AutoEditPrivacy Policy
Version 1.0 · In force since [MISSING: date of entry into force]
The essentials
- We keep only what is needed for your account, your computers, your minutes and your payments.
- Your videos never reach our server. To calculate the cut, the app sends the transcript and the audio volume curve: we use them only for that and we do not store them. What Claude looks at from your video (frames and contact sheets) goes to Anthropic through your Claude account, without going through us (section 7).
- When you use the app from the website, our server passes between your browser and your computer what you do and what the app shows you, including what you write to Claude and what the app shows you of its work. It travels encrypted to and from our server, and it is not stored. Videos go straight from your computer to your browser.
- Payments are handled by Stripe: we never see your card.
- Our server is in Canada (OVHcloud), a country with an EU adequacy decision.
- We do not sell your data or use it for advertising. Your Claude login details and what your Claude Code says to Anthropic never go through us.
1. Who processes your data
The controller is MONETIZANDO TU PASION LTD, a company registered in Cyprus under number [MISSING: registration number], with its registered office at Efesou 9, 5280 Paralimni, Cyprus. For any privacy matter, write to hola@autoedit.pro.
We are established in the European Union: we process your data under the General Data Protection Regulation (GDPR).
2. What data we process, why and for how long
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account: email, name (if you give it), language, time zone (your computer's, to tell you dates in your time), sign-up and last access dates, and account status | Identify you, provide the service and send you service notices | Contract (art. 6(1)(b) GDPR) | While the account exists; if you ask us to delete it, we delete it within one month at the latest, except what must be kept by law |
| Sign-in codes: email, an encrypted fingerprint of the code (never the code), expiry, attempts and the IP that requested it | Make sure only you get in and stop abuse | Contract and legitimate interest in security (art. 6(1)(f)) | 2 days; successful sign-ins (email and IP), 31 days, to recognise where you usually sign in from |
| Links to sign in without a code (those in some emails and those the app asks for): a fingerprint of the link, where it leads and its expiry | Let you sign in once without asking for a code | Contract | Up to 1 day after expiry |
| Computers: computer name, system, fingerprint of the machine identifier (never the identifier), fingerprint of its credential, app version, dates of registration, last use and removal, and whether it is connected | Apply the computer limit, connect it with the website, security and support | Contract and legitimate interest | While it is in your account; removed ones, 12 more months |
| Connecting a computer with a code: fingerprints of the codes, the computer's name, system and version, language and the IP it was requested from | Connect your computer to your account securely, and warn you if it was requested from another connection | Contract and legitimate interest | 1 day |
| Web sessions: fingerprint of the credential, how you signed in (with a code or a link), IP and browser at sign-in, and dates | Keep you signed in and security | Contract and legitimate interest | Up to 30 days after expiry or sign-out |
| Server-side cut: transcript with timings, audio volume curve and cut settings | Calculate the cut proposal | Contract | Not stored: processed in memory and discarded when responding; only their fingerprint remains (see “Charged videos”) |
| Using the app from the website: what you do on the app's screens and what they show you, which passes between your browser and your computer. It includes what you write to Claude (your comments and messages, with the images you attach) and what the app shows you of its work (its questions, the storyboard, the titles and the reports), as well as thumbnails | Let you use the app on your computer from the website | Contract | Not stored: it travels encrypted to and from our server, the server handles it in memory and it is discarded; we only record who opened which computer and when (see “Activity log”) |
| Charged videos: project id and fingerprint of the recordings (set by the app), fingerprint of the transcript and of the volume curve (they cannot be used to rebuild them), seconds charged, re-cuts, date and computer | Charge each video only once and explain your usage | Contract | Same as payments |
| Use of the service: each cut the server makes (when, from which computer, how long the final video lasts and how much it adds to your use; nothing from the video) | Measure each account's use, to spot unusual use or a shared account | Contract and legitimate interest (that the service is not used abusively) | Same as payments |
| Minutes: what you receive, use, lose to expiry, get refunded or are given, with its note | Keep track of your minutes | Contract and legal obligation (art. 6(1)(c)) | Same as payments |
| Payments: Stripe customer and subscription ids, plan and its price, status, period dates, code used, charges, refunds and disputes; the Stripe customer of each purchase (an account can have more than one if you buy without signing in) | Charge, invoice and handle cancellations, failed payments, refunds and disputes | Contract and legal obligation | 6 years from payment (the period the law sets for invoices) |
