Privacy Policy

Last updated September 17, 2026

This policy describes the personal data Hello8 processes when you use hello8.ai, the Hello8 studio, SubReviewer (subreviewer.com) and our related services, why we process it, who we share it with and what your rights are.

1. Data controller

Hello8, a French single-shareholder simplified joint-stock company (SASU) with a share capital of €1,000, registered with the Paris Trade and Companies Register under number 989 261 367, with its registered office at 24 rue Trousseau, 75011 Paris, France, EU VAT number FR49989261367 (“Hello8”, “we”).

For any question about your data or to exercise your rights: privacy@hello8.ai. Hello8 has not appointed a data protection officer.

When you use Hello8 on behalf of a company and upload content containing other people's data (the people on camera, for instance), your company is the controller of that data and Hello8 acts as its processor under our data processing agreement, available on request.

2. The data we process

• Account: e-mail address, display name, profile photo if you add one, language, password (stored hashed by Firebase Authentication, never readable by us), or your Google identity if you sign in with Google.
• Content: the videos and audio files you upload, the extracted audio, transcripts, subtitles, translations, glossaries and briefing instructions, comments and the edit history in the studio (who changed what, and when). For SubReviewer, the text of the subtitle files you submit.
• Billing: plan, credits, payment history. Payment details (card, billing address, VAT number) are collected and held by Stripe; we only see the last four digits and the subscription status.
• Technical data: IP address, browser, operating system, approximate city and country, timezone, device identifier, sign-in timestamps. In our device registry the IP address is only kept as a salted, truncated hash.
• Usage: pages viewed, actions in the studio, product events and, if you accept analytics cookies, recordings of your studio sessions (see section 6).
• Support: messages sent through the contact form or the feedback tool (with any screenshots or screen recordings you choose to attach), e-mails exchanged, appointment bookings.
• E-mail delivery: delivery receipts, bounces and spam complaints, so that we stop writing to addresses that reject our messages.

We do not knowingly process special categories of data. The content you upload may contain some (an interview about health, for instance): you remain responsible for it, and we process it only to produce your subtitles.

3. Why, and on what legal basis

We do not use your content to train artificial-intelligence models, and we do not sell it to anyone.

4. Who receives your data

Hello8 relies on processors that handle data on our behalf, on our instructions and under contract. They may not use it for their own purposes.

• Hosting and infrastructure: Google Cloud (database, file storage, server-side processing, European regions), Vercel (website and web application, functions running in Paris), Amazon Web Services (e-mail sending, Paris region).
• Speech recognition: specialised transcription engines receive the audio of your videos to produce the text. We use one provider established in France and one established in the United States (section 5).
• Language models: the text of your transcripts and subtitles is sent to language models for translation, review, hesitation detection and the production of titles and summaries. We use Google Cloud (Vertex AI) and one provider established in the United States (section 5). Only the text is sent, never the video.
• Payment: Stripe, which processes your payment data as an independent controller for its own obligations (fraud prevention, banking regulation).
• Analytics and diagnostics: PostHog (product analytics and session recording, hosted in Frankfurt), Vercel Analytics (audience measurement), Sentry (error diagnostics, hosted in Germany).
• Support: Tally (forms, Belgium), Google Calendar (appointment booking), Slack (our internal alerts, which may contain your e-mail address and the name of a media, United States).

The named list of our processors, with their locations and the applicable safeguards, is an annex to our data processing agreement, provided to business customers on request.

We may also disclose data where the law requires it, or in the context of a corporate transaction (merger, sale), in which case we will inform you.

5. Transfers outside the European Union

Your data is hosted in the European Union (database and files in Google Cloud's European multi-region). Some processing steps are entrusted to providers established in the United States: a speech-recognition engine (which receives the audio), a language-model provider (which receives the text), Stripe and Slack. The Google Cloud Gemini models we use for review are not offered in a European region, so Google may process subtitle text outside the EU, under its data processing addendum and standard contractual clauses. These transfers rely on the European Commission's standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework. You can obtain a copy of the applicable safeguards by writing to us.

6. Cookies and session recording

We use two categories of trackers.

Necessary, without consent: the session cookie (hello8_session, 5 days), the device cookie (hello8_device, 90 days, which lets you sign a specific device out), the language choice (NEXT_LOCALE), your cookie choice (hello8_cookie_consent, local storage), and Stripe's trackers on payment pages.

Analytics, with your consent, which you can withdraw at any time through the “Cookies” link in the footer: PostHog and Vercel Analytics. If you accept, we may record your sessions in the studio to understand how it is used. These recordings include the subtitle text you edit, in clear; form fields (passwords, addresses) are masked. They are kept by PostHog, in Frankfurt, for 30 days.

7. How long

• Your content: for as long as you keep it. A media moved to the trash stays there until you delete it permanently. Permanent deletion removes the media, its files, subtitles, comments and history from our active systems.
• Your account: for as long as it exists. On your deletion request, the account and its data are deleted within 30 days.
• Backups: our database backups are kept for 70 days and deleted files remain recoverable for 30 days; erased data leaves the backups at the end of those periods.
• Invoices and accounting records: 10 years (legal obligation).
• Technical logs, review telemetry, verification codes: from a few days to 30 days depending on the type.
• SubReviewer without an account: submitted files and proposed corrections are kept for 30 days; usage counters, which only hold a hash of the IP address, for a few days.
• Support exchanges: 3 years after the last contact.

8. Your rights

You can request access to your data, its rectification, its erasure, the restriction of its processing, its portability, and object to processing based on our legitimate interest. You can withdraw your consent to analytics cookies at any time, without affecting past processing.

You can change your name, e-mail address and photo from your profile, and manage your e-mail preferences in the notification settings. Every product-news e-mail contains an unsubscribe link.

To delete your account or exercise another right, write to privacy@hello8.ai from your account's address, or use the request form. We answer within one month, extendable by two months for a complex request, in which case we will tell you. We may ask you to confirm your identity.

You may also lodge a complaint with the CNIL (cnil.fr) or with the authority of your country of residence.

9. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to your content is limited to you and the people you share it with; our team's access, limited to support and maintenance, is logged. An account can be protected by device verification: a new device must then enter a code received at the account's address. No system is infallible; in the event of a data breach likely to harm you, we will inform you as the law requires.

10. Minors and automated decisions

The service is reserved for adults. We make no decision based solely on automated processing that would produce legal effects concerning you. Subtitle production by our models is a service you request and can correct.

11. Changes

We update this policy when our processing changes; the date at the top of the page is authoritative. A significant change is announced in the application or by e-mail.