Privacy Policy

1. Who is responsible

The data controller for editedforyou.com is Andrius, a sole trader registered in Lithuania (individuali veikla), trading as Edited For You.

You can reach me about anything in this policy, including a request to see or delete your data, at support@editedforyou.com. I read and answer that inbox myself. I haven't appointed a data protection officer, as a one-person business doesn't need one.

2. What I collect

When you visit the site

• Pages you view and what you do on them: the buttons you click, which sections you reach, how far you scroll, how long the page is open in front of you, and which questions you open in the FAQ
• Your approximate country, worked out from your IP address, so the site knows whether to ask about cookies first
• Your device type (phone, tablet or computer) and your browser's user agent
• Where you came from: the utm_ tags on the link you clicked, and Meta's click ID (fbclid) if you came from a Meta ad
• Your IP address, which comes with every request your browser makes. It's used for the country check, and PostHog uses it to estimate your rough location.
• A session recording, but only once measurement is allowed (see section 9): a replay of your scrolling, mouse movement and clicks. Your email address is masked, so it's never recorded, and the card fields belong to Stripe, so they aren't recorded either.

When you buy

• Your email address, which you type at checkout. It's how the kit and your receipt reach you.
• Your payment details, which go straight to Stripe. You type them into Stripe's own fields, so your card number never passes through my site and I never see it.
• The purchase record: amount, date, Stripe's payment ID, the country your connection came from, and whether you'd allowed measurement
• Matching details for ads: your IP address, your browser's user agent and, if you allowed them, your Meta cookie IDs. These are stored with the payment at Stripe, so a sale can be matched to the ad that brought you. They're sent to Meta only if you allowed measurement.

The checkout asks for your email and nothing else of your own: no name, phone number or address. If you pay with Apple Pay or Google Pay, your wallet may also pass your name and billing address to Stripe.

When you email me

Your email address, your message and anything you choose to include. I use it to answer you.

3. Why, and on what legal basis

What	Why	Legal basis (GDPR)
Email address	To send you the kit, your receipt and help when you ask for it	Contract, Art. 6(1)(b)
Payment details and purchase record	To take the payment, handle refunds and keep the accounting records the law requires	Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c)
Country check	To decide whether to ask you about cookies before any tracking starts	Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f)
Page counts without cookies	To see which parts of the page work, even for visitors who haven't chosen or who declined. No cookies, no recording, and a new random ID on every page.	Legitimate interest, Art. 6(1)(f)
Meta pixel and conversion measurement, PostHog with cookies, session recording	To see which ads and which parts of the page lead to a sale, so I don't pay for ads that don't work	Consent, Art. 6(1)(a)
Server logs and fraud checks	To keep the site running and stop fraudulent payments	Legitimate interest, Art. 6(1)(f)
Your emails to me	To answer you	Contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f)

Where the basis is consent, you can withdraw it at any time and it costs you nothing (see section 9). Withdrawing doesn't undo measurement that already happened.

I don't make automated decisions about you, and I don't profile you beyond the ad measurement described here.

4. Who else sees it

These companies receive data so the site can run. Most act only on my instructions. Stripe and Meta also use some of it for their own purposes, such as fraud prevention and ad delivery, under their own policies. I don't sell your data, and I don't share it with data brokers or list sellers.

Who	What they get	Where
Stripepayments	Your email, payment details, the purchase, and the matching details above. Stripe also runs its own fraud checks on the checkout page.	USA and Ireland Privacy policy
Metaad measurement	If you allow measurement: that a page view, checkout or purchase happened, your IP address, user agent and Meta cookie IDs. If you buy, your email address is hashed (SHA-256) before it's sent, so Meta gets a fingerprint, not the address.	USA and Ireland Privacy policy
PostHoganalytics and session replay	Page views, clicks, scrolling, device type, UTM tags, IP address and, if you allow it, the session recording	European Union Privacy policy
Vercelhosting	Standard server logs, including your IP address, as a by-product of serving the pages. Vercel also tells the site which country a visit comes from.	USA Privacy policy
Resenddelivery email	Your email address and order number, to send you the link to your kit	USA Privacy policy
Hostingeremail inbox	The emails you send to support@editedforyou.com and my replies	EU company Privacy policy
Google Fontsfonts	The site's font loads from Google, so Google receives your IP address and browser details when a page opens. Google Fonts sets no cookies.	USA and Ireland Privacy policy

I may also disclose data if the law really requires it, or to establish or defend a legal claim. If that ever happens and I'm allowed to tell you, I will.

