First Pass← firstpass.video

⚠️ Draft for review. This is a solid working template — have a data-protection solicitor review it (and fill the [bracketed] details) before you rely on it. It reflects how First Pass actually handles data as of the last update.

Privacy Policy

Last updated: [DATE]

This policy explains what personal data First Pass collects, why, and your rights over it. In short: we collect the minimum needed to run your account and improve the product — and we never store the footage you process.

1Who we are

First Pass is operated by Trick of the Light Ltd (“we”, “us”), a company registered in England & Wales [company no. / registered address]. For account and usage data described below, we are the data controller. For the footage you process through First Pass, you are the controller and we act only as your processor (see section 5 and our Data Processing Agreement).

Questions or requests: hello@totl.media. We are registered with the UK ICO [registration no.].

2What we collect

Data	Why	Lawful basis
Name, email, billing country	Create your account, send your licence key & receipts, support	Contract
Payment details	Take payment — handled entirely by Stripe; we never see or store card numbers	Contract
Licence & device info (a machine identifier, operating system, plugin/Premiere version, activation dates)	Enforce plan limits, prevent licence abuse, support	Contract / legitimate interest
Usage & product analytics (hours processed, which features are used, error events, counts)	Bill your usage, keep the service reliable, decide what to improve	Legitimate interest

What we do NOT collect: the content of your footage, audio, or transcripts; the words spoken in your interviews; your project files. Our analytics record counts and event types only — never content.

3Your footage — how it's handled

When you run an analysis, your audio is sent securely to our processing service and on to our AI sub-processors purely to produce your transcript and cut:

We never retain your audio. Short clips are processed in memory only; larger files are briefly written to a temporary file solely to reassemble the upload, then deleted immediately after processing — even if it fails.
We never store your transcript on our servers — it is produced and returned to your machine.
Local caching, on your own device only: to power the “reuse last transcript” feature, the plugin saves a copy of the transcript text (never the audio) in its own folder on your computer. That copy never leaves your machine and is never sent to us.
The only thing we keep is usage metadata — e.g. how many hours were processed — to bill usage and run the service.
You keep all rights to your footage; we claim no ownership of it (see our Terms).

4Who we share it with (sub-processors)

We use a small set of trusted providers to run the service. We share only what each needs:

Provider	Purpose	Location
Stripe	Payments & subscriptions	US / global
AssemblyAI	Transcription of your audio	US
Anthropic	Theme detection, captions, translation	US
Railway	Backend & database hosting (account/usage data)	US / EU
Netlify	Website hosting	US / global
Resend	Sending your licence-key & account emails	US

We do not sell your data or share it for advertising.

5International transfers

Some providers above are outside the UK/EEA (mainly the US). Where personal data is transferred there, we rely on appropriate safeguards — Standard Contractual Clauses / the UK International Data Transfer Addendum, or the provider's Data Privacy Framework certification. Copies are available on request.

6How long we keep it

Account data: while your account is active, and up to [6 years] after closure for legal/accounting purposes.
Usage & analytics: retained in identifiable form for up to [24 months], then aggregated or deleted.
Your footage/transcripts: not retained by us at all.

7Your rights

Under UK/EU GDPR you can ask us to: access a copy of your data; correct it; delete it; restrict or object to processing; or port it elsewhere. Email hello@totl.media and we'll respond within one month. You can also complain to the UK ICO.

8Security & cookies

Data is encrypted in transit; access is restricted; card data never touches our servers. Our website uses only essential cookies (and Stripe's during checkout); we do not run advertising or third-party tracking cookies. If that changes, we'll add a cookie banner.

9Children

First Pass is a professional tool not intended for anyone under 18, and we don't knowingly collect their data.

10Changes

We'll update this page when our practices change and revise the date above. Material changes will be notified by email.