Privacy Policy

Last updated: October 26, 2026

This privacy policy for Luis Federici ("I", "me", "my") explains how and why I access, collect, store, use and share ("process") your personal information when you use my services ("Services"), including when you:

• Visit my website at luisfederici.com, or any website of mine that links to this policy
• Use the client portal at videoportal.luisfederici.com
• Contact me or work with me in other related ways, such as by email

Questions or concerns? Reading this policy will help you understand your privacy rights and choices. I'm responsible for deciding how your personal information is processed. If you have questions, email me at luis@luisfederici.com.

Contents

1. What information do I collect?
2. How do I process your information?
3. What legal bases do I rely on?
4. When and with whom do I share your information?
5. Do I use cookies and other tracking technologies?
6. Is your information transferred internationally?
7. How long do I keep your information?
8. How do I keep your information safe?
9. Do I collect information from minors?
10. What are your privacy rights?
11. Controls for Do-Not-Track features
12. Do United States residents have specific privacy rights?
13. Client videos
14. Use of AI tools
15. Do I update this policy?
16. How can you contact me about this policy?
17. How can you review, update or delete your information?

1. What information do I collect?

Personal information you give me

In short: I collect personal information that you provide to me.

I collect personal information you give me when you contact me, ask about my Services, become a client or use the client portal. Depending on how you work with me, it may include:

• names and business names
• email addresses, and phone numbers or addresses if you share them
• contact preferences (for example, whether you'd rather be replied to by email)
• sign-in details for the client portal (your password is stored only in scrambled, hashed form)
• project details, messages and revision requests
• footage, photos, music and other material you send for your videos, which may show you, your staff or your customers
• billing and payment records for your project. If you pay an invoice through Stripe or PayPal, they handle your card or account details; I never see or store your full card number.

Sensitive information. I don't process sensitive information.

All personal information you give me must be true, complete and accurate, and you must tell me about any changes.

Information collected automatically

In short: some information, such as your IP address and browser and device characteristics, is collected automatically when you visit.

Some information is collected automatically when you visit or use the Services. It doesn't reveal your identity (like your name or contact details) and is needed mainly to keep the Services secure and working, and to count visits. It includes:

• Log and usage data: your IP address, browser type, the pages you view, the date and time of your visit, and error reports. The client portal also records failed sign-in attempts.
• Device data: your type of device, operating system and browser.
• Location data: the country you're visiting from, worked out from your IP address by Cloudflare Web Analytics. I don't collect precise location or GPS data.

2. How do I process your information?

In short: I process your information to provide my Services, communicate with you, keep the Services secure and comply with the law. I may also process it for other purposes only with your prior explicit consent.

• To deliver video editing services. Using the project details, footage and other material you give me to edit, deliver and support your videos. Kept for as long as you're a client, then up to six years after our last project.
• To respond to enquiries and offer support. Replying to messages sent through the contact form, by email or in the client portal. Up to 12 months if the enquiry doesn't become a project; otherwise with your other client records.
• To send administrative information. Sending project updates, portal invite links, invoices and account notices. Kept with your other client records: up to six years after our last project, or six years from the end of the tax year for invoices, as Canadian tax law requires.
• To manage client portal accounts. Creating and running invite-only client accounts, including secure sign-in, projects, messages and revision requests. For as long as you're a client, then up to six years after our last project. Deleted sooner on request, except records the law requires me to keep.
• To keep billing and payment records. Recording project fees, invoices and payments. Six years from the end of the tax year they relate to, as Canadian tax law requires.
• To protect my Services. Recording failed sign-in attempts, limiting repeated contact form messages and blocking attacks. Failed sign-in attempts for 1 day; error logs for a few days.
• To identify usage trends. Cookie-free visit counts from Cloudflare Web Analytics (pages viewed, device type, country) so I can improve the website. Kept by Cloudflare only as totals that don't identify you.
• To save or protect someone's vital interests. Where necessary to prevent harm to a person.

3. What legal bases do I rely on?

In short: I only process your personal information when I have a valid legal reason to, such as your consent, to provide the Services you asked for, to meet legal obligations, or for my legitimate business interests.

If you are in the EU or UK

The GDPR and UK GDPR require me to explain the legal bases I rely on:

• Consent. Where you've given me permission to use your information for a specific purpose. You can withdraw your consent at any time.
• Performance of a contract. Where I need your information to deliver the Services you've hired me for, or to take steps you asked for before we agree to work together.
• Legitimate interests. Where it's reasonably necessary for my business and doesn't override your interests and rights, in order to:
  • answer people who contact me and discuss a possible video project
  • protect client accounts and this website from misuse and fraud
  • understand how the website is used and improve it
• Legal obligations. Where I need to comply with the law, such as keeping tax records, cooperating with a regulator or law enforcement body, or defending my legal rights.
• Vital interests. Where necessary to protect someone's safety.

