01Who is responsible for your data
This notice explains personal-data processing through cutcrush.app, its video tools, API and connected assistants. The operator below is the controller for account administration, billing, security and running the service: they decide why and how that information is processed.
Uladzislau Stanisheuski, operating as CutcrushBialowieska 110/30, 54-234 Wroclaw, Poland
Privacy requests: iamstanlyx@gmail.com
If a business submits footage containing other people’s data, it is responsible for its own lawful basis, permissions and notices. We process submitted media to carry out the requested editing work. Business customers who require a data-processing agreement should contact us to establish the applicable processing arrangements before uploading client or employee personal data. This notice does not replace such an agreement.
02Information we process
- Account information: email address, user and account identifiers, authentication records, account name and saved clip preferences and sign-in information needed to protect access to your account.
- Media and instructions: uploaded files, filenames, source URLs and imported copies, video and audio, titles, thumbnails, duration, technical metadata, transcripts, generated clips, style settings and any focus instructions you provide. Footage may contain faces, voices and other personal information.
- Purchases and usage: subscription and payment references, selected plans, invoice and refund records, payment status, credit grants, reservations and usage. Our payment processor collects card details directly during checkout; Cutcrush does not store full card numbers or card security codes.
- Connections: names and permissions of authorized API keys and OAuth apps, credential hashes, token records, daily credit caps, revocations and actions taken through a connection.
- Operational and support information: job states, errors, timestamps, service events, support requests and audit records. Hosting, authentication and payment services also process request information such as IP address and browser/device data to deliver and secure their services.
Information comes from you, tools you authorize, videos or public sources you ask us to retrieve, and our authentication, processing and payment providers. Discovery uses public YouTube metadata. Public availability does not remove someone’s privacy rights.
Account information is needed to sign in; payment information is needed for purchases; media and instructions are needed for editing. You can browse public pages without an account. Do not include unnecessary confidential information or sensitive personal data, such as health details, in your footage or instructions.
03Why we use it and our legal bases
| Purpose | Information involved | GDPR basis |
|---|---|---|
| Provide your account, editing, storage and downloads | Account details, media, instructions and job records | Performance of our contract, Article 6(1)(b) |
| Process purchases and manage your subscription | Account, billing and credit records | Contract, Article 6(1)(b); legal duties, Article 6(1)(c) |
| Maintain tax records and answer lawful requests | Relevant financial, account and transaction records | Compliance with legal obligations, Article 6(1)(c) |
| Prevent abuse, secure the service and resolve disputes | Access records, usage, errors and audit information | Legitimate interests in a safe, reliable service and protecting legal claims, Article 6(1)(f) |
| Respond to support and understand service performance | Correspondence, job events and operational usage reports | Contract where needed to help you; legitimate interests in resolving problems and improving reliability |
| Carry out an optional activity that requires consent | The information described when consent is requested | Consent, Article 6(1)(a), which can be withdrawn |
For people appearing in another user’s footage, the uploading party must establish its lawful basis; its contract with us does not itself provide consent on their behalf. We do not treat accepting these terms or reading this notice as blanket consent for unrelated uses.
The application sends authentication messages such as verification and password recovery. It does not offer marketing subscriptions or job-completion email notifications. We may respond to messages you send us and communicate about a legal, billing or security matter; Our payment processor may send payment communications.
04Service providers and recipients
We share relevant information with the following categories of recipients to provide the service and fulfil our obligations.
- Account and hosting providers: process account details, media, application records and request information to maintain sign-in, storage, security and access to Cutcrush.
- Media-processing providers: receive source media and editing instructions to create clips, captions, transcripts and related output.
- Analytics providers: receive page-view and session information, a browser identifier and device information. We do not send account emails, video content or form entries for usage analytics, and session replay is disabled.
- Payment providers: process billing and transaction information for purchases, renewals, refunds and fraud prevention. They collect payment details directly and may act as independent controllers for their legal and compliance obligations.
- Content and sign-in platforms: process information needed when you use their content or choose their sign-in option. External previews and thumbnails can disclose your IP address and browser information to the platform serving that content.
- Apps and AI assistants you connect: receive only information within the permissions you grant, which can include project details, transcripts and downloads.
Discovery uses YouTube API Services for public video information. The Google Privacy Policy applies to Google's processing. Search terms and video identifiers may be sent to those services. Loading a YouTube preview or thumbnail sends a request to Google, including your IP address and browser information; opening a video on YouTube is subject to its own policies.
Authorized personnel can access relevant information to operate the service, handle support or address abuse. Support sessions are time-limited, read-only and audited; other administrative actions have separate permissions and audit records. We may disclose information to professional advisers or authorities where necessary for legal duties, disputes or protecting rights.
We do not sell your personal information or provide your videos to advertisers. We do not offer a contractual guarantee that every external AI provider has zero retention or excludes all model improvement uses. Contact us about processing terms before supplying material that requires special confidentiality or training restrictions.
