Privacy policy
Last updated: 30 August 2026
GoScratch generates short videos from a topic you provide. This document sets out exactly which data is processed to deliver this service, and which is not. It describes the product as it currently operates.
1. Data controller
The data controller is Wissem Hadhri, sole trader (entrepreneur individuel), whose registered office is at 66 avenue des Champs-Élysées, 75008 Paris, France, registered under SIREN 101 759 082.
For any question regarding your data: privacy@goscratch.h2wi.fr.
2. What GoScratch does not collect
We start here, because it is usually what matters most to you:
- No bank card number. Payments are handled entirely by Stripe. Your banking details never pass through our servers and are never stored there.
- No IP address, no user-agent in our application logs. GoScratch application logs do not record this information.
- No advertising cookie, no ad network, no resale of data. We do not use targeted advertising and do not sell any data. Cookies strictly necessary for the operation of the service (authentication and security) do not require your consent. We also use an audience-measurement tool (Google Analytics), described in section 3.5: it is only activated with your consent, and declining it has no impact on your access to the service.
- No profiling, and no automated decision producing legal effects concerning you.
3. Data processed
3.1 Identity
Authentication is handled by Clerk. Your name, your password and your sign-in data are kept by Clerk, not by GoScratch. Our databases link your videos to a pseudonymous technical identifier provided by Clerk, not to your name.
One exception, and only one: your email address. Since 30 August 2026 we keep a copy of it so that we can tell you when a video you started is ready. It is recorded when you first create a video, in a table separate from your billing data, and it is used for nothing else: no newsletter, no marketing message, and no disclosure to any third party other than the delivery service described in section 5.
You may ask for it to be erased at any time (section 7). You will keep full access to the service — you will simply no longer be notified by email, and your videos will remain visible from your dashboard.
Apart from that address, our administration interface can only display an identifier, and not a name.
3.2 Content you create
- the topic and generation parameters you enter;
- the generated scripts and the versions you validate or regenerate;
- the media selected and the files you upload, including their original name;
- the synthetic voice, the subtitles and the final produced video.
3.3 Billing
We keep a local copy of subscription information from Stripe: plan subscribed, status, Stripe customer, invoice and payment identifiers, amounts and currencies. This information is used to display your subscription status and history without querying Stripe on every view.
3.4 Technical logs
Each generation produces a log of the steps executed, their duration, the number of tokens consumed and the estimated cost. This log is used for diagnostics, quota calculation and the traceability of your validations. It contains neither IP address nor user-agent.
3.5 Audience measurement (Google Analytics)
To understand how the service is used and improve it, we use Google Analytics 4, provided by Google. This tool places cookies and measures usage statistics: pages viewed, traffic source and key events (creating a video, downloading, subscribing).
This measurement is subject to your consent. On your first visit, a banner lets you accept or decline it. Until you have accepted, no measurement script is loaded and no data is sent to Google (Google Consent Mode v2, storage denied by default). You may withdraw your consent at any time via the “Manage cookies” link at the bottom of the page; your choice is kept for twelve months.
Measurement data is linked to a technical identifier specific to Analytics, separate from your account. Google acts as a data processor for audience measurement; transfers outside the European Union may occur depending on your location and Google’s infrastructure, framed by appropriate safeguards (standard contractual clauses).
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide the video generation service | Performance of the contract |
| Manage the subscription, quotas and billing | Performance of the contract |
| Notify you by email that a video you started is ready | Performance of the contract |
| Ensure security and diagnose incidents | Legitimate interest |
| Keep a record of your editorial validations | Legitimate interest · legal obligation (accounting, for billing) |
| Measure site audience and improve the service | Consent |
5. Sub-processors
Delivering the service requires the use of providers. The main sub-processors that may process personal data concerning you notably include the following:
| Provider | Role | Data transmitted |
|---|---|---|
| Clerk | Authentication and account management | Name, email address, login credentials |
| Stripe | Payment and subscription | Payment details, billing address |
| Google (Gemini) | Script generation | The topic and generation parameters you enter |
| Google (Analytics) | Audience measurement (subject to consent) | Measurement identifier and pseudonymous usage data |
Hosting: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany), servers located in Germany.
6. Retention periods
We keep each item of data only for as long as necessary for its purpose:
- User account — for the entire life of the account. An account left inactive for two years is deleted, after prior notice.
- Generated content, uploaded videos and images, projects — kept while the account is active; in the event of inactivity, deleted at the end of the two years, unless a legal obligation requires otherwise.
- Notification email address — kept while your account is active, and erased immediately on request. It follows the deletion of the account and is not subject to the ten-year retention of accounting data, which does not cover it.
- Security technical logs — from six months to one year.
- Billing data — ten years, in accordance with accounting obligations (Article L123-22 of the French Commercial Code).
- Support exchanges — three years after the last contact.
- Technical backups — kept on a rotation of thirty days maximum, then automatically overwritten.
When you request the deletion of your account or your data, it is carried out as soon as possible, at the latest within one month (which may be extended to three months for complex requests), subject to data covered by a legal retention obligation. Deleted data may remain temporarily in the technical backups before being automatically overwritten at the end of the rotation period.
7. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability regarding your data, as well as the right to lodge a complaint with the competent supervisory authority.
These rights may be exercised at privacy@goscratch.h2wi.fr. As your name and email address are held by Clerk, a request concerning these items may require action on their side; we will assist you with this.
8. Content generated by artificial intelligence
The scripts, voices and edits produced by GoScratch are generated automatically. The service submits the script then the media to you for validation before producing the final video: these validation steps are recorded in order to establish who approved what, and when.
As this content is produced by an automated process, it may contain inaccuracies; it is your responsibility to check it before any distribution. You remain responsible for the use you make of the generated content and must comply with the law and the rights of third parties. The detailed liability terms are set out in the terms of use.
9. Amendments
Any change to this policy will be published on this page, with an update to the date shown at the top.