Privacy Policy

1. Who is responsible for your data

Tools Products FZ-LLC (“Shorty”, “we”, “us” or “our”) is responsible for the personal data described in this Policy and is the controller of that data for the purposes of European data protection law. Contact us through Help.

2. Data we collect

Account and contact data

Your email address, name, profile picture, authentication identifiers, account profile details, and messages you send to us.

Content and project data

Reference videos, footage, images, audio, music, prompts, notes, project settings, generated editing plans, rendered outputs, file metadata and related processing records. Content may contain personal data about you or other people.

Subscription and transaction data

Your plan, billing status, purchase amount, currency, transaction identifiers and limited payment-related details provided by our payment processor. We do not receive or store your full card number.

Usage, device and technical data

IP address, browser and device type, operating system, approximate location derived from your IP address, timestamps, requested pages, feature interactions, error and diagnostic records, security signals, and identifiers stored in cookies or local storage.

If you choose to answer our optional discovery survey, we send your selected source and any question summary you submit to PostHog to understand how people find Shorty. You can leave the question blank or skip the survey. Please leave personal and client details out of your summary.

When analytics is enabled and you click Edit, we send your submitted editing prompt, selected reference or saved style details, editing settings and footage counts to PostHog to understand what people want to create and improve Shorty. This happens even if you have not signed in or purchased. This event does not include your media files or their private filenames or URLs.

Data we ask you not to provide

Please do not send us special categories of personal data — such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation — or government identifiers, unless we specifically ask for them. We do not need this data to provide the Service, and we do not seek to infer characteristics about you from it.

3. Where the data comes from

• From you, when you create an account, upload content, configure a project, subscribe, or contact us.
• Automatically, when you use Shorty, through our servers, cookies, local storage and error-reporting tools.
• From service providers, such as Supabase (authentication and storage) and Stripe (payments), which pass us limited account, authentication and transaction information.
• From linked accounts, if you choose to sign in with Google, as described in the Google sign-in section below.

4. How we use data

We use personal data to:

• provide accounts, authenticate users, store projects, analyse content, create edit plans, render outputs and deliver the Service;
• process subscriptions, maintain transaction records and provide support;
• protect Shorty, prevent abuse, investigate incidents and enforce our Terms;
• monitor reliability, fix errors, understand feature performance and improve the Service;
• send essential service, security, billing and policy notices;
• send marketing only where permitted and honour opt-out choices; and
• comply with legal obligations and establish, exercise or defend legal claims.

Depending on where you live, our legal grounds may include performing our contract with you, your consent, compliance with law, and our legitimate interests in operating, securing and improving Shorty. Where we rely on consent, you may withdraw it at any time without affecting earlier processing. Users in Europe and the UK can find a purpose-by-purpose breakdown in the Notice to European and UK users.

Aggregated and de-identified data

We may create aggregated, de-identified or anonymised data from personal data, by removing the information that makes it identifiable. We do not attempt to re-identify such data, except to test that our de-identification works. We may use and share aggregated or anonymised data for lawful business purposes such as measuring reliability, analysing usage and describing the Service.

5. AI and media processing

Shorty uses automated systems to inspect uploaded media and instructions for characteristics such as scenes, motion, speech, captions, pacing, transitions and visual style. These systems use the results to prepare editing specifications and outputs you request.

Shorty uses AI service providers, including Google Gemini and Anthropic, to process reference media, footage, derived media samples, analyses, prompts and instructions on our behalf as needed to understand the uploads, plan the edit, author the rendering logic and validate the requested output. Depending on the edit, this processing may include sampled frames, contact sheets, transcripts, media descriptions and rendered previews.

When a reference contains music, Shorty may extract and analyse that soundtrack and use it in the rendered output. Upload a reference only when you have the rights or permission needed to process and use its audio.

Do not upload sensitive personal data or media you are not authorised to use. You are responsible for informing people whose personal data appears in content you submit and for obtaining any consent required by law.