05International processing
Our providers operate internationally, so data may be processed outside Poland or the European Economic Area, including in the United States and other countries where their infrastructure or support teams operate. An EU hosting region does not by itself mean that all provider access stays in the EU.
Transfers subject to GDPR require an applicable legal mechanism, such as an adequacy decision or appropriate safeguards including European Commission Standard Contractual Clauses. Contact iamstanlyx@gmail.com for information about the destination and safeguards applicable to your data, or to request a copy of relevant safeguards with confidential information protected. This notice does not ask you to waive transfer protections.
06How long information stays
- Projects, clips and transcripts: access expires automatically 72 hours after project creation. Our cleanup removes clip references and transcripts; you can delete a project earlier. Associated media records and any copies we retain are removed during cleanup. Active processing or an unresolved submission can delay final cleanup, but does not extend access. Limited transaction identifiers and credit records remain for accounting. Removing a project in Cutcrush does not certify erasure from the provider’s systems, which follow the provider’s retention policies.
- ZIP exports: download access expires within 24 hours or when a source project expires, whichever is earlier. Downloaded copies on your device are under your control.
- Source files: unused uploads older than 24 hours are eligible for cleanup. Files linked to active processing are retained; files linked to recently updated work remain until no linked job is active and no linked project has been updated within seven days. Deletion may also wait for an upload authorization to expire. These are cleanup rules, not guaranteed backup periods.
- Account and preference information: stays while your account is maintained. After an account-deletion request, the media cleanup steps run before the account email and profile are replaced. This is not immediate removal of every record or identifier.
- Financial records: are retained separately to satisfy tax and accounting duties and resolve payment disputes. Polish tax-document retention is generally five years from the end of the calendar year in which the tax payment was due. Suspension or interruption of limitation periods, litigation or another legal duty can extend retention.
- Operational events, support and audit records: are separate from media and may remain after a project is deleted. Retention depends on the security incident, support issue, payment reconciliation or legal claim they document and the applicable limitation period. The media-cleanup schedule does not erase these records; contact us for a record-specific retention or deletion request.
- Temporary authorization records: expired OAuth requests, codes and tokens are eligible for cleanup after their expiry window; rate-limit records older than seven days are cleaned up. Browser storage remains until cleared by the browser or the relevant feature.
Cleanup runs as a background process and can require retries. Copies held by processing providers, backup systems or recipients you authorized may follow separate deletion processes. A Cutcrush media deletion is not a promise of immediate erasure from every such system. We retain data only for the applicable purpose or legal need; you can ask us to explain a continuing retention or challenge it.
07Your export and deletion controls
Settings lets you export account records and request account deletion. Download clips separately if you want media copies; the account export is a data export, not a backup of every video. Project deletion can be requested from the project’s controls. Cancel your subscription before the self-service account-deletion step, or contact us if you need help closing the account.
Account deletion disables access and revokes connected credentials while deletion is processed. Provider-side erasure may require reconciliation and remain pending. Relevant financial and audit records can be retained for the reasons above. These product controls do not limit your right to contact us with a broader GDPR request or require you to keep paying to exercise that right.
Revoke API keys and OAuth grants in Connect your AI. Revocation prevents future authorized requests; an assistant or other recipient may already hold copies. Ask that recipient about deleting its copies as well. Do not give an assistant permissions it does not need.
09Security and automated processing
Access controls separate customer accounts. Private media delivery requires authorization; connected tools have explicit permissions and credit limits. Secrets should not be shared in prompts, support messages or public links. No internet service can guarantee absolute security; report suspected unauthorized access promptly.
AI analyzes your media to select clips and generate transcripts, captions and related output. Those outputs may be inaccurate and need your review. Subscription status, credit balances and technical limits are checked automatically to allow or refuse a job. Cutcrush does not use clip scores to make legal or similarly significant decisions about people. Contact us for human review if you believe an account or billing restriction is wrong.
10Your privacy rights
Subject to applicable conditions, GDPR gives you rights of access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal. You may also ask about recipients, sources and international-transfer safeguards.
Send a request to iamstanlyx@gmail.com or the operator’s postal address. Explain the information or account involved. If you appear in someone else’s video, give enough context for us to locate it without sending unnecessary sensitive material. We may reasonably verify identity or authority before disclosing or changing data.
We respond without undue delay, normally within one month. A complex or numerous request may require up to two additional months; we will explain an extension within the first month. Requests are normally free. If a legal exception applies, we will explain the reason and available complaint rights rather than silently rejecting the request.
You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), through uodo.gov.pl, or to a competent authority where you live, work or where an alleged infringement occurred. You do not have to contact us first.
11Children and changes to this notice
Cutcrush is intended for people who can enter the agreement described in our Terms, and is not directed at children. Do not create an account without any legally required parent or guardian involvement. If you believe a child’s information has been submitted without appropriate authority, contact us so we can investigate and handle the data lawfully.
We update this notice when the service or its data practices change. The date above identifies the current version. Material changes will receive the notice required by law, and a new use requiring consent will need separate consent. Merely continuing to browse does not waive your privacy rights.