Your data,
in plain words.

Last updated: October 18, 2026

1. Who is responsible

The controller for Candela (candela.mov) and the Candela Recorder is Dafin SA, route de Saconnex-d'Arve 131, 1228 Plan-les-Ouates (“we”, “us”). For any question about your data, write to privacy@candela.mov.

When the customer is the controller. For the films and the product material a customer organisation brings (briefs, websites, screens, recordings, Recorder captures, review notes), the customer is the controller and we process the data on its behalf, as its processor, under our terms and, on request, a data processing agreement. Requests about that data are best sent to the customer; we pass on any we receive.

Which law. We are established in Switzerland and apply the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example to people in the EU or the EEA, this policy also gives the information it requires (Art. 13 GDPR).

2. What we collect

• Accounts: email, display name, a password hash (Argon2id; never the password), organisation memberships and roles, and the language chosen for the app.
• Organisations: the organisation's name, its members and their roles, and invitations (the invited address, who sent it, when it was used).
• Sessions: a hash of the session cookie, dates, and the browser's user agent.
• Films: titles, briefs, scripts, narration text, review notes and their authors, approvals, and the rendered films.
• Product material: screenshots and page snapshots of the customer's product, from a website capture, an uploaded screen recording or the Candela Recorder. These can show whatever the product shows, including names or customer records if they were on screen. Websites are captured from our server in Switzerland.
• GitHub repositories: when a customer connects GitHub, Candela reads the repositories they choose (release notes, pull requests, documentation and the images in them) to make their films. Only the material extracted is kept, with the film's sources, and it is deleted with them. No GitHub access token is stored.
• Billing: the company name, billing country, VAT number, the buying owner's email, the Candela packs bought, the frames used and the auto-renewal setting. Card and TWINT details go straight to Stripe; we never see them (a renewal uses Stripe's reference to the saved card). Stripe issues and keeps the invoices for us.
• Logs: an audit log of who did what (user id, client IP address, without secrets); anonymous records of visits to external share links (a hash of the address, the browser family); and technical application logs (user, film and job ids, error messages). Our web server keeps no access log.
• Cookies: only strictly necessary ones; see section 11.
• Showcase: a film is shown on candela.mov only if an owner of its organisation turned on “Show on candela.mov”, knowing that anyone can then watch it there. Only its preview (a lighter encode of the film, never the full-quality file) and poster become public, and the organisation's name only if the owner chose to show it. Turning it off removes the film at once.
• Thumbs up: a vote stores the film, the time, and either your account (if you are signed in) or a one-way hash of a random vote cookie (candela_vote), set only when you give a thumbs up. Your IP address is never stored; it is used in memory only, to limit abuse. You can withdraw a vote; votes are deleted after 90 days.
• Help bot and support questions: the “Questions?” bot recognises keywords in your browser; it is not an AI. A question it cannot match is kept as text only (at most 300 characters) with the page and language, without your IP address, session or email. If you send a question to our support team, we store your email, the name you give, your message, the page and the language, and email them to our support address so that we can reply. Support questions belong to no organisation's data.

Not collected or stored: passwords or tokens in clear, card or TWINT details, voice samples (there is no voice cloning), tracking or advertising data.

3. The Candela Recorder

• It records only the browser tab where the user presses Record, only until Stop, never while paused.
• Password fields are always masked; all other inputs are masked by default; users can mask any element on screen, and masked areas are covered in screenshots.
• Nothing is uploaded before the user reviews the steps and presses Send to Candela. Until then the recording stays in the browser and can be discarded.
• Uploads go over HTTPS to candela.mov only, for the one film the capture link names. The server masks password-like values again on arrival and deletes the raw upload once the product kit is built.
• The extension contacts no other server and loads no remote code. It does not read browsing history, cookies or other tabs. More for IT departments: candela.mov/recorder/it.

4. Why we use it, and on what legal basis

• To provide the service (accounts, sign-in, making, storing and delivering films, support): performance of our contract with the customer organisation, and our legitimate interest in running the service for the people it invites (Art. 6(1)(b) and (f) GDPR).
• The customer's material: processed only on the customer's instructions, to make its films (Art. 28 GDPR; art. 9 FADP).
• Billing, invoicing and accounting: the contract and our legal obligations, including keeping accounting records (Art. 6(1)(b) and (c) GDPR; art. 958f Swiss Code of Obligations).
• Security, abuse prevention and the audit log: our legitimate interest in protecting the service, the customers' data and our rights (Art. 6(1)(f) GDPR).
• The showcase and its thumbs up: a film appears on candela.mov only because an owner of its organisation chose to show it there (the customer's instruction); votes are counted, and limited against abuse, in our legitimate interest in showing the films people like, fairly (Art. 6(1)(f) GDPR).
• Answering support questions and improving the help bot: steps taken at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering questions and improving the bot's answers (Art. 6(1)(f) GDPR). We use your email only to answer that request.

We do not sell personal data, use it for advertising or profile anyone, we make no automated decisions with legal effect, and we do not use customer material to train AI models.

5. Where it is stored

On Infomaniak Public Cloud in Geneva, Switzerland: the application, its database, its file storage and the encrypted backups. Some data is sent to the providers below, one request at a time, to do their part of the work.

6. Who processes it for us

A short list of providers, each bound by contract to process the data only for us. The full list, with what each receives and the safeguards, is on the subprocessors page.

7. Transfers abroad

Anthropic, ElevenLabs, Stripe and Google may process data in the United States, and Microsoft may access the emails it handles from there for support. Neither Switzerland nor the EU considers the United States to offer adequate protection in general. We transfer data there only with appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the Swiss addendum) or the Swiss-US and EU-US Data Privacy Framework where the provider is certified. You can ask us for a copy of the safeguards.

8. How long it is kept

9. Your rights

You may ask for access to your data and a copy in a common format, its correction or deletion, the restriction of its processing, and you may object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time.

• Your own data: while signed in, candela.mov/auth/me/export downloads everything stored about you (account, memberships, sessions, the notes you wrote, your own actions in the audit log) as one file.
• An organisation's owner can export all of the organisation's data as one zip file: members, films and their files, product kits, billing, costs and the audit log.
• A member can delete a film; everything made from it is deleted (files, kits, recordings), and it leaves the backups within 12 months.
• Accounts and whole organisations are deleted on request; billing records stay as the law requires.

To exercise these rights, write to privacy@candela.mov. We answer within 30 days and may ask you to confirm who you are. For data a customer controls, we forward your request to that customer.

You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the EU or the EEA the authority of the country where you live or work.

10. Security

Encrypted connections (HTTPS) everywhere; passwords stored only as Argon2id hashes and session and link tokens only as hashes; encrypted backups off the server; access limited by organisation and role; and an audit log of sensitive actions. External share links expire, can require a passcode, can be revoked, and every visit is logged.

11. Cookies and browser storage

• candela_session: keeps you signed in; it ends 30 days after its last use, or when you sign out.
• candela_view: lets an outside viewer who opened an external share link watch that one film; 12 hours, sent only to that link's address.
• candela_lang: the language you chose; one year.
• candela_vote: set only when you give a thumbs up on the showcase without signing in, so that you can withdraw your vote and cannot vote twice; we store only a one-way hash of it; one year, sent only to /showcase.

Your browser also remembers, on your device only, the light or dark room you chose, the last organisation you opened, and your best scores and last choice in the waiting-room games. None of it is sent to us.

These are strictly necessary for the service or remember a choice you made, so no consent banner is needed. There are no analytics, tracking or advertising cookies.

12. Changes to this policy

We publish every change on this page with its date, and tell the organisations' owners before a material change takes effect.