Last updated: October 10, 2026
Your privacy is critically important to us. At Borumi, we follow these principles:
Below is our Privacy Policy, which incorporates and clarifies these principles.
The data controller for the personal information described in this policy is:
Spandino AB
Address:
c/o Federico Terzi
Prefektgatan 6
752 57 Uppsala Sweden
In all matters regarding our services, including the processing of your personal data, you can contact us at support@borumi.com
We process personal information in uploaded content on your behalf as a processor under the Data Processing Addendum in our Terms. You are responsible for its lawful use. We remain the controller for account, billing, security and usage data.
This Privacy Policy applies to the information that we collect about you when you use:
Throughout this Privacy Policy we’ll refer to our websites, mobile applications, desktop applications, and other products and services collectively as “Services.”
Below we explain how we collect, use, and share information about you, along with the choices that you have with respect to that information.
We only collect information about you if we have a reason to do so — for example, to provide our Services, to communicate with you, or to make our Services better.
We collect this information from three sources: if and when you provide information to us, automatically through operating our Services, and from outside sources. Let’s go over the information that we collect.
It’s probably no surprise that we collect information that you provide to us directly. Here are some examples:
We also collect some information automatically:
We may also get information about you from other sources. For example:
We use information about you for the purposes listed below:
The processing of your personal data is based on the following legal grounds:
We generally discard information about you when it’s no longer needed for the purposes for which we collect and use it — described in the section above on How and Why We Use Information — and we’re not legally required to keep it.
For example, we keep web server logs that record information about a visitor to one of Borumi’s websites, like the visitor’s IP address, browser type, and operating system, for approximately 30 days. We retain the logs for this period of time in order to, among other things, analyze traffic to Borumi’s websites and investigate issues if something goes wrong on one of our websites.
We permanently delete shared videos and related information, including backups, within 30 days after deletion or expiry, unless retention is required by law. For deletion requests, contact support@borumi.com.
Because our Services are offered worldwide, the information about you that we process when you use the Services in the EU may be used, stored, and/or accessed by individuals operating outside the European Economic Area (EEA) who work for us, or third-party data processors. This is required for the purposes listed in the “How and Why We Use Information” above.
When providing information about you to entities outside the EEA, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy as required by applicable law. These measures include entering into European Commission approved standard contractual arrangements with entities based in countries outside the EEA.
You can ask us for more information about the steps we take to protect your personal information when transferring it from the EU.
We use Cloudflare, Inc. to host and deliver shared videos and website content, and to prevent abuse. It may process data worldwide, including outside the EEA.
We use Sentry (Functional Software, Inc.) to diagnose errors using technical reports and logs. These reports do not include video or audio files. Processing may occur outside the EEA, including in the United States.
We use PostHog, Inc. to understand how our apps and websites are used, including visits, downloads and feature use. We use its EU region in Frankfurt, Germany.
PostHog runs only while Analytics is enabled. It can recognize visits across Borumi websites for up to 365 days and link activity to your signed-in account. We do not send your name, email address or Google advertising identifiers to PostHog.
You can disable Analytics through Your Privacy Choices in the footer. This stops PostHog and removes its browser data.
We use Hetzner Online GmbH to host our web services and related data in Germany.
We use Backblaze, Inc. to store encrypted backups of service data in its EU Central region.
We use Resend (Plus Five Five, Inc.) to send transactional emails, such as account confirmations and security notifications. Data may be processed outside the EEA, including in the United States.
We use Paddle to handle payments and subscriptions, through Paddle.com Market Ltd., Paddle Payments Ltd. or Paddle.com Inc., depending on your country. Data may be processed outside the EEA, including in the UK and United States.
We use Google Workspace to handle some of our business operations, including some email communications. When you communicate with us, Google could act as the service provider. We also use Google Workspace Forms to handle some of our waitlists and surveys.
While Analytics is enabled, we use Google Analytics to measure visits, downloads and purchases and improve our Services.
While Advertising is enabled, we use Google Ads to measure advertising performance and show personalized Borumi ads on other websites and apps. In some cases, we might share a hashed version of your email with Google to improve advertising measurement. Advertising stays off when your browser sends a Global Privacy Control signal.
Google receives browser identifiers, device information, IP addresses, website activity, campaign information and purchase details.
Where prior consent is required, these services run only after you enable the relevant category. You can change your choices through Your Privacy Choices in the footer. Turning a category off stops future tracking and removes its Google cookies stored by Borumi. This does not delete information already collected by Google.
Please be aware that Google may process your data on servers located in the United States, outside of the European Economic Area.
You can find Google’s Privacy Policy at: https://policies.google.com/privacy?hl=en-US
Learn how Google uses information from partner websites and apps.
We use Affonso (operated by ZASolution) for affiliate attribution, commissions, reporting and abuse prevention while Advertising is enabled. We do not expose customer names or email addresses to affiliates. Its infrastructure is in Frankfurt, Germany.
We use Microsoft for business operations, including email communications. Data may be processed outside the EEA, including in the United States.
Providing your data is optional; however, certain categories may be marked as required. If you do not provide the mandatory information, you may be unable to fully utilize our Services. Your personal data is either provided directly by you or collected through technologies when you connect to our website (e.g., IP address).
While no online service is 100% secure, we work very hard to protect information about you against unauthorized access, use, alteration, or destruction, and take reasonable measures to do so. We monitor our Services for potential vulnerabilities and attacks.
