Privacy policy
Last updated 7 November 2026
This policy explains what personal data ShotCut collects, why, who we share it with and your rights. ShotCut is provided by Shot Social L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("we"), the controller of your personal data. Questions or requests: contact@shotsocialagency.com.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your name, email address and password (stored only as a secure hash), workspace name, role and sign-in history | To create your account, sign you in and run workspaces and invites | Contract |
| Content you upload, link to or type in (episodes, videos, reels, articles, documents, photos, brand guides and ideas), transcripts, and the carousels, covers and captions we make | To provide ShotCut | Contract |
| Billing details: plan, invoices, card brand and last 4 digits, and a card fingerprint from Stripe (full card details are held by Stripe, never by us) | To take payment, keep accounting records and allow one free trial per card | Contract; legal obligation; legitimate interests (preventing trial abuse) |
| Usage: what you create, edit and export, job timings and errors | To keep ShotCut working, fix problems and improve it | Legitimate interests |
| Feedback you send us | To improve ShotCut | Legitimate interests |
| Visit counts on our website (the page and the referring site, with no cookies and no personal profile) | To see whether our marketing works | Legitimate interests |
Your content may include personal data about other people, such as the voices, faces and words of podcast guests. You're responsible for having the right to use it (see our terms); we process that data on your behalf, only to provide ShotCut to you.
Cookies
We use only essential cookies: to keep you signed in and remember which workspace you're in. We don't use advertising or tracking cookies, so we don't ask for cookie consent. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.
Who we share data with
We use these service providers to run ShotCut. They process data on our instructions and only to provide their service:
| Provider | What for | Where |
|---|---|---|
| Hetzner | Our servers and storage (your content and outputs) | Germany |
| Supabase | Accounts, sign-in and workspaces | Ireland (EU) |
| Anthropic (Claude) | AI that picks moments, writes slides and captions, and matches screenshots | United States |
| AssemblyAI | Transcribing audio | United States |
| Stripe | Payments, subscriptions and invoices | Ireland (EU) / United States |
| Resend | Sending emails (sign-in links, notifications) | United States |
| Apify | Fetching public Instagram posts when you paste a link | Czech Republic (EU) |
| Webshare | Network proxies used to download videos from links you give us | United States |
| Kit | Our early access email list, for people who joined it | United States |
Our AI providers process your content to return results to us and, under their terms for business customers, don't use it to train their models. We don't sell your data or share it for advertising. We may disclose data if the law requires it, or to a buyer if ShotCut is sold (in which case this policy continues to apply).
International transfers
Some providers are outside the UK and EU. Where they are, we rely on safeguards recognised under UK and EU data protection law: adequacy decisions (including the EU-US Data Privacy Framework and the UK-US data bridge where the provider is certified), or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
How long we keep it
- Your account and workspace data: while your account is open.
- Uploaded episodes and files: kept so you can make more carousels from them, until you delete the project or close your account. Copies of YouTube videos fetched from links are deleted automatically after 30 days.
- Outputs and transcripts: in your projects until you delete them.
- When you close your account, we delete your content within 30 days, except records we must keep by law (such as invoices, for 6 years).
- Copies in backups are overwritten on a rolling basis within 30 days.
Security
Your data is stored on servers in the EU and sent over encrypted connections. Passwords are stored only as secure hashes. Your content is accessible only to the people in your workspace and to the small team that runs ShotCut, when needed to support you or fix a problem.
Your rights
Under UK and EU data protection law you can ask to see, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Email contact@shotsocialagency.com and we'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Children
ShotCut is for adults and businesses. We don't knowingly collect data from children under 18.
Changes
We'll update this policy when our practices change, and email you about important changes.