Vidext

GDPR overview

GDPR compliance is claimed explicitly and documented in unusual detail. The publisher is established in Valencia, Spanish law applies and the courts of Valencia have jurisdiction. A full Data Processing Agreement forms Annex I of the terms: documented instructions, confidentiality undertakings, Article 32 security measures, breach notification without undue delay, assistance with data subject rights, and audits on thirty days' notice. Sub-processors are covered by a prior general authorisation with a fifteen-day right of reasoned objection, and Appendix A names them individually. Transfers outside the EEA rely on adequacy decisions or Standard Contractual Clauses. The vendor undertakes to cooperate with the Spanish supervisory authority, the AEPD, and to notify a breach within seventy-two hours. Rights are exercised at datos@vidext.io or the registered office. No data protection officer is named, and no Article 27 representative is designated, which is consistent with an EU-established controller.

Who owns the data?

Vidext states that the customer keeps its rights over the material it uploads and over the content generated for its organisation, subject to applicable law, and that it neither sells nor rents customer content. Under the Data Processing Agreement annexed to the terms, the customer is the controller and Vidext the processor, acting on documented instructions; at the end of the engagement Vidext deletes or returns the personal data at the controller's choice, unless a tax or commercial obligation requires retention. One caveat deserves a lawyer's eye: the terms also have the customer grant Vidext a free, irrevocable, non-exclusive, transferable, sub-licensable and worldwide licence over the content it supplies, for the maximum period the law allows.

Reuse rights

Content created in Vidext belongs to the customer's organisation, which may publish it, assign it to teams and export it as MP4, PDF, TXT or a SCORM/xAPI package for its own learning management system without asking further permission. Vidext says it processes that content only to perform the requested feature, provide support, maintain security and meet legal obligations, and its trust centre commits in writing that customer content is never used to train Vidext's own AI models. That commitment sits awkwardly beside the privacy policy, which reserves the right to process submitted content for internal research or to improve the services or other Vidext technologies on a legitimate interest basis. Thirteen named third parties, among them Google, OpenAI, Anthropic, xAI, Mistral AI, ElevenLabs and Cloudflare, receive data according to the feature invoked, and the vendor states that a request is routed only to the service needed rather than broadcast to all of them.

Data retention & training

Hosting summary

Vidext runs as a software-as-a-service product on cloud infrastructure, and the sub-processors are named individually in Appendix A of the terms. Amazon Web Services provides hosting and storage from Ireland and the European Union, or from the United States under Standard Contractual Clauses; Google Cloud Platform supplies infrastructure and computing from the European Union or under the same clauses. Planet Scale operates the database from the United States, Stripe Payments Europe handles payments from Ireland and the United States, and OpenAI and ElevenLabs process language and speech from the United States under the Data Privacy Framework or Standard Contractual Clauses. The trust centre lists further AI and research providers, among them Google, Anthropic, xAI, Mistral AI, Cloudflare, Inworld AI, RunPod, Firecrawl, Exa, OpenAlex, OpenRouter and Braintrust. Transfers outside the European Economic Area rely on adequacy decisions or Standard Contractual Clauses with supplementary measures. The privacy policy reserves the possibility of using processors located outside Spain and the European Union. Content is scoped to an organisation, access is role-based, and encryption at rest and in transit is claimed.