Privacy policy

Operator

Tom LAU, individual entrepreneur, 25 Le Bois Dormant, 77123 Noisy-sur-École, France, controls intoshort's account, billing and service data. Contact: tom.lau.974@gmail.com.

Business customers may control submitted content, with intoshort acting on their instructions. Our DPA is unfinished: contact us before submitting data requiring one. You must inform people concerned and have a legal basis for their data, including public videos.

Data and purposes

We collect account and sign-in details, IP/browser information, submitted media and instructions, source metadata, generated clips and transcripts, usage, billing and feedback. Sources include you, linked videos, Google, Stripe and service logs.

When you connect YouTube, Google provides OAuth tokens and the authorized scopes. For a publication, we process the selected render, publication metadata, the YouTube video ID and the upload status. We exchange these data with Google and YouTube only to link your account and carry out the publication you request.

Our legal bases are contract performance for accounts, video processing, subscriptions and support; legitimate interests for security and troubleshooting; and legal obligations for accounting. Generate requests processing, not separate consent for other uses.

Providers and AI

Railway hosts data in Amsterdam; OpenAI processes audio, transcripts, instructions and optional frames; Google handles optional sign-in and YouTube account linking and publication; Stripe handles payments; Resend delivers emails. Imports may contact YouTube, Twitch or image hosts. Other providers may process data elsewhere. See the Google Privacy Policy. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

We do not train models on your content. OpenAI model-improvement sharing is disabled, but standard retention applies. Local face/speaker analysis supports framing, not identification. Review AI output; cancellation cannot undo completed processing.

Retention and deletion

Account data remains while your account is open; videos remain until deletion is requested. Delete videos in your library; request account deletion by email. Active jobs may need cancellation, and cleanup can be delayed. Video deletion leaves account, billing and usage records, external originals and downloaded copies untouched. Usage records enforce plan limits; mandatory records follow legal retention requirements.

YouTube OAuth tokens are encrypted at rest and kept until you disconnect YouTube, revoke access, the connection expires without renewal, or delete your account. Disconnecting YouTube or deleting intoshort data does not delete a video already sent to YouTube. Delete that video through YouTube.

Log history lasts seven days. Media is private, with account checks and temporary links. Database backups are disabled; temporary processing files are cleaned up after processing.

Cookies and controls

We use session cookies, lasting seven days and renewed during use, with no advertising or website analytics cookies. Blocking them may prevent sign-in. Google and Stripe have their own notices.

Manage notifications in Account settings. Marketing is inactive; default preferences are not consent. Promotions require opt-in and an unsubscribe link.

Revoke Google access separately. This neither deletes intoshort data nor ends sessions; contact us before removing your only sign-in method.

Rights and changes

Subject to applicable law, you may access, correct, erase, restrict or port your data, object to processing, and withdraw consent without affecting earlier lawful processing. Email us above; identity checks may apply. GDPR responses normally take one month, with permitted extensions. You may complain to the CNIL or another competent authority.

We email material policy changes and update the date above. Changes do not replace required consent.