| Acceptances: version of the terms accepted, at sign-in and at payment; the request to start the service straight away, with its text, date, time, IP, browser and checkout session; withdrawals | Prove what you accepted and comply with consumer law | Legal obligation and legitimate interest | As long as the contract lasts plus the period to bring claims |
| Activity log: sign-ups, sign-ins and computers (with the IP), who opened which computer from the website and when (never what they did), plan changes, payments, gifts and actions in our admin panel | Security, fraud prevention and resolving incidents and complaints | Legitimate interest | The IP, 12 months; the rest, same as payments |
| Web server logs: IP, date, address requested, response and browser | Security and operation | Legitimate interest | 14 days |
| Website measurement (the sales page, the payment page and the welcome page): a random number for each visit, your truncated IP (without its last number; for IPv6, only its first 48 bits), your approximate location (country, region and city, worked out from your IP at that moment, without storing the full IP), your browser, your system and your device (with its brand and model if it says them), the size of your screen and window, your languages, your time zone, whether the screen is a touch screen, the connection type, where you came from and what you do on those pages (section 8) | Know how people reach the sales page and what they do on it and in the payment, to improve them | Legitimate interest (art. 6(1)(f)) | 90 days |
| Emails sent: recipient, subject, date and delivery result; during the beta, while we do not have our own email, also their text (to hand you your sign-in code manually) | Make sure they reach you and fix delivery problems | Contract | As long as our mail server's log keeps them, which renews itself as it fills up; the beta text, 7 days |
| Support: what you write to us | Help you | Contract and legitimate interest | 2 years from the last reply |
| News (only if you ask for it): email | Send you news and offers | Consent (art. 6(1)(a)) | Until you withdraw it |
Other people's data in your videos. The transcript may contain other people's names or data, or anything you say in the video. We use it only to calculate the cut and do not store it. If you edit clients' videos as a business, tell us if you need a data processing agreement.
3. What we do not collect
- Your videos, your audio, your images or your projects: what goes through our server when you use the app from the website is not stored.
- Transcripts and volume curves, beyond calculating the cut.
- Your card: Stripe has it.
- Your Claude login details or what your Claude Code says to Anthropic. What you write to Claude from the website and what the app shows you of its work do go through our server, but they are not stored (section 2).
- No third-party analytics tools or advertising, in the app or on the website: what we measure on the website we measure ourselves, without cookies and without storing your full IP (section 8). We do not build profiles or sell data.
4. Where your data comes from
From you (your email and what you write to us), from the app (your computers, their version, their time zone and what it sends for the cut), from your browser when you visit the sales page and the payment page (what it says about itself and the approximate location we work out from your IP: section 8) and from Stripe (the status of your payments, refunds and disputes, and your card's fingerprint).
5. Who we share it with
| Who | What for | Where | Role |
|---|---|---|---|
| OVHcloud | Hosts the server, the database, the daily backups and the email we send you | Canada (Beauharnois, Quebec) | Processor |
| Stripe (in the EU, Stripe Payments Europe, Limited, Ireland) | Payments, invoices, customer portal and fraud prevention | EU and USA | Processor for payments; separate controller for fraud and its legal obligations |
| Accountants and tax advisers | Invoices and tax obligations | Cyprus | Processor |
| Authorities and courts | When the law requires it | — | — |
No one else. We never sell or hand over your data for advertising.
6. International transfers
- Canada: our server is in an OVHcloud data centre in Beauharnois (Quebec). Canada has an adequacy decision from the European Commission (Decision 2002/2/EC, for organisations subject to the federal PIPEDA law), which the Commission confirmed in its review of 15 January 2024.
- United States (Stripe): under the EU-US Data Privacy Framework or standard contractual clauses.
- Any other provider that processed your data outside the European Economic Area would do so only with the safeguards of the GDPR (an adequacy decision of the European Commission or its standard contractual clauses), and we would say so here.
7. What does not go through us
AutoEdit works with programs and services that talk directly from your computer, without going through our server:
- Claude Code (Anthropic): what Claude reads and writes (transcripts, frames of your video, animations) reaches Anthropic through your Claude account and is handled according to your terms and privacy settings with Anthropic. What you write to it from the website, and what the website shows you of its work, also go through our server on the way between your browser and your computer, without being stored (section 2).
- Your videos: when you watch them on the website, your browser loads them straight from your computer, with signed links that expire after 5 minutes.
- ElevenLabs (Scribe): only if you turn it on yourself with your own key.
- Downloads of models and programs (Hugging Face, PyPI, npm and Google), when installing and updating.
They are responsible for that data. The app's guide (“Privacy: what leaves your computer”) explains it in detail.
