Operator information
FirstVideoDownloader
1–2 Alpen House, Portsmouth
United Kingdom
Contact: support@firstvideodownloader.com
1. Scope, operator and transparency
This notice explains the data flows in FIRST’s website download service, account system, billing and optional desktop extension. The controller is the operator identified in the operator panel. FirstVideoDownloader is based at 1–2 Alpen House, Portsmouth, United Kingdom. Privacy enquiries can be sent to support@firstvideodownloader.com. We do not claim that a brand name is a registered legal entity.
The deployed environment matters. The current website uses ChatGPT Sites hosting and a Google Cloud processing server in London. The processing server runs as a temporary pilot funded by Google Cloud trial credit. The current pilot has no automatic application backup configured. Purchase-recovery links are sent through the support mailbox hosted by Hostinger. Live payments are not enabled yet.
2. Information you give us
Free use creates a random browser identifier and a server-side record of its download allowance. No email or password is needed. Paid checkout supplies billing details to Stripe; the service receives a customer reference, purchase status and purchase email for recovery. Access-link and session credentials are stored as hashes. Legacy password accounts, if any, retain salted one-way password hashes. When you ask for a website download, the service receives the source URL, requested format, available source metadata and the media necessary to prepare the output. A URL or recording can itself contain personal information.
Support enquiries may include your contact details, message, a job reference and the information you choose to attach. Do not send unnecessary personal data, payment-card credentials, passwords, source-site cookies or sensitive recordings. There is no advertising profile, comment account or newsletter signup implemented merely because this privacy page exists.
3. Technical and payment information
Your browser necessarily shares network information with the site’s hosting infrastructure. This can include an IP address, request time, browser details and security-related information. The application uses short-lived rate records to protect the service; its normal handler does not write submitted video links or account tokens to access logs. Hosting, proxy and mail systems may maintain their own operational logs under their configured policies.
Stripe receives the payment and billing details entered in its hosted checkout. FIRST stores the Stripe identifiers and subscription status needed to associate payment with an account, process notifications, offer billing management and investigate a transaction. Full card numbers and security codes are not stored in FIRST’s application database. Stripe’s handling of information is also described in its own privacy information.
4. Website processing and the optional local route
For website downloads, your submitted link goes to a processing server. The server contacts the source service, inspects formats, retrieves media, merges or converts it as requested and temporarily stores the output for transfer. The source service sees requests from the server and may apply its own rules. No Chrome extension is required for this website route. Do not interpret a desktop “local processing” description as a statement that website files never pass through a server.
The optional extension has a separate design. It can identify direct media after a user action and communicate with a local companion using private local credentials. Local settings and task information remain in the browser or local companion storage. If a user chooses the website instead, website account, server and payment data flows apply. The website fonts and marketing photographs are served by its host. The optional extension can request source thumbnails directly, which can disclose browser network details to the thumbnail provider.
5. Purposes and lawful bases
We use registration and verification information to provide the account and manage access; submitted links and media to perform the requested preparation and transfer; and payment identifiers to administer the chosen plan. Where contractual necessity is an appropriate basis, it relates to those requested service activities rather than unrelated marketing. We also use limited information to respond to support requests, prevent misuse, secure systems and investigate failures.
Where legitimate interests are relied upon for proportionate security or service-administration work, those interests are maintaining a functioning service and protecting users and resources. The operator must assess necessity and the effect on individuals. Legal obligations may require retaining particular transaction records or responding to a valid legal request. Optional marketing or non-essential tracking would require a separate assessment and, where required, a valid choice before it is introduced.
6. Recipients and disclosures
The service uses infrastructure providers to host the website and processing server, Hostinger to send purchase-recovery messages, and Stripe to process payments and manage billing. Authorised people dealing with support or operations may access information necessary for their task. ChatGPT Sites provides the public website endpoint and Google Cloud hosts the processing server in London. Hostinger supplies the mailbox used for purchase-recovery messages. These messages include the recipient email address and the relevant short-lived account link. Live Stripe checkout is not enabled yet. We do not make a promise about another provider’s precise retention or data location without checking its terms and configuration.
We may disclose proportionate information where required by law, to address a credible security incident or to respond to a properly supported rights complaint. A complaint does not automatically entitle the complainant to account details or private media. We do not offer a public library of users’ prepared files, and one account is not authorised to read another account’s jobs.
7. Storage and retention
The website marks prepared media to expire one hour after processing. A housekeeping loop checks expired jobs approximately every thirty seconds while the service runs. A restart deletes transient job folders and releases unfinished trial reservations. If a server is offline, deletion may not run until it restarts; this is not a claim that every byte disappears at an exact second or from every infrastructure copy. The deployment does not include automatic backup of temporary media.
Account and subscription records persist to administer the account, its one-time trial and payment rights. Purchase-recovery links last 15 minutes and are single use. A free browser session has a maximum lifetime of one year. Sessions restored through an email link last seven days unless revoked or ended earlier. Browser settings may delete cookies sooner. Expired session and verification records are pruned on service configuration, and when operational housekeeping runs. Account records remain while the account is open, or while needed to administer its trial, resolve a dispute or meet a legal obligation. You may request closure or erasure using the support address. Any justified continued retention will be explained in response to your request.
8. International processing and safeguards
The processing server is in London. Website delivery, provider operations and support can involve processing outside the United Kingdom. We do not promise that all information stays in the United Kingdom or European Union. Where a restricted international transfer occurs, applicable data-protection requirements and appropriate safeguards must be met.
You can ask the operator for information about relevant safeguards and how to obtain a copy where applicable. A request may require clarification to identify the processing involved. We will consider requests about provider arrangements and safeguards alongside the processing involved.
9. Your choices and rights
Depending on applicable law and the circumstances, you may have rights to access personal information, correct it, request erasure, restrict processing, receive certain information in a portable form, or object to processing. The right to object is particularly relevant where legitimate interests are used. Rights can have conditions and exceptions, including where records must be retained to meet a legal obligation or establish a claim.
Contact the privacy address with a clear request. We may ask for proportionate information to verify identity and understand scope; we should not collect excessive identity documents by default. Where processing relies on consent, you can withdraw that consent without changing the lawfulness of earlier processing. Closing an account does not automatically erase legally required payment records. You can also complain to the relevant data protection authority; UK users can find information at ico.org.uk.
10. Security, automated controls and sensitive material
The application includes hashed session and access-link credentials, HttpOnly session cookies, same-origin request controls and session-ownership checks for private jobs. Legacy passwords remain salted and hashed. These are safeguards, not a guarantee that every risk is eliminated. Keep your credentials secure, avoid sharing a signed-in browser and contact support promptly if you suspect misuse. Production configuration, updates, access restrictions and backups remain operational responsibilities.
Trial counters, rate limits and subscription checks make automated access decisions about service use. They are not designed to profile a person for advertising or make unrelated decisions with legal effects. If you think a restriction is wrong, ask support to review it. Do not submit sensitive material unless you have an appropriate reason and authority for the processing; the service is not designed as a confidential professional records repository.
11. Children, changes and contact
The service is not designed to collect information from children who cannot independently enter the relevant agreement. The operator should assess the intended audience and any additional obligations before actively directing the service at children or educational institutions. A teacher’s use of a permitted recording does not automatically mean student accounts or student personal data should be uploaded.
We will identify substantive changes through an updated policy date and, where appropriate, an additional notice. If the service begins using analytics, advertising, new payment features or a materially different media-retention design, its notice and any required choices must be updated before that processing starts. Contact the published privacy address for questions about this notice or a particular data flow.