Privacy Policy

1. Who is responsible for your data

Tools Products FZ-LLC (“Shorty”, “we”, “us” or “our”), based in Dubai, United Arab Emirates, is responsible for the personal data described in this Policy and is the controller of that data for the purposes of European data protection law. Contact us at support@tools-labs.com.

2. Data we collect

Account and contact data

Your email address, name, profile picture, authentication identifiers, account profile details, and messages you send to us.

Content and project data

Reference videos, footage, images, audio, music, prompts, notes, project settings, generated editing plans, rendered outputs, file metadata and related processing records. Content may contain personal data about you or other people.

Subscription and transaction data

Your plan, billing status, purchase amount, currency, transaction identifiers and limited payment-related details provided by our payment processor. We do not receive or store your full card number.

Usage, device and technical data

IP address, browser and device type, operating system, approximate location derived from your IP address, timestamps, requested pages, feature interactions, error and diagnostic records, security signals, and identifiers stored in cookies or local storage.

Data we ask you not to provide

Please do not send us special categories of personal data — such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation — or government identifiers, unless we specifically ask for them. We do not need this data to provide the Service, and we do not seek to infer characteristics about you from it.

3. Where the data comes from

• From you, when you create an account, upload content, configure a project, subscribe, or contact us.
• Automatically, when you use Shorty, through our servers, cookies, local storage and error-reporting tools.
• From service providers, such as Supabase (authentication and storage) and Stripe (payments), which pass us limited account, authentication and transaction information.
• From linked accounts, if you choose to sign in with Google, as described in the Google sign-in section below.

4. How we use data

We use personal data to:

• provide accounts, authenticate users, store projects, analyse content, create edit plans, render outputs and deliver the Service;
• process subscriptions, maintain transaction records and provide support;
• protect Shorty, prevent abuse, investigate incidents and enforce our Terms;
• monitor reliability, fix errors, understand feature performance and improve the Service;
• send essential service, security, billing and policy notices;
• send marketing only where permitted and honour opt-out choices; and
• comply with legal obligations and establish, exercise or defend legal claims.

Depending on where you live, our legal grounds may include performing our contract with you, your consent, compliance with law, and our legitimate interests in operating, securing and improving Shorty. Where we rely on consent, you may withdraw it at any time without affecting earlier processing. Users in Europe and the UK can find a purpose-by-purpose breakdown in the Notice to European and UK users.

Aggregated and de-identified data

We may create aggregated, de-identified or anonymised data from personal data, by removing the information that makes it identifiable. We do not attempt to re-identify such data, except to test that our de-identification works. We may use and share aggregated or anonymised data for lawful business purposes such as measuring reliability, analysing usage and describing the Service.

5. AI and media processing

Shorty uses automated systems to inspect uploaded media and instructions for characteristics such as scenes, motion, speech, captions, pacing, transitions and visual style. These systems use the results to prepare editing specifications and outputs you request.

Shorty uses AI service providers, including Google Gemini and Anthropic, to process reference media, footage, derived media samples, analyses, prompts and instructions on our behalf as needed to understand the uploads, plan the edit, author the rendering logic and validate the requested output. Depending on the edit, this processing may include sampled frames, contact sheets, transcripts, media descriptions and rendered previews.

When a reference contains music, Shorty may extract and analyse that soundtrack and use it in the rendered output. Upload a reference only when you have the rights or permission needed to process and use its audio.

Do not upload sensitive personal data or media you are not authorised to use. You are responsible for informing people whose personal data appears in content you submit and for obtaining any consent required by law.

We do not use Your Content to train general-purpose AI models unless we first tell you and obtain any consent required by law.

No automated decisions with legal effects

Although the Service is automated, we do not use your personal data to make decisions about you by automated means alone that produce legal effects concerning you or similarly significantly affect you.

6. Signing in with Google

Shorty offers “Continue with Google” as an optional way to create and access your account. If you use it, Google shares a limited set of profile information with us: your name, email address, profile picture and Google account identifier. We use that information only to create your Shorty account, authenticate you when you return, contact you about the Service, and support you if you ask for help.

Shorty does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos or any other Google service data. We request only the basic openid, email and profile scopes.

Shorty's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not transfer it to third parties except as needed to provide or improve the features you use or as required by law, do not use it for advertising, and do not allow humans to read it except with your explicit consent, for security or abuse investigations, to comply with law, or where the data has been aggregated and de-identified.

You can disconnect Shorty from your Google Account at any time at myaccount.google.com/permissions. Revoking access does not delete data we have already received; to delete that data, email support@tools-labs.com and we will delete your account and associated data.

