Privacy Policy

At PR2XML, operated by Norde SRL (company no. BCE 1039457839), we take your privacy very seriously. This Privacy Policy explains what data we collect, why, and how we protect it.

Data controller: Norde SRL, a company incorporated under Belgian law, registered with the Crossroads Bank for Enterprises under number 1039457839. For any question about your data, write to support@pr2xml.com.

1) Data we collect

• Account data: name, email address, language preference, email verification status.
• Conversion data: converted file name, file size, track and clip counts (metadata only - your video, audio and image media files never leave your computer).
• Payment data: banking information is processed directly by Stripe - we only store the transaction ID and purchase confirmation.
• Navigation data: IP address, browser type, pages visited (via Google Analytics and Microsoft Clarity).
• Affiliate program: if you arrive through an affiliate's link, their code is kept for 30 days in a cookie and, if you have an account, on your account, so your purchase is credited to them even if you pay from another device. The affiliate never sees your full email address, only a masked version.

2) Your media stays with you

Analysis and timeline preview run entirely in your browser: no file is uploaded. To generate the converted file (available to licensed accounts), only your .prproj project file - which contains just your edit metadata (tracks, clips, effects) - is sent to our server, processed in memory, then immediately discarded: never written to disk or retained. Your media (video, audio, images) never leaves your computer. Only conversion metadata (name, size, statistics) is saved for your history.

3) Purposes of processing

• • Service delivery: creating and managing your account, processing your payment, displaying your conversion history.
• • Communication: sending verification and password reset emails (via Resend).
• • Informational emails: sending you tips, news and offers (via Sender, and for some one-off sends via Resend), only if you ticked the box at account creation or in your settings. They include a short welcome series after you sign up and, after a purchase, a request for a review. Some are sent after something you do in PR2XML (an export blocked for lack of a license, a file too large, a first download), to help you at the right moment. They tell us whether they were opened and which links you clicked, so we can see what interests you. You can unsubscribe in one click, from your settings or from the link in every one of those emails.
• • Service improvement: analyzing site usage to improve the user experience.
• • Public reviews: if you leave a 4 or 5 star review, it may be shown on pr2xml.com with your first name and the initial of your last name, no photo. Write to us to have it removed, at any time.

4) Sub-processors and hosting

5) Cookies

Trackers marked Consent required load only after you agree on the banner. You can change that choice at any time with the Manage cookies link in the footer.

Worth knowing: your choice is stored in your browser's localStorage; the cookie_consent cookie is only a copy of it, so that our server respects it too. Clearing your cookies therefore does not necessarily reset it; use the link above to revisit it. If you refuse or withdraw your consent, we delete the cookies those tools had set on pr2xml.com.

6) Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access: obtain a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your account and data.
• Objection: object to processing for direct marketing.
• Portability: receive your data in a structured format.
• Restriction: ask us to freeze a processing activity while a challenge is being examined.
• Withdrawal of consent: where processing rests on your consent, withdraw it at any time, without affecting what was done beforehand.

To exercise these rights, contact us at support@pr2xml.com.

7) Security

We implement appropriate security measures to protect your data: HTTPS encryption, secure authentication (better-auth), database hosted on Supabase. However, no method of transmission over the Internet is completely secure.

8) Data retention

Your account data is retained as long as your account is active. Your conversion records (file name, size, status, dates) are kept as long as your account exists, for support and statistics, and deleted with it. The .prproj file sent to generate an export is never retained: it is processed in memory and discarded immediately. You can delete your account at any time.

At Sender, your data stays as long as you receive our informational emails. If you unsubscribe, you are removed from our lists. If you delete your account, your data is also removed from our lists at Sender.

9) Legal bases for processing

The GDPR requires us to state the legal ground each processing activity rests on. For PR2XML:

• Performance of the contract: creating and managing your account, converting your files, processing your payment, keeping your conversion history, support.
• Legitimate interest: service security, fraud and abuse prevention, technical error monitoring, aggregate performance measurement. You may object to this processing.
• Consent: analytics and advertising cookies (including the conversions our server reports to Meta), informational email. Consent to those emails is given through an optional box, never pre-ticked, at account creation or in your settings, and withdrawn in the same place or through the unsubscribe link. We keep the date and the origin of every agreement and every withdrawal, so that we can account for them.
• Legitimate interest and existing relationship: accounts created before 25 September 2026, which were never offered that box, may receive those same emails on the basis of the existing relationship. One click from you ends them immediately.
• Legal obligation: retention of accounting and tax records relating to your purchases.

10) Transfers outside the European Union

Some of our sub-processors are established outside the European Union, mainly in the United States. That includes Stripe, Resend, Sentry, Google Analytics, Microsoft Clarity and Meta. PostHog is hosted in the European Union.

Sender is established in the European Union (Lithuania). Its contract nonetheless allows it to use its own sub-processors, some of them outside the Union, in particular in the United States; those must be certified under the EU-US Data Privacy Framework.

These transfers are framed by the mechanisms set out in Chapter V of the GDPR: an adequacy decision where the provider is certified under the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses otherwise. You can ask us for a copy of the safeguards that apply.

11) Minors

The service is not intended for people under 16 and we do not knowingly collect their data. If you believe a minor has given us personal data, write to us and we will delete it.

12) Complaint to a supervisory authority

If you consider that the processing of your data does not comply with the regulation, you may lodge a complaint with a data protection authority, without prejudice to any judicial remedy.

Our lead authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels. You may also contact the authority of your country of residence or place of work: the CNIL in France, the CNPD in Luxembourg, the Office of the Privacy Commissioner in Canada.