Your footage never leaves your device

GDPR-Compliant Video Editor with no data transfer

No uploadNo EU-to-third-country transferNo processor for your footage

Most GDPR worries about online video editors come from one architectural fact: when you upload a video to a cloud editor, you are transferring personal data (the people in the video, the audio of their voices, the metadata of where and when it was recorded) to a third-party processor. That transfer triggers most of the heavy GDPR machinery: a Data Processing Agreement, lawful basis review, cross-border transfer mechanisms, breach notification procedures, the right to erasure across replicas.

Honest scope

This page describes how VidStudio handles the main GDPR concern around video content. We are not a Data Protection Officer service, and this page is not legal advice. The architectural fact (your video stays on your device) is what takes most video-related GDPR questions off the table.

Try it now

The architecture above runs every tool below. Pick one to start.

Open the Video Editor

or jump directly to a tool

Auto Caption Compress Resize Trim Watermark Thumbnails

How this fits GDPR-Compliant Video Editor

VidStudio does not have any of that machinery because it does not have the transfer it would manage. The file you drop on the page is read by your browser tab. Speech recognition runs locally against a Whisper model that downloads once and caches in your browser. Video processing runs locally too: captions and the editor use the browser's WebCodecs API, and tools like audio extraction use FFmpeg compiled to WebAssembly. The captioned or compressed or trimmed output is written back to your disk. None of that involves a server-side processor that handles your video.

What we do collect, separately from your video, is product telemetry: anonymous usage events (PostHog), error reports (Sentry), and Core Web Vitals (Vercel Analytics). None of it sets cookies, and none of it includes your video, audio, or file names. That telemetry is GDPR-relevant in its own right, and those three providers are the subprocessors for it. The point is that the video itself is not on that list, because the video does not go anywhere.

The architectural points that do the work

No controller-to-processor transfer of video content

GDPR Article 28 requires a Data Processing Agreement between a data controller and any processor that handles personal data on the controller's behalf. Because VidStudio never receives your video, there is no processor relationship to formalise for that content.

No cross-border data flow

Cross-border transfers (especially EU-to-US) trigger Standard Contractual Clauses and Transfer Impact Assessments under Schrems II. None of that applies to a video that stays on your laptop in the country where you opened the browser.

Right to erasure is trivial

Working data lives in your browser. Burn-in stages the source video in the browser's private storage, and the app removes it after processing; clearing site data removes everything at once. There is no server copy, no backup, no replica in three regions. The right-to-erasure obligation, which is operationally painful for cloud services, has nothing on our side to erase.

Telemetry honesty

We run product analytics (PostHog, Vercel) and error tracking (Sentry). They do not set cookies, and none of them receives video, audio, or file names. Error reports carry processing context such as file size, MIME type, and the stage that failed.

How to verify the GDPR-relevant claims yourself

01 Open DevTools

On any VidStudio tool page, open browser DevTools and switch to the Network panel.

02 Filter to fetch and XHR

Apply the Network panel's filter to fetch and XHR requests so you only see the application traffic.

03 Drop a video and run the tool

Drop any video file in and let the tool process it. Compress, resize, or generate captions, whichever flow you want to inspect.

04 Read the requests

You will see the application bundle, the Whisper model from models.vidstudio.app (first visit only), and small analytics and error-report pings. You will not see any request containing your video, or anything near its size. That is the architectural claim, observed directly.

Frequently asked questions

Does GDPR apply to using VidStudio?

GDPR applies to anyone processing personal data of people in the EU and UK. If your video contains identifiable people, you are processing personal data when you edit it. The good news: VidStudio is not the processor; you are. The video stays on your device, so the cross-border processor question does not apply.

Do you sign a Data Processing Agreement?

For video content, no, because we do not act as a processor of that content. We do not see, store, or transmit it. For the small amount of telemetry we do collect (anonymous usage events, error reports, web vitals), the standard subprocessor terms apply through PostHog, Vercel, and Sentry.

Where is my video stored?

In your browser tab's memory while you are working with it. The browser may temporarily write to local OPFS storage for memory-efficient processing of large files; that storage is origin-bound, the app removes it after processing, and clearing site data for vidstudio.app wipes it. Nothing about your video is stored on our infrastructure.

What about the Whisper model download? Is that a transfer?

The Whisper model weights are served from VidStudio's own model host (models.vidstudio.app) and cached by your browser. When your browser fetches the model, it is fetching a fixed file the same way it fetches an image. The model is the same for every user; nothing about your video influences which file is fetched, and the request carries nothing about your file.

Can I use VidStudio under a UK GDPR / EU GDPR / Swiss FADP regime?

Yes. The architectural fact is the same regardless of jurisdiction. The video does not leave your device, so the rules about transferring personal data to a processor do not apply to the video itself. Local rules on analytics still apply to the telemetry we run.

Is this legal advice?

No. This page describes our architecture. A privacy lawyer who knows your specific use case and jurisdiction should sign off on the actual compliance position. The point of this page is that the architecture removes most of the questions you would normally have to answer.