7. When we share data

We may share personal data with:

• service providers that support hosting, authentication, private storage, media processing, rendering, error monitoring, communications, security and customer support;
• AI providers, including Google and Anthropic, which process content and instructions on our behalf as described above;
• payment providers, including Stripe, to process subscriptions and manage transactions. Stripe handles card details directly and uses them in line with its own privacy policy;
• linked third-party services you connect to your account, such as Google when you use “Continue with Google”;
• affiliates, meaning any parent, subsidiary or commonly controlled company within our group, for the purposes described in this Policy;
• professional advisers, such as lawyers, auditors, bankers and insurers, in the course of the services they provide to us;
• authorities and others where we believe in good faith it is reasonably necessary to comply with law, respond to lawful requests, protect rights and safety, or handle legal claims;
• a buyer or successor in connection with a merger, financing, reorganisation, insolvency or sale of all or part of our business, including with prospective counterparties and their advisers; and
• other parties at your direction or with your consent.

We do not sell your personal data, and we do not share it for cross-context behavioural or targeted advertising.

Your projects and uploads are private to your account by default. Content becomes visible to others only when you download, publish or otherwise share it yourself, and we are not responsible for how others use content once you have shared it.

8. Your choices

• Review and update your details. You can review and change account information while signed in.
• Delete content or close your account. You can delete projects and uploads from your account. To close your account entirely, email support@tools-labs.com.
• Marketing messages. Use the unsubscribe link in any marketing email, or contact us. You will still receive service, security, billing and policy messages.
• Cookies and local storage. Control these through your browser, subject to the limits described below.
• Linked accounts. Disconnect Shorty from your Google Account at any time. That choice does not apply to information we have already received.
• Do Not Track and Global Privacy Control. We do not serve advertising and do not sell or share personal data, so there is no advertising tracking to opt out of. We do not currently respond to “Do Not Track” browser signals. Where applicable law requires it, we treat a Global Privacy Control signal as a valid opt-out request.
• Declining to provide data. Some data is needed to run the Service. If you do not provide it, we may not be able to give you an account or process your projects.

9. International transfers

Shorty and its providers may process data in the United Arab Emirates, the United States, the European Union and other countries. Privacy laws in those countries may differ from those where you live. Where required, we use appropriate safeguards for cross-border transfers — such as standard contractual clauses approved by the relevant authority — and require providers to protect data consistently with applicable law. Users in Europe and the UK should read the Notice to European and UK users for details.

10. Data retention

We keep personal data only as long as reasonably needed for the purposes described above. To decide how long that is, we consider the amount, nature and sensitivity of the data, the potential harm from unauthorised use or disclosure, the purposes we process it for and whether we can achieve those purposes another way, your plan and account status, project settings, dispute and fraud-prevention needs, backup cycles, and applicable legal requirements.

We generally retain account and transaction records while your account is active and for a reasonable period afterward. Uploaded media, project data and outputs may remain available for the storage period associated with your plan or until you delete them, subject to queued deletion, backups and legal holds.

When we no longer need personal data, we delete or anonymise it. Where immediate deletion is not possible — for example because the data sits in backup archives — we store it securely and isolate it from further processing until deletion is possible. Anonymised data may be kept indefinitely.

11. Security

We use technical and organisational safeguards designed to protect personal data, including access controls, private storage controls and encrypted transmission where appropriate. Security risk is inherent in all internet and information technologies, so we cannot guarantee absolute security. Keep your account access secure and contact us if you suspect unauthorised use.

12. Cookies and local storage

Shorty uses cookies, browser storage and similar technologies that are necessary for sign-in, session continuity, security, preferences and core Service operation. We also use limited first-party product analytics and error monitoring to understand reliability and feature performance. Our payment and authentication providers may set their own essential technologies when you use their services.

You can control cookies through your browser. Blocking essential storage may prevent sign-in or other parts of Shorty from working. We do not use advertising or cross-site tracking cookies. If we introduce non-essential analytics or advertising cookies, we will provide any notice and choices required by law before doing so.

13. Your privacy rights

Depending on your location and subject to legal exceptions, you may have the right to:

• ask whether we process your personal data and receive information or a copy;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to certain processing or withdraw consent;
• receive certain data in a portable format; and
• complain to the relevant data protection authority.

To make a request, email support@tools-labs.com. We may need information from you to confirm your identity before we act, and we may ask an authorised agent to show proof that they may act for you. We respond within the time applicable law allows, and if we decline a request in whole or in part we will explain why. Exercising these rights is free and we will not treat you differently for doing so.

14. Notice to European and UK users

This section applies to individuals in the European Economic Area and the United Kingdom (“Europe”). References to personal data should be read as “personal data” under the EU GDPR and UK GDPR.

Controller

Tools Products FZ-LLC, Dubai, United Arab Emirates, is the controller of the personal data covered by this Policy. Contact us at support@tools-labs.com.