5. What never reaches me

• Your card number. It goes from your browser to Stripe. My site never receives it.
• Your videos. The kit runs on your own computer. Your recordings, the edits, thumbnails and shorts stay there. I never get a copy.
• What you do in Claude. You use Claude in your own account, under Anthropic's privacy policy. What Claude reads to edit your video (your words and a few still frames) goes to Anthropic, not to me. I receive nothing from Claude about you.
• Your YouTube channel. I never get access to it. You upload your videos yourself.

6. Data sent outside the EU

Stripe, Meta, Vercel, Resend and Google process some data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the company is certified, the EU–US Data Privacy Framework. PostHog keeps the analytics and session recordings on its EU servers, and Hostinger is an EU company.

7. How long I keep it

• Purchase records and invoices: 10 years, the accounting retention period in Lithuanian law
• Your email address as a customer: as long as you have access to the kit, so I can send you updates and help. The purchase record above keeps it for accounting.
• Support emails: up to 2 years, then deleted
• Analytics events: 12 months in PostHog
• Session recordings: 1 month, then deleted automatically
• Server logs: a short time, under Vercel's own limits
• Meta measurement data: under Meta's own retention rules, which I don't control

8. Your rights

If the GDPR applies to you, you have the right to:

• See what I hold about you and get a copy
• Correct anything that's wrong
• Have it deleted, except the purchase records I must keep for accounting
• Restrict or object to processing based on legitimate interest
• Take it elsewhere in a portable format
• Withdraw consent for measurement at any time, with Cookie settings

Email support@editedforyou.com and I'll deal with it within 30 days. It's free and you don't have to say why. I may only ask for enough detail to be sure the request really comes from you.

If you're unhappy with how I handle it, you can complain to Lithuania's State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the data protection authority where you live.

If you live in California or another US state with a privacy law, you may have similar rights to see and delete your data. The same email address is how to use them. I don't sell or share personal information in the sense those laws mean, beyond the Meta measurement you can switch off below.

9. Cookies and your choice

Cookies are small files a site stores in your browser. Similar notes kept in "local storage" work the same way, so they're in the list too.

What happens before you choose

If you're in the EU, the EEA or the UK, or your country can't be determined, you see a banner, and no tracking cookies are set until you press Accept. Until then:

• Meta's script file is downloaded from Meta's servers, which means Meta can see your IP address in that request. It sends no events and sets no cookies.
• PostHog counts page views and clicks without cookies. Every page load gets a new random ID, and nothing is recorded.

If you're in a country where the law doesn't require a banner, such as the USA, Canada, Australia or New Zealand, measurement starts when the page loads. You can switch it off at any time with the button below.

The full list

Name	Set by	What for	Lasts
lk_consentlocal storage	Edited For You	Remembers your cookie choice so you're not asked again. Needed for the banner to work.	Until you clear it
lk_geosession storage	Edited For You	Remembers whether your country needs the banner, so the site checks once per visit. Needed.	Until you close the tab
__stripe_mid, __stripe_sid	Stripe	Fraud prevention, only on the checkout page. Needed to take a payment safely.	1 year / 30 minutes
mon m.stripe.com	Stripe	Fraud prevention, only on the checkout page. Needed.	About 13 months
__cf_bm	hCaptcha, for Stripe	A bot check during payment, only on the checkout page. Needed.	30 minutes
_fbp	Meta	Recognises your browser so a purchase can be matched to the ad you saw. Needs your consent.	90 days
_fbc	Meta	Keeps the click ID when you arrive from a Meta ad, for the same matching. Needs your consent.	90 days
lastExternalReferrer, lastExternalReferrerTimelocal storage	Meta	Notes which site sent you here, for the same matching. Needs your consent.	Until you clear it or decline
ph_phc_…_posthogcookie and local storage	PostHog	Tells one visit from the next and makes session recording work. Needs your consent.	1 year

Meta's cookies are the only advertising cookies on this site. The demo videos on the page are served from this site, not embedded from YouTube, so they set no cookies.

Changing your mind

This button reopens the choice. If you decline, the Meta and PostHog cookies already in your browser are deleted and the page reloads, so neither keeps running.

Cookie settings

You can also clear cookies in your browser settings or use a tracker blocker. The site works normally with all of it blocked, and declining changes nothing about the price you pay or your 14-day refund.

10. Children

Edited For You is sold to adults who run a business and isn't aimed at children. I don't knowingly collect data from anyone under 16. If you think a child has given me data, email me and I'll delete it.

11. Security

The site runs over HTTPS. Payments are handled entirely by Stripe, which is certified to PCI DSS Level 1, so card details never sit on my systems. Secret keys live in the hosting settings, not in the code.

If a breach ever puts your rights at risk, I'll report it to the supervisory authority within 72 hours and tell you directly.

12. Changes

If this policy changes, the date at the top changes with it. If a change is significant, such as a new company receiving your data or a new purpose for it, I'll ask for your consent again rather than rely on the old one.