Our Services are not intended for individuals under the age of 13. We do not intentionally collect personally identifiable information from children under 13. If we become aware that a child under 13 has shared personal information with us, we will promptly delete it from our servers. If you are a parent or guardian and you know that your child has provided us with personal information, please contact us so we can take the appropriate actions.
If you are located in certain parts of the world, including some US states and countries that fall under the scope of the European General Data Protection Regulation (aka the “GDPR”), you may have certain rights regarding your personal information, like the right to request access to or deletion of your data.
If you explicitly agreed to it, you might receive marketing emails from Borumi. You can always opt out of marketing emails by utilizing the “unsubscribe” link in the emails, or by contacting us at support@borumi.com
Note that you might still receive transactional emails (eg. password-reset emails), which are necessary to provide you with our Services.
If you are located in a country that falls under the scope of the GDPR, data protection laws give you certain rights with respect to your personal data, subject to any exemptions provided by the law, including the rights to:
You also have the right to make a complaint to a government supervisory authority.
Laws in some US states require us to provide residents with additional information about the categories of personal information we collect and share, where we get that personal information, and how and why we use it. You’ll find that information in this section (if you are a California resident, please note that this is the Notice at Collection we are required to provide you under California law).
In the last 12 months, we collected the following categories of personal information, depending on the Services used:
In some US states you have additional rights subject to any exemptions provided by your state’s respective law, including the right to:
Personalized advertising through Google may constitute sharing personal information for cross-context behavioral advertising or targeted advertising under applicable US state laws. You can opt out by disabling Advertising through Your Privacy Choices. We also honor Global Privacy Control.
When you contact us about one of your rights under this section, we’ll need to verify that you are the right person before we disclose or delete anything. For example, if you are a user, we will need you to contact us from the email address associated with your account. You can also designate an authorized agent to make a request on your behalf by giving us written authorization. We may still require you to verify your identity with us.
In some circumstances we may deny your request to exercise one of these rights. For example, if we cannot verify that you are the account owner we may deny your request to access the personal information associated with your account. As another example, if we are legally required to maintain a copy of your personal information we may deny your request to delete your personal information.
In the event that we deny your request, we will communicate this fact to you in writing. You may appeal our decision by responding in writing to our denial email and stating that you would like to appeal. All appeals will be reviewed by an internal expert. In the event that your appeal is also denied this information will be communicated to you in writing.
If your appeal is denied, in some US states you may refer the denied appeal to the state attorney general if you believe the denial is in conflict with your legal rights. The process for how to do this will be communicated to you in writing at the same time we send you our decision about your appeal.
Although most changes are likely to be minor, we may change the Privacy Policy from time to time. We encourage visitors to frequently check this page for any changes to its Privacy Policy. If we make changes, we will notify you by revising the change log below, and, in some cases, we may provide additional notice (like adding a statement to our homepage or the Borumi Blog, or sending you a notification through email or your dashboard). Your further use of the Services after a change to our Privacy Policy will be subject to the updated policy.
This policy was derived from the Automattic privacy policy, available under the CC-SA license here.
We use essential cookies to provide our Services and keep you signed in. We save privacy choices only after you make them. Analytics and advertising storage is used only while each category is enabled.
Essential cookies are crucial for a website’s functionality as they enable basic features such as page navigation and access to secure areas. Without these cookies, the website cannot operate correctly.
| Cookie Name | Purpose | Duration |
|---|---|---|
| borumi-login-session | Remembering the user session after a sign-in and protecting access to secure areas | Session |
| oauth2-code-verifier | Used to verify the OAuth2 authorization code during social login via Google | Session |
| oauth2-redirect-state | Used to maintain state between the OAuth2 authorization request and the callback | Session |
| __Secure-br-consent | Stores the consent policy version, your choices, and the time of those choices | Up to 365 days |
The following storage is used only while Analytics is enabled:
| Storage Name | Type | Purpose | Duration |
|---|---|---|---|
| ph_br_analytics | Cross-subdomain cookie | Recognizes visits across Borumi websites and remembers campaign information | Up to 365 days |
| ph_br_analytics_window_id | Session storage | Distinguishes analytics activity in the current browser tab | Browser session |
| ph_br_analytics_primary_window_exists | Session storage | Helps distinguish duplicated or newly opened browser tabs | Browser session |
| _ga | Cross-subdomain cookie | Distinguishes visitors for Google Analytics 4 | Up to 2 years |
| ga* | Cross-subdomain cookie | Maintains Google Analytics 4 session state | Up to 2 years |
Turning off Analytics through Your Privacy Choices stops PostHog and Google Analytics and removes their known browser storage on Borumi.
The following storage is used only while Advertising is enabled:
| Storage Name | Type | Purpose | Duration |
|---|---|---|---|
| gcl* | Cross-subdomain cookie | Attributes downloads and purchases to a Google advertisement | Up to 90 days |
| _gcl_ls | Local storage | Supports Google Ads conversion measurement | Until Advertising is disabled or browser storage is cleared |
| affonso_referral | Cross-subdomain cookie | Stores an opaque referral ID so a purchase can be attributed to the referring affiliate | Up to 60 days |
| affonso_data | Cross-subdomain cookie | Stores optional affiliate-program data, including coupon information when configured | Up to 60 days |
Google may also use cookies on its own domains; see Google’s cookie information.
Turning off Advertising through Your Privacy Choices stops future Google Ads tracking and Affonso attribution and removes their known browser storage on Borumi.