If you are in Canada

I may process your information with your express consent, or where your consent can be reasonably implied (for example, when you send me an enquiry and expect a reply). You can withdraw your consent at any time. In some exceptional cases the law allows processing without consent, for example:

• if collection is clearly in someone's interests and consent can't be obtained in time
• for investigations and fraud detection and prevention
• for business transactions, when certain conditions are met
• if it's contained in a witness statement needed to assess, process or settle an insurance claim
• to identify injured, ill or deceased people and communicate with next of kin
• if there are reasonable grounds to believe someone has been, is or may be a victim of financial abuse
• if asking for consent would compromise the information's availability or accuracy, and collection is reasonable for investigating a breach of an agreement or of Canadian or provincial law
• if disclosure is required to comply with a subpoena, warrant, court order or court rules
• if it was produced by someone in the course of their employment, business or profession and the collection matches the purpose it was produced for
• if the collection is solely for journalistic, artistic or literary purposes
• if the information is publicly available and specified by the regulations

4. When and with whom do I share your information?

In short: only with the service providers that help me run my business, and in the situations described below. I never sell your information.

I share information with service providers who do work for me and need access to it to do that work:

I may also need to share your information in this situation:

• Business transfers. In connection with, or during negotiations of, a merger, sale of business assets, financing or acquisition of all or part of my business.

5. Do I use cookies and other tracking technologies?

In short: this website sets no cookies. The client portal uses cookies only to keep you signed in. Visits are counted without cookies.

This website counts visits with Cloudflare Web Analytics, which uses a small script (a "web beacon") instead of cookies. It doesn't follow you across other websites and isn't used for advertising. The client portal sets two cookies that are strictly necessary for signing in:

I don't use advertising, targeting or social media cookies, and I don't let third parties use tracking technologies on my Services for advertising.

6. Is your information transferred internationally?

In short: yes. I work from Canada, and some of my service providers store information in the United States and other countries.

Your information may be transferred to, stored and processed by me in Canada and by the service providers listed in section 4, including in the United States and other countries.

If you live in the European Economic Area (EEA), the UK or Switzerland, those countries may not have data protection laws as comprehensive as yours. I take the necessary measures to protect your information in line with this policy and applicable law. Canada is recognised by the EU and UK as providing adequate protection, and my service providers' data processing terms include the European Commission's Standard Contractual Clauses, which require them to protect information from the EEA and UK in line with European data protection law. Details are available on request.

7. How long do I keep your information?

In short: for as long as needed for the purposes in this policy, unless the law requires longer.

I keep personal information only as long as necessary for the purposes set out in this policy, unless a longer period is required by law (such as tax or accounting rules). The retention period for each purpose is listed in section 2. Footage and other material clients send for their videos stays in the shared folder the client chooses, and my working copies are kept so I can help with future edits, unless the client asks me to delete them.

When I no longer need your information, I delete or anonymise it. If that isn't possible right away (for example, because it's in backups), I store it securely and keep it from any further use until it can be deleted.

8. How do I keep your information safe?

In short: through organisational and technical security measures.

I use appropriate technical and organisational measures to protect the personal information I process, including encrypted connections, hashed passwords, two-step sign-in for my own account, and access limited so each client sees only their own project. However, no electronic transmission or storage can be guaranteed to be 100% secure, so I can't promise that hackers or other unauthorised third parties will never be able to defeat these measures. Please access the Services only from a secure environment.

9. Do I collect information from minors?

In short: I don't knowingly collect data from or market to children under 18.

I don't knowingly collect data from, or market to, children under 18 (or the equivalent age in your jurisdiction). If I learn that I've collected personal information from someone under 18, I'll deactivate any account and promptly delete the data. If you become aware of any such data, please contact me at luis@luisfederici.com.

10. What are your privacy rights?

In short: depending on where you live, including some US states, the EEA, the UK, Switzerland and Canada, you have rights that give you more access to and control over your personal information.

In some regions (like the EEA, UK, Switzerland and Canada) you may have the right to: (i) access and get a copy of your personal information; (ii) ask for it to be corrected or deleted; (iii) restrict its processing; (iv) data portability, where applicable; and (v) not be subject to automated decision-making. If a decision with legal or similarly significant effects were ever made solely by automated means, I'd tell you, explain the main factors and offer a simple way to ask for a human review. In certain circumstances you may also object to processing. To make a request, use the details in section 16. I'll consider and act on any request in line with applicable data protection laws.

If you're in the UK and unhappy with how I've handled your information, you can complain to me directly, in addition to your rights under the UK GDPR and the Data Protection Act 2018. I'll acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. If you're not happy with my final response, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you're in the EEA or UK and believe I'm processing your information unlawfully, you can also complain to your Member State data protection authority or the UK data protection authority. If you're in Switzerland, you can contact the Federal Data Protection and Information Commissioner. If you're in Canada, you can contact the Office of the Privacy Commissioner of Canada.

Withdrawing your consent: if I rely on your consent (express or implied, depending on the law), you can withdraw it at any time using the details in section 16. This won't affect processing that happened before you withdrew it, or processing based on other legal grounds where the law allows.

Cookies: most browsers accept cookies by default. You can set yours to remove or reject them, but the client portal needs its sign-in cookie to work.

If you have questions about your privacy rights, email me at luis@luisfederici.com.