We do not use Your Content to train general-purpose AI models unless we first tell you and obtain any consent required by law.

No automated decisions with legal effects

Although the Service is automated, we do not use your personal data to make decisions about you by automated means alone that produce legal effects concerning you or similarly significantly affect you.

6. Signing in with Google

Shorty offers “Continue with Google” as an optional way to create and access your account. If you use it, Google shares a limited set of profile information with us: your name, email address, profile picture and Google account identifier. We use that information only to create your Shorty account, authenticate you when you return, contact you about the Service, and support you if you ask for help.

Google sign-in requests only the basic openid, email and profile scopes. Signing in does not itself connect Google Drive.

Dropbox footage connections

Where enabled, connecting Dropbox requests read-only account information, file metadata and file content permissions (account_info.read, files.metadata.read, files.content.read). We list video files across your folders and copy only the clips you select into Shorty's private storage for editing. We do not modify or delete your Dropbox files. Connection credentials are encrypted on our servers and are not provided to editing agents.

Disconnecting deletes the saved connection and requests revocation at Dropbox. Previously imported copies remain in Shorty until deleted under the media retention practices below. Selected clips are processed by the AI and media providers described in Section 5, in the same way as uploaded footage.

Google Drive public folders

You can paste a Google Drive folder link after setting its sharing to Anyone with the link · Viewer and allowing downloads. Anyone who has that link can view the shared files. Shorty uses a dedicated server reader to list videos in the folder and its subfolders. We process only the videos you explicitly select for import. Originals remain in Drive; Shorty stores prepared editing copies under the retention and deletion practices below. Keep originals accessible until preparation finishes. This flow does not connect your private Google account or request customer Drive OAuth permissions.

Private Google Drive connections — temporarily disabled

Private account connections remain unavailable pending verification and the security assessment. Previously imported media remains subject to the retention and deletion practices below.

When available, you can separately connect Google Drive to browse and import private media. This requests read-only Drive access (drive.readonly) and your Google email address (userinfo.email). We use this access to show your account, list and search file names and metadata, navigate folders, and download the files you select. We do not modify or delete files in Google Drive and do not automatically import your entire Drive.

Connection credentials are encrypted on our servers and are not given to editing agents. Selected files are copied into Shorty's private storage and processed for the edits you request, including by the AI and media providers described in Section 5. Imported media follows the same retention and deletion practices as uploaded media. Disconnecting Google Drive deletes the saved connection and requests revocation at Google; it does not delete copies already imported into Shorty.

Shorty's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not transfer it to third parties except as needed to provide or improve the features you use or as required by law, do not use it for advertising, and do not allow humans to read it except with your explicit consent, for security or abuse investigations, to comply with law, or where the data has been aggregated and de-identified.

You can disconnect Shorty from your Google Account at any time at myaccount.google.com/permissions. Revoking access does not delete data we have already received; to delete that data, contact us through Help and we will delete your account and associated data.

7. When we share data

We may share personal data with:

