice to any mandatory consumer or data-protection rights you have where you live.