11. Controls for Do-Not-Track features

Most browsers and some devices include a Do-Not-Track ("DNT") setting that signals you don't want your browsing tracked. No uniform standard for recognising DNT signals has been finalised, so I don't currently respond to them, and California law requires me to tell you this. In any case, I don't track you across other websites. If a standard is adopted that I must follow, I'll describe it in an updated version of this policy.

12. Do United States residents have specific privacy rights?

In short: if you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the right to access, correct, get a copy of or delete your personal information, and to withdraw your consent. These rights may be limited by law in some circumstances.

Categories of personal information I collect

This table shows the categories collected in the past 12 months. For a full description, see section 1.

I may also collect other personal information when you get help from me, and when I deliver my Services or respond to your enquiries. I keep the information collected as follows:

• Categories A, B and D: for as long as you're a client, then up to six years after our last project, because payment records are tax records under Canadian law.
• Category F: visit counts are kept by Cloudflare only as totals that don't identify you; failed sign-in attempts for 1 day.
• Category G: country only, kept by Cloudflare Web Analytics as totals that don't identify you.
• Categories H and I: kept with your project files so I can help with future edits, unless you ask me to delete them.

Sources, use and sharing

The sources of the information I collect are described in section 1, and how I use it in section 2. Visit data is collected through a web beacon (Cloudflare Web Analytics). I disclose personal information only to my service providers, under written contracts, as described in section 4.

I have not sold or shared any personal information for a business or commercial purpose in the past 12 months. In that time, I have disclosed the following categories to service providers for a business purpose: A (identifiers), B (California Customer Records information), D (commercial information), F (internet activity), G (geolocation), H (audio, electronic and visual information) and I (professional information).

Your rights

You have rights under certain US state data protection laws. They aren't absolute, and in some cases I may decline a request as the law allows. They include the right to:

• know whether I'm processing your personal data
• access your personal data
• correct inaccuracies in your personal data
• request deletion of your personal data
• get a copy of the personal data you've shared with me
• not be discriminated against for exercising your rights
• opt out of the use of your personal data for targeted advertising (or "sharing" under California law), its sale, or profiling that produces legal or similarly significant effects. I don't do any of these.

Depending on your state, you may also have the right to: access the categories of personal data being processed (for example, in Minnesota); get a list of the categories of third parties I've disclosed personal data to (for example, in California, Delaware and Maryland); get a list of the specific third parties I've disclosed personal data to (for example, in Minnesota and Oregon); get a list of third parties I've sold personal data to (for example, in Connecticut; I haven't sold any); review and question profiling (for example, in Connecticut and Minnesota); limit the use of sensitive personal data (for example, in California); and opt out of the collection of sensitive data and data from voice or facial recognition features (for example, in Florida).

How to exercise your rights

Visit luisfederici.com/contact, email luis@luisfederici.com, or use the contact details at the end of this policy. Under some state laws you can have an authorised agent make a request for you; I may deny a request from an agent who can't show they've been validly authorised.

Request verification

When I receive a request, I'll need to confirm you're the person whose information I hold. I'll use the information in your request only to verify your identity or authority. If I can't verify you from the information I already have, I may ask for more, for identity and fraud-prevention purposes. If you use an authorised agent, I may need more information to verify you, and the agent must provide your written, signed permission.

Appeals

If I decline to act on your request, you may appeal by emailing luis@luisfederici.com. I'll tell you in writing what I did or didn't do in response, with the reasons. If your appeal is denied, you may complain to your state attorney general.

California "Shine The Light" law

California Civil Code Section 1798.83 lets California residents ask once a year, free of charge, which categories of personal information (if any) I disclosed to third parties for their direct marketing, and the names and addresses of those third parties, for the previous calendar year. I don't disclose personal information for direct marketing. To make a request, use the details in section 16.

13. Client videos

This policy covers luisfederici.com and the client portal at videoportal.luisfederici.com. Footage, photos and music you send me for a video are used only to edit and support your videos, and stay in the shared folder you choose (such as Google Drive or Dropbox), under that service's own privacy policy. Once a video is delivered, you decide where it is posted, and each platform you post it on handles its viewers' information under its own privacy policy.

14. Use of AI tools

I sometimes use AI tools (Claude by Anthropic and ChatGPT by OpenAI) to help with captions, transcripts and other repetitive editing work. I only share with them what's needed for the task, such as the audio or text for your video, and never passwords or payment details. I use settings that stop these tools from using your information to train their AI models.

15. Do I update this policy?

In short: yes, as needed to stay compliant with the law.

I may update this policy from time to time; the date at the top shows the latest version. If I make important changes, I may post a notice here or tell you directly (for example, by emailing clients with a portal account). Please check this policy from time to time.

16. How can you contact me about this policy?

Email me at luis@luisfederici.com, use the contact form, or write to:

Luis Federici
Stratford, Ontario
Canada

17. How can you review, update or delete your information?

You have the right to ask for access to the personal information I collect from you, details of how I've processed it, corrections, or deletion. You may also have the right to withdraw your consent to my processing of your personal information. These rights may be limited in some circumstances by law. To make a request, visit luisfederici.com/contact.

This policy was created using Termly's Privacy Policy Generator.

See also: Terms of Service and DMCA Policy.