• service providers that support hosting, authentication, private storage, media processing, rendering, error monitoring, communications, security and customer support;
• AI providers, including Google and Anthropic, which process content and instructions on our behalf as described above;
• payment providers, including Stripe, to process subscriptions and manage transactions. Stripe handles card details directly and uses them in line with its own privacy policy;
• FirstPromoter, when you allow advertising cookies, to attribute partner referrals and calculate commissions. It receives referral identifiers, page and browser information, and your verified account email after a new account is confirmed. The connected billing integration supplies qualifying transaction, refund and cancellation information. We do not send editing prompts or uploaded media to FirstPromoter;
• Reddit, when you allow advertising cookies, to measure visits and advertising results using device details, page information and ad click identifiers;
• Meta, when you allow advertising cookies, to measure visits and completed paid subscriptions from our ads. Meta receives page URLs, referrer information, IP address, browser details, advertising cookie or click identifiers, and verified purchase amount, currency and an event identifier. We do not send Meta your account profile, editing prompts or uploaded media through the Meta Pixel;
• OpenAI, when you allow advertising cookies, to measure visits and completed paid subscriptions associated with ads in ChatGPT. OpenAI receives website and referrer information, IP address, browser details, advertising cookie or click identifiers, and verified subscription amount, currency and an event identifier. Its automatic advanced matching may detect supported contact information on the page, normalize and hash it in your browser, and include the resulting identifiers with measurement events. We do not include editing prompts, uploaded media, filenames, payment card details or Stripe session IDs in these events. Our page-view and subscription events opt out of future user-level personalization;
• linked third-party services you connect to your account, such as Google when you use “Continue with Google”;
• affiliates, meaning any parent, subsidiary or commonly controlled company within our group, for the purposes described in this Policy;
• professional advisers, such as lawyers, auditors, bankers and insurers, in the course of the services they provide to us;
• authorities and others where we believe in good faith it is reasonably necessary to comply with law, respond to lawful requests, protect rights and safety, or handle legal claims;
• a buyer or successor in connection with a merger, financing, reorganisation, insolvency or sale of all or part of our business, including with prospective counterparties and their advisers; and
• other parties at your direction or with your consent.

We do not sell your personal data for money. If you allow advertising cookies, information shared with Meta, OpenAI or Reddit may be considered sharing for cross-context behavioural or targeted advertising. You can decline or withdraw this choice using Cookie Preferences.

Your projects and uploads are private to your account by default. Content becomes visible to others only when you download, publish or otherwise share it yourself, and we are not responsible for how others use content once you have shared it.

8. Your choices

• Review and update your details. You can review and change account information while signed in.
• Delete content or close your account. You can delete projects and uploads from your account. To close your account entirely, contact us through Help.
• Marketing messages. Use the unsubscribe link in any marketing email, or contact us. You will still receive service, security, billing and policy messages.
• Cookies and local storage. Control these through your browser, subject to the limits described below.
• Linked accounts. Disconnect Shorty from your Google Account at any time. That choice does not apply to information we have already received.
• Do Not Track and Global Privacy Control. A Global Privacy Control or enabled “Do Not Track” browser signal keeps optional analytics and advertising cookies off. You can also decline advertising cookies or change your choice using Cookie Preferences.
• Declining to provide data. Some data is needed to run the Service. If you do not provide it, we may not be able to give you an account or process your projects.

9. International transfers

Shorty and its providers may process data in the United Arab Emirates, the United States, the European Union and other countries. Privacy laws in those countries may differ from those where you live. Where required, we use appropriate safeguards for cross-border transfers — such as standard contractual clauses approved by the relevant authority — and require providers to protect data consistently with applicable law. Users in Europe and the UK should read the Notice to European and UK users for details.

10. Data retention

We keep personal data only as long as reasonably needed for the purposes described above. To decide how long that is, we consider the amount, nature and sensitivity of the data, the potential harm from unauthorised use or disclosure, the purposes we process it for and whether we can achieve those purposes another way, your plan and account status, project settings, dispute and fraud-prevention needs, backup cycles, and applicable legal requirements.

We generally retain account and transaction records while your account is active and for a reasonable period afterward. Uploaded media, project data and outputs may remain available for the storage period associated with your plan or until you delete them, subject to queued deletion, backups and legal holds.

When we no longer need personal data, we delete or anonymise it. Where immediate deletion is not possible — for example because the data sits in backup archives — we store it securely and isolate it from further processing until deletion is possible. Anonymised data may be kept indefinitely.

11. Security

We use technical and organisational safeguards designed to protect personal data, including access controls, private storage controls and encrypted transmission where appropriate. Security risk is inherent in all internet and information technologies, so we cannot guarantee absolute security. Keep your account access secure and contact us if you suspect unauthorised use.

