Privacy Policy

This policy explains how FAIA LLC ("TrackPlay", "we", "us") handles personal data. It covers two very different things, and the difference matters, so we separate them throughout.

• Your data. Data about you, our customer. Your account, your billing, your support tickets. For this data we are the controller. We decide what happens to it, and this policy governs it.
• Your viewers' data. Data about the people who watch videos you host with us. Play events, watch time, drop-off points, IP address, device. For this data we are a processor. You are the controller. You decide why it is collected, and we act on your instructions under our Data Processing Agreement. If you are a viewer and want this data deleted, you need to contact the business whose video you watched, not us. We will help them action it.

1. Data we hold as controller (your account)

What	Why	Legal basis (GDPR)
Name, email, password hash, workspace name	To create and secure your account	Performance of a contract
Billing details, plan, invoices, play counts used	To charge you and to meter usage	Performance of a contract, and legal obligation for tax records
Login records, IP addresses, audit log	Security, fraud prevention, abuse investigation	Legitimate interests
Support messages	To answer you	Performance of a contract
Marketing emails, if you opt in	Product news	Consent. Withdraw any time via the unsubscribe link

We do not sell your personal data, and we do not sell your viewers' personal data.

2. Data we process for you (your viewers)

When someone watches a video you host with us, the player records events so you can see what happened. Typically: play start, watch time and percentage watched, seeks and pauses, drop-off point, approximate location, device and browser type, referring page, and IP address. IP address counts as personal data under GDPR, so this section applies even though we never ask a viewer for a name.

We process this to deliver the service, to bill you, and to give you your analytics. We do not use your viewers' data to build our own advertising profiles, and we do not combine one customer's viewer data with another's to build a cross-customer product.

2.1 Advertising pixels, and why this one is on you

TrackPlay can fire Meta and Google Ads pixels from the player when a viewer reaches a watch-time milestone you configure. Read this part carefully, because it is the part most likely to get you in trouble.

• You decide. Pixel firing is off until you turn it on. You choose the network, the pixel ID, and the milestone. We execute the configuration you set.
• You must obtain consent. Firing an advertising pixel writes to or reads from the viewer's device. In the EU, the UK, and a growing list of other places that requires the viewer's prior consent, and "legitimate interests" is not an available excuse. The consent has to be collected on your page, because it is your page. We cannot collect it for you, and we have no way to know whether you did.
• The obligation is contractual. Our Acceptable Use Policy requires you to obtain valid consent before enabling pixels for viewers in those jurisdictions, and to cover us if you do not.

Once a pixel fires, the data goes to Meta or Google under their terms, not ours. We cannot retrieve it or delete it for you.

2.2 Cart postbacks

If you connect a cart, the cart sends us a postback when a sale completes so we can attribute it to a play. That payload may include an order ID, an amount, and an email or a hashed email. We store it against the play and we process it as your processor.

3. Sub-processors

We use other companies to run the service. Each one is bound by a written contract with data-protection terms no weaker than these. Our current sub-processor list is available on request at [email protected].

We publish changes to this list here. If you object to a new sub-processor, tell us at [email protected] before it starts processing. If we cannot resolve it, you may terminate the affected service.

4. International transfers

We are based in the United States and our sub-processors operate globally, so data may be transferred outside the EEA and the UK.

Where we transfer personal data out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses (2021) together with the UK International Data Transfer Addendum.

5. How long we keep things

• Viewer event data and IP addresses: retained while you remain a customer, deleted with your account.
• Video files after you delete them: purged from delivery immediately and from backups and caches within 30 days.
• Account data after closure: deleted within 90 days.
• Billing records: kept for seven years to meet tax obligations.
• Security and audit logs: kept for 12 months.

6. Your rights

If you are in the EEA or the UK you can ask us for a copy of your data, correct it, delete it, restrict or object to processing, or port it elsewhere. You can withdraw consent at any time where we relied on consent. You can complain to your supervisory authority, and we would rather you came to us first.

If you are in California you can ask what we collected, ask us to delete or correct it, and opt out of sale or sharing. We do not sell or share personal data as the CCPA defines those terms. We will not treat you worse for exercising a right. Residents of other US states with comparable laws have comparable rights.

If you are a viewer and you want your data handled, contact the business whose video you watched. They are the controller and it is their decision. If you cannot identify them, write to us and we will route it.

To exercise any right, email [email protected]. We respond within one month.

7. Security

We use encryption in transit and at rest, access on a least-privilege basis, and audit logging. No system is perfectly secure and anyone who tells you otherwise is selling something. If a breach affects your data we will tell you without undue delay, so you can meet your own notification deadlines.

8. Cookies on this website

This website sets strictly necessary cookies and, on some pages, advertising measurement pixels (Meta). Cookies set inside the application are described in the application. The consent rules in section 2.1 apply to your pages, not to this one.

9. Children

TrackPlay is a business tool and is not directed at children. Our Acceptable Use Policy prohibits hosting child-directed content and content aimed at under-13s. If we learn we hold data from a child under 13, we delete it.

10. Representatives and contact

Controller (legal entity)	FAIA LLC
Privacy questions and data rights requests	[email protected]
Phone	+1 302 546 5216

11. Changes

If we change this policy in a way that matters, we email you before it takes effect. We keep old versions so you can see what changed.