Privacy Policy
Last updated: October 19, 2026
This Privacy Policy explains what personal data ViCut (“we”, “us”, “our”) collects when you use ViCut (the “Service”), why we use it, who we share it with and what rights you have. We are the controller of this data. If you have any questions, email us at [email protected].
1. Data we collect
Account data. Your email address, the name you choose to add, your settings (such as theme, date and time format) and the date you joined.
Sign-in and security data. We sign you in with a one-time link sent to your email. When you request a link, we store the request together with your IP address to prevent abuse. When you sign in, we create a session and store your browser’s user agent and when the session was last used, so you can see your active sessions and sign out other devices.
Content you provide. Voiceover recordings, scripts, video ideas and briefs, YouTube channel links or handles, images and video clips you upload, custom styles, and choices you make in the storyboard.
Content we create for you. Transcripts, storyboards, rendered videos, subtitles, thumbnails, scripts, and suggested YouTube titles, descriptions and tags.
Public channel information. When you add a YouTube channel, we fetch its public details (such as name, handle and avatar) through the YouTube Data API.
Billing data. Your plan, credit balance and a history of credit use. Payments are handled by our payment provider, which acts as the merchant of record. It collects your payment details directly; we never see or store your full card number. We receive limited information from it, such as your subscription status and the country used for tax.
Technical data. Our servers keep basic logs (such as IP address, time, and the request made) to run and protect the Service, and we record how jobs ran (such as processing time and errors) to fix problems and manage costs.
Usage analytics. We use Google Analytics to count visits and see which pages and features people use: pages viewed, how you arrived (for example, from a search engine), approximate location from your IP address, device and browser type. Google Analytics does not receive your email or your content. In the EU, EEA, UK and Switzerland it sets cookies only if you allow them; see section 7.
We do not ask for sensitive data such as health information, and we ask you not to include it in your content unless it is needed for your video.
2. How we use it and our legal bases
- To provide the Service: sign you in, process your content, build storyboards, render videos and send you files. Legal basis: performance of our contract with you.
- To send service emails: sign-in links, email change confirmations, notices before videos are deleted, and important updates about the Service, these Terms or this Policy. Legal basis: contract, and our legitimate interest in keeping you informed.
- To manage billing and credits. Legal basis: contract, and legal obligations such as tax and accounting.
- To keep the Service secure: rate limits, abuse prevention and fraud checks. Legal basis: legitimate interests.
- To support and improve the Service: answering your questions, fixing errors and understanding costs and performance. Legal basis: legitimate interests.
- To improve how the Service picks footage: we analyse the frames you replace on your storyboards (the line, the frame shown and the frame you chose) across all users. Legal basis: legitimate interests. You can object at [email protected].
- To understand how the Service is used: counting visits and page views with Google Analytics. Legal basis: consent in the EU, EEA, UK and Switzerland; legitimate interests elsewhere.
- To comply with the law and respond to lawful requests. Legal basis: legal obligation.
Where we rely on consent, you can withdraw it at any time. We do not sell your personal data, we do not use it for advertising, and we do not use your content to train our own AI models.
3. AI processing
The Service uses third-party AI models to do its work. Anthropic’s Claude models write scripts (in Idea mode, with web search), correct place names, plan scenes, and choose and check footage; they receive your script or transcript text and small preview images of candidate frames. Google’s Gemini image model creates AI thumbnails when you choose them; it receives the thumbnail prompt, headline and frames from your video. These providers process the data under their API terms to return results to us. Speech recognition (Whisper) and the built-in narrator voices (Kokoro and Kyutai Pocket TTS) run on our own servers, so your voiceover audio is not sent to an AI provider. Pocket TTS and the voices of the VCTK corpus (University of Edinburgh) are used under the CC BY 4.0 license.
4. Who we share data with
We share personal data only with service providers that help us run the Service, under contracts that limit how they may use it:
- Hetzner — servers and file storage in Germany and Finland (EU).
- Neon — our database, hosted on AWS in Frankfurt, Germany (EU).
- Cloudflare — DNS, content delivery and the secure network connection to our servers.
- Resend — sending emails.
- Anthropic — AI models, as described above.
- Google — AI thumbnails, the YouTube Data API for channel lookups, and Google Analytics for visit statistics.
- Our payment provider — processing payments and subscriptions as merchant of record.
To find footage and maps, the Service sends search queries (for example, place names from your script) to Pexels, Pixabay, Wikimedia Commons, Openverse, the U.S. Geological Survey and OpenStreetMap-based services. These queries do not include your email or other account details.
We may also disclose data if required by law, to protect our rights or the safety of others, or to a successor if the Service is reorganised or sold, including to a company we set up to operate it. We will tell you before your data becomes subject to a different privacy policy.
5. International transfers
Our servers, files and database are in the European Union. Some providers, including Anthropic, Google, Cloudflare and Resend, are based in the United States or may process data there. Where data is transferred outside the EU, UK or European Economic Area, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, such as the EU–US Data Privacy Framework where the provider is certified.
6. How long we keep data
- Finished videos are deleted 30 days after they are rendered. We email you 7 days before.
- Storyboards, scripts, voiceovers and drafts are kept while your account is active, so you can render again. You can delete a video or project at any time.
- Sessions expire after 30 days. Sign-in links work for 15 minutes and only once.
- When you delete your account, we delete your account, projects, videos, files, styles, channels and sessions. Copies may remain in backups for a short time until they are overwritten, and we keep records we must keep by law, such as billing records, for the period the law requires.
7. Cookies and local storage
We use one essential cookie, xp_session, to keep you signed in for up to 30 days. We also save a few interface preferences, such as your light or dark theme and your cookie choice, in your browser’s local storage. If you come to ViCut through a partner’s link, we also keep that link’s referral token (creem_ref) in local storage, so that our payment provider can credit the partner if you subscribe. The token expires after 180 days.
We use Google Analytics cookies (_ga and _ga_*, kept up to 14 months) to count visits. In the EU, EEA, UK and Switzerland they are off until you press Accept; until then Google Analytics receives only cookieless, anonymous signals. You can change your choice by clearing this site’s data in your browser. We do not use advertising cookies. Our payment provider may set its own cookies on its checkout pages.
8. Security
We use encrypted connections (HTTPS), store only hashed versions of sign-in links and session tokens, keep our servers closed to the public internet except through a secure tunnel, and limit who can access production systems. No system is perfectly secure, so please keep your email account safe and tell us at [email protected] if you notice anything suspicious.
9. Your rights
Depending on where you live, including in the EU and UK, you have the right to:
- access your personal data and get a copy of it;
- correct data that is inaccurate;
- delete your data;
- export your data in a portable format;
- object to or restrict processing based on our legitimate interests;
- withdraw consent where we rely on it;
- complain to your local data protection authority.
You can do much of this yourself: edit your name in Settings → Profile, download an export of your projects, scripts, storyboards, sources and credit history in Settings → Privacy, sign out other devices in Settings → Security, and delete your account in Settings → Privacy. For anything else, email [email protected]. We will reply within one month, and may need to confirm your identity first.
10. Children
The Service is for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this Policy
We may update this Policy as the Service changes. If a change is material, we will tell you by email or in the app before it takes effect. The date at the top shows when it was last updated. Please also read our Terms of Service.
12. Contact
For privacy questions or requests, email [email protected].