12. Cookies and local storage

Shorty uses cookies, browser storage and similar technologies that are necessary for sign-in, session continuity, security, preferences and core Service operation. With your permission, we use PostHog for product analytics, performance measurements, error monitoring and session replay. Outside the EU, EEA, UK and Switzerland, visitors who have not yet made a choice are counted anonymously without cookies — no storage on your device, no session replay and no link to an account — until they choose; rejecting stops it. If you create an account, we also save the campaign tags, referring site and landing page of the visit that first brought you to Shorty with your account. You can turn analytics and advertising on or off separately in Cookie Preferences. See our Cookie Notice for details about each category and the technologies we use. Our payment and authentication providers may set their own essential technologies when you use their services.

With your permission, we load the Meta and OpenAI pixels to measure page visits, completed paid subscriptions and advertising effectiveness. Meta also receives a completed-registration event after a new account is confirmed. We use an opaque event identifier to avoid counting repeated sign-ins as new accounts; we do not include your account profile in this event. They may use cookies and click identifiers to associate activity with an ad. OpenAI stores its ad click reference in the first-party __oppref cookie and may use a __obref browser identifier. Automatic advanced matching may include securely hashed contact identifiers detected on the page, as described in section 7. Both pixels are off until you enable Advertising in Cookie Preferences or choose Accept All Cookies. Reddit measurement is also controlled by the Advertising preference. An earlier Meta-only acceptance does not enable OpenAI measurement; we ask for the updated choice.

Declining does not prevent you from using Shorty. Use Cookie Preferences in the footer to change your choice; withdrawing it stops future measurement events and removes the advertising cookies we can access. We retain your consent preference so we can respect it. This choice does not delete data already received by the providers. Learn more in Meta’s Privacy Policy and OpenAI’s Privacy Policy. You can also control cookies through your browser. Blocking essential storage may prevent sign-in or other parts of Shorty from working.

13. Your privacy rights

Depending on your location and subject to legal exceptions, you may have the right to:

• ask whether we process your personal data and receive information or a copy;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to certain processing or withdraw consent;
• receive certain data in a portable format; and
• complain to the relevant data protection authority.

To make a request, contact us through Help. We may need information from you to confirm your identity before we act, and we may ask an authorised agent to show proof that they may act for you. We respond within the time applicable law allows, and if we decline a request in whole or in part we will explain why. Exercising these rights is free and we will not treat you differently for doing so.

14. Notice to European and UK users

This section applies to individuals in the European Economic Area and the United Kingdom (“Europe”). References to personal data should be read as “personal data” under the EU GDPR and UK GDPR.

Controller

Tools Products FZ-LLC is the controller of the personal data covered by this Policy. Contact us through Help.

Our legal bases

The GDPR requires a legal basis for each purpose for which we use personal data. Ours are:

• Service delivery and operations — account, content, project and transaction data. Basis: performance of our contract with you.
• Payments and account records — subscription and transaction data. Basis: performance of our contract with you, and compliance with legal accounting and tax obligations.
• Security, abuse prevention and incident investigation — account, device and usage data. Basis: our legitimate interest in keeping the Service, our users and our systems safe, and compliance with law.
• Reliability, error monitoring and Service improvement — usage, device and diagnostic data. Basis: our legitimate interest in providing a Service that works well and improves over time; consent for any optional cookies used for this purpose.
• Service, security and policy notices — contact data. Basis: performance of our contract with you and compliance with law.
• Direct marketing — contact data. Basis: our legitimate interest in promoting the Service, or your consent where consent is required.
• Compliance, legal claims and corporate transactions — any relevant data. Basis: compliance with law, and our legitimate interest in following legal process and in protecting and transferring our business.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and fundamental rights. You can ask us for more detail about that assessment.

