Legal

1. Who is responsible

The controller is Ducky Monster Limited, Landscape House, Baldonnell Business Park, Dublin, D22 P3K7, Ireland. For data protection questions you can reach us at hello@duckymonster.com.

2. What data we process

• Account data, such as name, email address, sign-in details and account settings.
• Content data, meaning the source material you upload or link (video, audio, images and text), the videos the service generates from it, and your project and publishing settings.
• Connected account data, such as the platform account you link, its identifier and display name, the access tokens that let us publish on your behalf, and the results of publishing attempts. Access tokens are stored encrypted.
• Usage and device data, such as browser and device information, IP address, log data, security events and cookie choices.
• Billing data, such as your plan and transaction records. Card payments are handled by our payment provider; we do not store full card details.
• Support and communication data, such as messages, feedback and the information we need in order to handle your request.

3. Purposes and legal bases

• Providing the website, account and service, including processing your material and publishing where you direct us, to perform a contract or take pre-contractual steps (Art. 6(1)(b) GDPR).
• Security, abuse prevention, troubleshooting and improving the service, on the basis of our legitimate interests (Art. 6(1)(f) GDPR).
• Support and product communication, depending on the message on the basis of pre-contractual steps, consent or legitimate interests.
• Optional analytics or marketing, only where you have given consent (Art. 6(1)(a) GDPR).
• Legal, tax and accounting obligations, where we are required by law to process or retain data (Art. 6(1)(c) GDPR).

4. Material that contains other people

Material you upload may contain the images, voices or other personal data of people who are not you. Where that is the case, you are responsible for having a lawful basis and any necessary consents or releases before you upload or publish it. We process that material on your instructions as part of providing the service.

5. Automated processing

The service processes your material automatically, which may include automated editing, formatting, captioning and similar steps. These steps do not produce legal or similarly significant effects for you within the meaning of Art. 22 GDPR.

6. Consent and withdrawal

Where processing is based on consent, you can withdraw it at any time with effect for the future. The lawfulness of processing before withdrawal and statutory retention obligations remain unaffected.

7. Cookies and similar technologies

We use technologies that are necessary to provide the service, secure sessions, remember basic settings and prevent abuse. We use optional analytics or marketing technologies only where the required consent has been given. Details are on our cookie page.

8. Service providers and recipients

We use carefully selected service providers, for example for hosting and storage, media processing, email delivery, payments, customer support and security. They process data under appropriate agreements and on our instructions. Separately, when you connect a social platform and ask us to publish, your content and the related account data are sent to that platform, which handles them as its own controller under its own terms. We may also share data with authorities or courts where required by law. We do not sell personal data.

9. International transfers

Where possible we choose providers in the EU or EEA. Some providers, and most of the social platforms you can publish to, operate outside the EU or EEA. In those cases we rely on appropriate safeguards such as adequacy decisions, EU standard contractual clauses and, where necessary, additional protective measures.

10. Security and retention

We use technical and organisational measures to protect personal data against unauthorised access, loss, misuse and alteration, including encryption in transit and encryption of connected-account access tokens. We keep your content and account data while your account is active and for a limited period afterwards, keep log data for a shorter period, and keep billing records for as long as tax and accounting law requires. After that we delete or anonymise data where possible.

11. Your rights

You have rights of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time. You can also disconnect a linked platform at any time in your account, which revokes our access to it. To exercise your rights, write to hello@duckymonster.com. You may also lodge a complaint with a supervisory authority; ours is the Irish Data Protection Commission, www.dataprotection.ie.

12. Changes and contact

We may update this privacy policy when our services, legal requirements or processing activities change. We publish the current version here. Questions? Write to hello@duckymonster.com.