8. Cookies and data on your device
- Website: we use the
__Host-sesionsession cookie, which is technical and needed to keep you signed in (30 days; 1 day for admin accounts). The app on your computer, when you open it from the website, cannot use that cookie: the editor has its own session cookie,__Host-editor, which lasts as long as your website session and stops working with it, and__Host-editor-estado(10 minutes) to enter it safely. When you subscribe from the sales page, the__Host-compracookie (2 hours) links your browser to your payment so that, when you come back from Stripe, you go into your new account. All of them are technical and necessary. We do not use analytics or advertising cookies, so we do not ask for cookie consent. - Affiliate links: if you arrive through the link of someone who recommends us (an affiliate), we store the
__Host-refcookie in your browser for 60 days: it only holds a signed reference to that click, so that we know who gets the commission if you subscribe. It is ours (no other website reads it), it is not used to follow you across other websites or for advertising, and we do not store your IP address for the click (only a code for that day which, from the next day, can no longer be linked to you). We consider it necessary for the affiliate programme requested by the person who recommended you, which is why we do not ask for your consent for it. Affiliates who sign in to their portal also use the__Host-afiliadosession cookie (30 days). - Payment page: the one for a plan is on our website, but the payment form is Stripe's: Stripe.js, loaded from js.stripe.com ONLY on that page (not on the rest of the website). To prevent fraud, Stripe sets its
__stripe_mid(1 year) and__stripe_sid(30 minutes) cookies there, and others on its own domains, and collects data about your device and browser, under its privacy policy; if you pay with Link, Link's too. The one for a pack is on Stripe's domain, with the same cookies. They are needed to pay safely, which is why we do not ask for your consent for them. - Visits to the sales page: we count them on our server without cookies or personal data: only how many visits there were each day on each page and language, and where they came from (the link's campaign or the site's name, without its page). In these counts we do not store your IP or anything that identifies you, and we use no third-party analytics tools.
- Website measurement: to know how people reach the sales page, which sections they see and at which payment step they stop, we measure visits to the sales page, the payment page and the welcome page with a system of our own: without cookies and without storing anything in your browser. Each visit carries a random number that is only valid for that visit: it does not follow you from one visit to another. We keep your truncated IP (without its last number; for IPv6, only its first 48 bits: the network you come from, not your connection); your approximate location (country, region and city), which we work out from your IP at that moment with a database that is on our own server (your IP does not leave it and the full IP is not stored); your browser, your system and your device, with its brand and model if it says them (to refine them, the page asks your browser for its “Client Hints”); the size of your screen and window, your languages, your time zone, whether the screen is a touch screen and the connection type (if your browser says it); where you came from (the link's campaign or code, or the site's name); and which sections you see and how far into the payment you get. We do not use fingerprinting (no hidden drawings, no reading your fonts) or anything that recognises you from one visit to another. We do it on the basis of our legitimate interest in knowing how the sales page works and improving it, and it is deleted after 90 days. The location comes from IP Geolocation by DB-IP (CC BY 4.0 licence). If you subscribe, your purchase also keeps the campaign of the link you arrived through.
- App: it stores your computer's credential in the system's secure store (Windows Credential Manager or the macOS keychain) so it does not ask you for a code every time.
9. Automated decisions
We do not make solely automated decisions that significantly affect you, with two exceptions that are part of the service: without enough minutes or with a failed payment, the server does not make the cut or open the app from the website; and if you open a dispute with your bank, your account is paused automatically while it is resolved and we stop charging you: your plan's cancellation is scheduled for the end of the period (or is immediate, if you had a pending payment) and, when that comes, your pack minutes are frozen. In both cases you can write to us and a person will review your case.
10. Security
Everything travels encrypted (HTTPS), including your computer's connection with our server, which only your account uses: to open your computers from the website you have to sign in with a code. Encryption protects the journey: what passes between your browser and your computer is handled by our server in memory, without being stored. Codes and credentials are only stored as encrypted fingerprints. The database is not open to the internet and only those who need it can access it. We make a daily copy of the database, which can only be read with administrator access. If there were a security breach affecting you, we would tell you as the law requires.
11. Your rights
You can ask to access your data, correct it, delete it, restrict its use, take it with you (portability) or object to its processing, and withdraw at any time any consent you have given us. Write to us at hola@autoedit.pro for any of them, including to download your data or delete your account, and we will do it for you. We reply within one month at the latest.
When you delete the account, we cancel your plan on the spot, remove your computers and delete your data, except what the law requires us to keep (invoices and payments), which we keep blocked until that period ends. What is left of the paid period and your remaining minutes, pack minutes included, are lost: before you confirm the deletion, we tell you how many there are.
If you think we have not handled your data properly, you can complain to the Office of the Commissioner for Personal Data Protection of Cyprus, the supervisory authority of Cyprus, or to the one of the EU country where you live or work (in Spain, the Agencia Española de Protección de Datos).
12. Minors
AutoEdit is only for people aged 18 or over. If we learn that an account belongs to a minor, we delete it.
13. Changes to this policy
If we change something important, we will email you before it applies. The current version is always on this page, with its date.