Your rights

You may ask us to give you access to your personal data, correct it, delete it, transfer a machine-readable copy to you or a third party, restrict how we process it, or object to processing based on our legitimate interests. You may object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

Send requests through Help. We may ask for information to confirm your identity. If we reject a request in whole or in part, we will tell you why, subject to any legal restrictions.

Complaints

If you are unhappy with how we handle your personal data or respond to a request, you may complain to the data protection authority where you live, work, or where you believe the issue occurred. In the EEA, contact details for each national authority are published by the European Data Protection Board. In the UK, contact the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, tel. +44 303 123 1113, ico.org.uk.

Transfers of data out of Europe

Our providers operate in the United Arab Emirates, the United States and elsewhere. If you use the Service, your personal data will be accessed and processed outside Europe.

Some of these countries — including the United Arab Emirates and the United States — are not covered by an adequacy decision of the European Commission or the UK Government, meaning their legal regimes have not been recognised as offering protection equivalent to European law. Where we transfer personal data to a country without an adequacy decision, we put in place appropriate safeguards designed to give the data effectively the same protection it has in Europe — normally the standard contractual clauses approved by the European Commission and, where relevant, the UK International Data Transfer Addendum. In limited cases we may instead rely on a derogation permitted by the GDPR, such as your explicit consent or the necessity of the transfer to perform our contract with you.

You can contact us through Help for more information about the mechanism used for a particular transfer, or to request a copy of the relevant safeguards.

Sensitive data and automated decisions

We ask that you do not provide special categories of personal data through the Service, as described in section 2. We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

15. US state privacy rights

This section applies to residents of US states whose comprehensive privacy laws apply to us, including California, Colorado, Connecticut, Virginia and Texas. Not every right is available under every state's law, and we may decline a request where the law permits.

Subject to those limits, you may ask us to tell you what personal information we have collected about you and how we use and disclose it, give you a copy of it, correct it, delete it, and appeal a decision to refuse a request. The categories of personal information we collect, the sources we collect them from, the purposes we use them for and the categories of recipients we disclose them to are set out in sections 2, 3, 4 and 7 of this Policy, and our retention criteria are set out in section 10.

We do not sell personal information for money. When you allow advertising cookies, sharing of online identifiers, page visits and subscription events with Meta, OpenAI or Reddit may constitute sharing or a sale under some state privacy laws. You can opt out using Cookie Preferences, and we honor Global Privacy Control for optional analytics and advertising. We do not use personal information for profiling that produces legal or similarly significant effects. We do not knowingly collect personal information from anyone under 18, so we do not sell or share the personal information of minors. We do not process sensitive personal information for the purpose of inferring characteristics about you.

To exercise a right, contact us through Help. We may need to verify your identity and residency before we act, and we may require a copy of a valid power of attorney or written authorisation before accepting a request from an authorised agent. You will not be discriminated against for exercising these rights.

California residents may also request, under California Civil Code § 1798.83, the names of third parties to whom we disclosed personal information for their own direct marketing purposes in the preceding calendar year. We do not make such disclosures, but you may confirm this by emailing us with the subject line “Shine the Light Request”. Nevada residents may direct us not to sell covered personal information; we do not sell personal information, but you may register that direction by contacting us.

16. Children

Shorty is not intended for children under 18, and we do not knowingly collect their personal data. If you are a parent or guardian and believe a child has provided personal data to us, contact us so we can investigate and delete it as applicable law requires.

17. Third-party links and services

Our Service may link to or integrate with websites and services that we do not control. Those links and integrations are not an endorsement or a sign that we are affiliated with the third party. Their privacy practices are governed by their own policies, and we encourage you to review them.

18. Changes to this Policy

We may update this Policy as Shorty, the law or our practices change. We will post the new version and update the effective date, and the updated Policy takes effect when posted unless we say otherwise. If a change materially affects your rights, we will provide reasonable additional notice. Continuing to use Shorty after a change takes effect means the updated Policy applies to you.

19. Contact

For privacy questions or requests, contact us through Help.

Tools Products FZ-LLC