Privacy Policy

Last updated: October 7, 2026

Lanternaut is a sole-proprietor business operating under the brand name Lanternaut ("Lanternaut", "we", "us", "our"). This policy explains what personal data we collect, why, and the choices and rights you have.

1. Who we are

Lanternaut provides video and image hosting and streaming infrastructure for businesses and developers at https://lanternaut.com.

For account data, website data, and billing data, Lanternaut is the data controller. For personal data contained in content that customers upload, see section 10.

For privacy questions and data requests, email [email protected].

2. What we collect

• Account data: your name, email address, password, and account settings. Passwords are stored securely using one-way hashing and never in plain text.
• Billing data: payments are handled by Paddle, our Merchant of Record. We receive limited billing information, such as your plan, payment status, country, and receipts. We never see or store full card numbers.
• Customer content: the videos, images, and metadata you upload.
• Usage data: storage used, data delivered, encoding minutes, and API requests. We need this for billing and service limits.
• Technical data: IP addresses, browser or client information, and request logs, used for security, abuse prevention, rate limiting, and fixing problems.
• Support data: the content of emails you send us.
• Viewer data: when people watch our customers' videos, we process technical data (such as the IP address and the request itself) only to deliver the video and count usage.

3. Why we use data

We use personal data to:

• provide, operate, and maintain the Service;
• manage your account, billing, plan limits, and wallet;
• keep the Service secure and prevent fraud and abuse;
• provide support and communicate with you about your account and the Service;
• fix problems and improve the Service;
• meet legal obligations.

We do not sell personal data. We do not use customer content for advertising or to train AI models.

4. Legal bases

Where the law requires a legal basis (for example, under the EU and UK GDPR), we rely on:

• Contract: to provide the Service and manage your account, billing, and usage.
• Legitimate interests: to keep the Service secure, prevent abuse, fix problems, provide support, and improve the Service.
• Legal obligation: to meet legal requirements, such as keeping billing records required by tax law.
• Consent: for any optional cookies or emails that need consent. We currently use only essential cookies.

5. How long we keep data

• Account data and settings: kept while your account is open, then deleted within 30 days after it closes, except billing records.
• Usage and billing records: kept as long as tax and accounting law requires.
• Technical and request logs (including IP addresses): kept for up to 30 days, then deleted.
• Viewer technical data: used only in those logs and in usage counts. Usage counts do not contain IP addresses.
• Essential login cookies: expire when you log out or after 30 days of inactivity.
• Original uploaded files: deleted 7 days after encoding unless you select "Keep original". Kept originals stay until you delete them.
• Encoded videos and images: kept until you delete them or close your account.
• Closed accounts: content is deleted within 30 days after the account is closed.
• Unpaid accounts: content is deleted if the account is still unpaid 60 days after a failed subscription payment. We send warning emails before deletion.
• Accounts terminated for breaking our rules: violating content is removed immediately. Remaining content is deleted within 30 days, except where we are legally required to keep it longer, for example preserving reported illegal content for the authorities.
• Sandbox clips: deleted automatically after 24 hours.
• Temporary processing copies: deleted as soon as processing finishes, and in any case within 24 hours.
• Support emails: kept for as long as needed to handle your request and keep a record of our support history.

6. Who we share data with

We share personal data only with service providers that help us run the Service, and only as needed for that purpose:

Business customers can request our current list of subprocessors at [email protected]. It is provided under a Data Processing Agreement.

We may also disclose data if the law requires it, to respond to valid legal requests, or to protect the rights, safety, and security of our users, the public, or the Service.

7. International transfers

Our service providers may process data in countries other than your own, including the United States and the European Union. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses offered by our providers.

8. Cookies

We use only essential cookies that keep you logged in to the dashboard and keep the Service secure. We do not use website analytics tools or advertising trackers. If this changes, we will update this policy and ask for consent where the law requires it.

9. Automated scanning

Uploads are automatically scanned to detect content that breaks our Acceptable Use Policy, such as known illegal material. Automated scanning may block or remove content. If you believe content was removed by mistake, email [email protected] and a person will review it.

10. Customer content and our role as processor

Customers decide what content they upload and are responsible for it. For personal data contained in customer content, the customer is the controller and we act as a processor. We process that data only to provide the Service on the customer's behalf. A Data Processing Agreement is available on request at [email protected].

If you appear in a video hosted by one of our customers and want to make a request about it, please contact that customer first. You can also contact us at [email protected] and we will help where we can.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on consent.

We offer these rights to everyone, wherever you live. Send requests to [email protected]. We respond within 30 days. We may need to confirm your identity first. Legal obligations, such as keeping billing records, may limit what we can delete.

You also have the right to complain to the data protection authority in your country.

12. Children

The Service is not for people under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.

13. Security

We protect data with encryption in transit, access controls, hashed passwords, and signed, expiring playback links. No system is completely secure. If a data breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

14. Changes to this policy

We may update this policy. The "Last updated" date shows the latest version. We will email account holders about material changes.

15. Contact

For privacy questions or data requests, email [email protected].