Our legal bases

The GDPR requires a legal basis for each purpose for which we use personal data. Ours are:

• Service delivery and operations — account, content, project and transaction data. Basis: performance of our contract with you.
• Payments and account records — subscription and transaction data. Basis: performance of our contract with you, and compliance with legal accounting and tax obligations.
• Security, abuse prevention and incident investigation — account, device and usage data. Basis: our legitimate interest in keeping the Service, our users and our systems safe, and compliance with law.
• Reliability, error monitoring and Service improvement — usage, device and diagnostic data. Basis: our legitimate interest in providing a Service that works well and improves over time; consent for any optional cookies used for this purpose.
• Service, security and policy notices — contact data. Basis: performance of our contract with you and compliance with law.
• Direct marketing — contact data. Basis: our legitimate interest in promoting the Service, or your consent where consent is required.
• Compliance, legal claims and corporate transactions — any relevant data. Basis: compliance with law, and our legitimate interest in following legal process and in protecting and transferring our business.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and fundamental rights. You can ask us for more detail about that assessment.

Your rights

You may ask us to give you access to your personal data, correct it, delete it, transfer a machine-readable copy to you or a third party, restrict how we process it, or object to processing based on our legitimate interests. You may object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

Send requests to support@tools-labs.com. We may ask for information to confirm your identity. If we reject a request in whole or in part, we will tell you why, subject to any legal restrictions.

Complaints

If you are unhappy with how we handle your personal data or respond to a request, you may complain to the data protection authority where you live, work, or where you believe the issue occurred. In the EEA, contact details for each national authority are published by the European Data Protection Board. In the UK, contact the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, tel. +44 303 123 1113, ico.org.uk.

Transfers of data out of Europe

We are based in the United Arab Emirates, and our providers operate in the UAE, the United States and elsewhere. If you use the Service, your personal data will be accessed and processed outside Europe.

Some of these countries — including the United Arab Emirates and the United States — are not covered by an adequacy decision of the European Commission or the UK Government, meaning their legal regimes have not been recognised as offering protection equivalent to European law. Where we transfer personal data to a country without an adequacy decision, we put in place appropriate safeguards designed to give the data effectively the same protection it has in Europe — normally the standard contractual clauses approved by the European Commission and, where relevant, the UK International Data Transfer Addendum. In limited cases we may instead rely on a derogation permitted by the GDPR, such as your explicit consent or the necessity of the transfer to perform our contract with you.

You can email support@tools-labs.com for more information about the mechanism used for a particular transfer, or to request a copy of the relevant safeguards.

Sensitive data and automated decisions

We ask that you do not provide special categories of personal data through the Service, as described in section 2. We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

15. US state privacy rights

This section applies to residents of US states whose comprehensive privacy laws apply to us, including California, Colorado, Connecticut, Virginia and Texas. Not every right is available under every state's law, and we may decline a request where the law permits.

Subject to those limits, you may ask us to tell you what personal information we have collected about you and how we use and disclose it, give you a copy of it, correct it, delete it, and appeal a decision to refuse a request. The categories of personal information we collect, the sources we collect them from, the purposes we use them for and the categories of recipients we disclose them to are set out in sections 2, 3, 4 and 7 of this Policy, and our retention criteria are set out in section 10.

We do not sell personal information and we do not share it for cross-context behavioural or targeted advertising, as those terms are defined in these laws. We do not use personal information for profiling that produces legal or similarly significant effects. We do not knowingly collect personal information from anyone under 18, so we do not sell or share the personal information of minors. We do not process sensitive personal information for the purpose of inferring characteristics about you.

To exercise a right, email support@tools-labs.com. We may need to verify your identity and residency before we act, and we may require a copy of a valid power of attorney or written authorisation before accepting a request from an authorised agent. You will not be discriminated against for exercising these rights.

California residents may also request, under California Civil Code § 1798.83, the names of third parties to whom we disclosed personal information for their own direct marketing purposes in the preceding calendar year. We do not make such disclosures, but you may confirm this by emailing us with the subject line “Shine the Light Request”. Nevada residents may direct us not to sell covered personal information; we do not sell personal information, but you may register that direction by contacting us.

16. Children

Shorty is not intended for children under 18, and we do not knowingly collect their personal data. If you are a parent or guardian and believe a child has provided personal data to us, contact us so we can investigate and delete it as applicable law requires.

17. Third-party links and services

Our Service may link to or integrate with websites and services that we do not control. Those links and integrations are not an endorsement or a sign that we are affiliated with the third party. Their privacy practices are governed by their own policies, and we encourage you to review them.

18. Changes to this Policy

We may update this Policy as Shorty, the law or our practices change. We will post the new version and update the effective date, and the updated Policy takes effect when posted unless we say otherwise. If a change materially affects your rights, we will provide reasonable additional notice. Continuing to use Shorty after a change takes effect means the updated Policy applies to you.

19. Contact

For privacy questions or requests, email support@tools-labs.com.

Tools Products FZ-LLC
Dubai, United Arab Emirates