Privacy Policy
Effective 22 September 2026 · Last updated 22 September 2026
Boreo ("Boreo," "we," "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, and safeguard your data when you use Boreo.
We comply with the EU General Data Protection Regulation (GDPR) and applicable Dutch data protection law.
1. Data controller
Boreo is the data controller responsible for your personal data.
Contact: our contact form at boreo.app/support · Post: Boreo, Netherlands (registered address available on request).
2. What data we collect
Account information
- Email address
- Name (if provided)
- Password (hashed, never stored in plaintext)
- Profile preferences
- Timezone and language settings
Billing information
- Payment method details (processed and stored by Stripe, not by Boreo)
- Billing history
- Subscription tier and status
- Credit balance and consumption history
Usage data
- Videos generated and their metadata
- Reference materials you upload
- Generated scripts, thumbnails, and video content
- Publishing history and platform destinations
- Learning system signals (aggregated performance data)
Technical data
- IP address
- Browser type and version
- Device information
- Cookies and similar technologies
Communications
- Support requests and correspondence
- Marketing preferences (opt-in only)
3. How we use your data
Provide the service
- Create and manage your account
- Process payments and manage subscriptions
- Generate videos and manage the AI pipeline
- Publish content to third-party platforms at your direction
- Provide customer support
Improve the service
- Analyze aggregate usage patterns
- Improve AI recommendation accuracy through the learning system (using anonymized aggregate signals only)
- Identify and fix technical issues
Legal and security
- Comply with legal obligations
- Prevent fraud and abuse
- Enforce our Terms of Service
Communications
- Send transactional emails (account confirmations, billing receipts, service updates)
- Send marketing communications (only if you opt in — you can unsubscribe anytime)
4. Legal basis for processing (GDPR)
We process your data under the following legal bases:
- Contract performance: processing necessary to provide the service you subscribed to
- Legitimate interest: analytics, security, service improvement (balanced against your rights)
- Consent: marketing communications, optional features (you may withdraw consent anytime)
- Legal obligation: tax, accounting, regulatory compliance
6. AI training on your data
We do not train AI models on your content. Your reference videos, scripts, generated videos, and other personal content are used solely to provide the service to you. They are not used to train or improve underlying AI models.
Our learning system uses aggregated, anonymized signals (such as which patterns correlate with viral videos in specific niches) to improve recommendations. This does not involve training AI models on your specific content.
7. International data transfers
Some of our processors operate outside the European Economic Area (EEA). When we transfer your data internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Additional technical safeguards where required
8. Data retention
We retain your data for as long as your account is active and for a limited period after account deletion:
- Account data: retained for 90 days after account deletion, then permanently deleted
- Generated content: retained for 90 days after account deletion, then permanently deleted
- Billing records: retained for 7 years as required by Dutch tax law
- Support communications: retained for 2 years for quality and legal purposes
- Aggregated learning system signals: retained indefinitely in anonymized form
9. Your rights (GDPR)
You have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate data
- Erasure ("right to be forgotten"): request deletion of your data
- Portability: receive your data in a structured, machine-readable format
- Restrict processing: limit how we process your data
- Object: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent
- Complain: lodge a complaint with a supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens)
To exercise these rights, use our contact form at boreo.app/support. We will respond within 30 days.
11. Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encrypted data transmission (TLS/SSL)
- Encrypted data storage
- Access controls and authentication
- Regular security reviews
- Incident response procedures
In the event of a data breach affecting your personal data, we will notify you and the relevant authorities within 72 hours as required by GDPR.
12. Children's privacy
Boreo is not intended for individuals under 18. We do not knowingly collect data from minors. If you believe we have collected data from a minor, contact us through our contact form at boreo.app/support for immediate removal.
13. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email at least 30 days in advance.
14. Contact
For privacy questions, contact us through our contact form at boreo.app/support or by post at Boreo, Netherlands.