Privacy Policy
Last updated: March 22, 2026
1. Controller
The controller responsible for data processing is:
Holger Sadek, BSc, Berggasse 20, 1090 Vienna, Austria
Email: hello@yul.io
2. Processed data
When using yul.io, the following personal data may be processed:
- Account data: name, email address, password, profile picture
- Event data: recipient name, occasion, date, images
- Participant data: name and email address (required), optional videos, images and comments
- Technical data: IP address, browser information and access data (server logs)
- Token-based access data for share and surprise links
3. Purposes of processing
Personal data is processed for the following purposes:
- Providing and operating the platform
- Creating and managing video gifts
- Technical processing and rendering of content
- Communicating with users, for example by email
- Ensuring system security and preventing misuse
4. Legal bases
Personal data is processed on the basis of the following legal grounds:
- Art. 6(1)(b) GDPR for the performance of a contract
- Art. 6(1)(f) GDPR for legitimate interests in secure and reliable operation
- Art. 6(1)(a) GDPR based on consent, in particular when users submit data or upload content
5. Hosting and infrastructure
yul.io uses the following technical service providers:
- Cloudflare (Pages, Workers, D1, R2 – EU region)
- Amazon Web Services (S3 and EC2 in Ireland, CloudFront)
- Mailgun (EU) for email delivery
- Stripe for payment processing
- Cloudflare Turnstile for bot protection
These providers process data only to the extent necessary to provide their services.
Processing generally takes place within the EU or EEA. Where providers are based outside the EU/EEA or data transfers cannot be fully excluded, transfers may be based on appropriate safeguards such as standard contractual clauses.
6. User content
Users may upload content such as videos, images and text.
Such content may contain personal data.
Processing takes place solely for the purpose of providing the platform and creating the final video compilation.
7. Email communication
yul.io sends transactional emails only, for example:
- verification emails
- comment notifications
- upload confirmations
- render status updates
- payment confirmations
- support communication
No newsletters or marketing emails are sent.
8. Payment processing
Payments are processed through Stripe Checkout.
In this context, personal data such as payment-related information may be processed.
The exact scope of processing depends on Stripe’s standard checkout process and the data provided there.
Payment processing is carried out directly by the payment service provider.
10. Server logs
When accessing the platform, technical access data may be processed, such as IP address, timestamp, browser information and request data.
These logs are provided through Cloudflare as part of the infrastructure.
Storage is based on Cloudflare’s default logging configuration and any applicable legal retention obligations.
11. Retention period
Content is stored for at least 6 months.
Users may delete content, events and accounts themselves at any time.
At present, no automatic final deletion takes place without user action.
Statutory retention obligations remain unaffected.
12. Rights of data subjects
Users have the following rights under the GDPR:
- access to stored personal data
- rectification of inaccurate data
- erasure
- restriction of processing
- data portability
- objection to processing
13. Right to lodge a complaint
Data subjects have the right to lodge a complaint with a supervisory authority.
In Austria, the competent authority is the Austrian Data Protection Authority.
14. Sources of data
Data is collected either directly from users, for example when creating an account or uploading content, or automatically when using the platform.
Data may also be provided by other users within the context of an event, for example where an owner enters recipient details or participants contribute content.
15. Data relating to third parties
Users may upload content that contains personal data of other persons.
Users are responsible for ensuring that they are authorized to share and submit such data for processing.
16. Changes
This Privacy Policy may be updated if necessary.