Privacy policy

In short

• Phizm sells files, not a service that watches your videos. Skills run in your own Claude, on your machine: your footage never goes through our servers.
• We only keep what is needed: your account, credits, purchases, unlocked skills and the videos you choose to publish in the community.
• No ads, no advertising trackers. Vercel audience analytics are anonymous and cookieless. The only cookies keep you signed in and remember your language.
• Your card details never reach us: payment happens at Stripe.
• You delete your account yourself, in one click, from your settings.

Data controller

Brian Biendou EI, Sonnerie 10, 8 rue de la Mayenne, 31100 Toulouse, France, SIRET 919 153 189 00015. For any question about your data: contact@phizm.fr.

No data protection officer is appointed: the business is not one of the cases where it is mandatory. Requests are handled directly by the publisher.

Data we process

Your account

Your email address, your password (stored irreversibly hashed by our authentication provider, never readable by us), your display name, username, your avatar if it comes from a Google or GitHub sign-in, your language, the topics picked during onboarding and your account creation date.

Your activity on Phizm

Your balance and credit history, unlocked styles and their installed version, favorites, the styles you suggest, and temporary install links (valid ten minutes, single use).

Your purchases

For each order: the item, amount, VAT, status, date, acceptance of the terms and the payment identifiers sent by Stripe. Your billing address and payment method are collected by Stripe and stay at Stripe: we never see your card number.

The community

If you publish an edit: the video, its preview image, its title, the style used, the Instagram or TikTok link you add, your rights statement, the moderation status and the date. Once approved, your display name, username and avatar appear with it.

GitHub, if you connect it

Your GitHub username, the Phizm app installation and the name of the private repository your skills are copied to.

Technical data

Our hosting providers' logs (IP address, browser, requested page, errors) and anti-abuse counters tied to your identifier, which limit the number of requests over a short period. The country derived from your IP address is only used to pick the language of your first visit: it is not stored.

Audience analytics

The website is measured with Vercel Web Analytics and Vercel Speed Insights: page views, referring page, country, device type, browser and load times. These tools set no cookie and create no identifier that would follow you from one visit to the next: we see totals, not visitors. Legal basis: legitimate interest (knowing which pages are useful and which are slow).

What we do not collect

The videos you edit with a skill, your conversations with Claude, your Claude key or account. Phizm sends no data to Anthropic.

Purposes and legal bases

• Performance of the contract: creating and managing your account, selling and delivering skills, managing credits and subscriptions, publishing your community videos, sending emails about your account and purchases.
• Legal obligation: keeping invoices and accounting records, answering requests from an authority.
• Legitimate interest: securing the service, preventing fraud and abuse (rate limits, moderation), defending our rights in a dispute.
• Consent: any optional processing, which you can withdraw at any time. None is in place today.

Recipients and processors

Your data is never sold, rented or transferred. Only these providers access it, each for its own task and under contract:

• Supabase, Inc.: database, sign-in and file storage (skills, community videos). Project hosted in Ireland (eu-west-1 region).
• Stripe Payments Europe, Ltd. (Ireland): payments, subscriptions, invoices and receipts, fraud prevention. Stripe also acts as a controller for its own legal obligations.
• Brevo (Sendinblue SAS, France): sign-in, confirmation and purchase emails. Your address and name are sent for that purpose only.
• Vercel Inc. (United States): website hosting and delivery, anonymous cookieless analytics.
• Cloudflare, Inc. (United States): domain name, network protection, storage and delivery of demo videos (stored in Western Europe).
• GitHub, Inc. (United States): only if you connect your GitHub account, to copy your skills to your private repository.

Transfers outside the European Union

The database and files stay in Ireland. Vercel, Cloudflare, GitHub and the parent companies of Supabase and Stripe are US companies: some technical data may pass through the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's standard contractual clauses included in their data processing agreements.

Retention periods

• Account, credits, unlocked skills, favorites, style suggestions: as long as your account exists. Erased immediately when you delete it.
• Community videos: as long as they are published and your account exists. A rejected video is deleted during moderation. You can ask for a published video to be removed at any time.
• Orders: as long as your account exists in our database. Invoices and payment records are kept for ten years in our Stripe account, even after account deletion, as required by article L. 123-22 of the French Commercial Code.
• Install links: valid ten minutes, erased one day after expiry.
• Anti-abuse counters: one day at most.
• Technical logs: a few days at most at our hosting providers, then deleted automatically.
• Backups: our current hosting plan has no restorable backup. Deleted data is gone for good.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death.

You edit your profile and delete your account yourself from your settings: deletion is immediate and permanent (account, credits, unlocked skills, favorites, community videos and their files).

For any other request, write to contact@phizm.fr from your account address. We reply within one month at most. If you disagree, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of your country.

Cookies

Phizm only uses strictly necessary cookies: they are listed on the Cookies page.

Minors

Phizm is for people aged 16 and over. We do not ask for ID. If we are told an account belongs to someone younger, it is deleted.

Security

Encrypted connections (HTTPS), access rights checked row by row in the database, skill files and community videos in private storage served through short-lived signed links, payments handled by Stripe. No system is flawless: if a data breach puts you at risk, you will be told.

Language

This page is a translation. The French version is the legally binding one.