Privacy Policy

1. Who we are & how to contact us

Shortlist is a software service that helps users create ranking-style short-form videos (the “Service”).

If you have questions about this Privacy Policy or how we handle personal data, you can contact us at mojeltd14@gmail.com.

2. Information we collect

The information we collect depends on how you use the Service. It generally falls into the following categories:

• Account information. When you create an account, we receive information from our authentication provider (currently Clerk), such as your name, email address, and basic profile details. In our own systems, we store your email address, name, plan status (for example, free or paid), and internal identifiers needed to associate your account with your projects and billing.
• Project & content information. When you create projects or upload or link content, we process and store the information you provide, such as videos, audio files, text (including scripts, captions, prompts), and related metadata. This information is used to generate, process, and render your videos. Media files are stored in cloud storage (currently Cloudflare R2) under identifiers associated with your projects.
• Usage & export information. We collect information about how you use the Service, such as the number of exports you create, their status (for example, pending, processing, completed, or failed), timestamps, and basic project metadata. This information is used to operate the Service, enforce plan limits, and diagnose issues.
• Billing & subscription information. If you subscribe to a paid plan, payments are processed by our payment provider (currently Stripe). We store Stripe-related identifiers (such as customer and subscription IDs) associated with your account. We do not store full payment card details on our servers.
• Technical information. Like most online services, we may collect technical information such as IP address, browser type, device characteristics, request and response metadata, error logs, and basic timing information. This information is used to operate, secure, and debug the Service.
• Local storage. The Service may store limited data locally in your browser (for example, UI preferences or cached recommendations) to improve performance and user experience.

We do not intentionally collect personal data from children under the age of 13 (or the minimum age of digital consent in your country, if higher). If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

3. How we use your information

We use the information we collect to:

• provide, operate, and maintain the Service;
• create, process, and host your projects, scripts, clips, voiceovers, and exports;
• manage user accounts, authentication, and subscriptions;
• enforce plan limits and usage restrictions;
• process payments and provide access to billing features;
• monitor, secure, and improve the performance and reliability of the Service;
• respond to user inquiries and provide support;
• develop new features and understand general usage patterns; and
• comply with legal obligations and enforce our terms.

Legal bases (EEA / UK users). Where required by applicable law (including GDPR and UK GDPR), our legal bases for processing personal data include performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service), compliance with legal obligations, and consent where applicable.

4. AI and automated processing

We use third-party AI and media processing services to generate outputs you request, such as voiceovers, captions, or transcriptions.

We do not use your content to train our own machine-learning models. Where supported by our providers, we configure AI service providers not to use your content for training their models. Your content is processed solely to provide the requested functionality.

5. How we share information

We do not sell your personal information.

We may share information in the following situations:

• Service providers. We use third-party service providers to operate parts of the Service, including authentication (for example, Clerk), payment processing (for example, Stripe), infrastructure and databases, cloud storage (for example, Cloudflare R2), and AI or media processing services. These providers process data on our behalf and are required to protect it under contractual obligations.
• Legal and safety reasons. We may disclose information if we reasonably believe it is necessary to comply with applicable law or legal process, to protect the rights, safety, or property of us, our users, or others, or to detect and prevent fraud or security issues.
• Business transfers. If we are involved in a merger, acquisition, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

6. Cookies and analytics

The Service uses essential cookies and similar technologies required for authentication and core functionality. We may also use privacy-focused analytics to understand general usage patterns and improve the Service. We do not use advertising cookies or cross-site behavioral tracking technologies.

7. International data transfers

Our infrastructure and service providers may be located in different countries. As a result, your information may be processed outside your country of residence. Where required by law, we rely on appropriate safeguards, such as standard contractual clauses approved by relevant authorities, to protect transferred data.

8. Data retention

We retain personal data for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

In general:

• account data and project content are retained while your account is active; and
• when you delete your account, we delete associated user records, projects, and media assets from our primary systems where technically feasible.

Certain information (such as logs, backups, or billing records) may be retained for longer periods where required by law or for legitimate business purposes, such as security, fraud prevention, and accounting.

9. Your rights

Depending on your location, you may have rights regarding your personal data, including the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• object to or restrict certain processing;
• request a copy of your data in a portable format; and
• withdraw consent where processing is based on consent.

You can exercise many of these rights directly through the Service or by contacting us at mojeltd14@gmail.com. We may need to verify your identity before responding. Legal limitations or exceptions may apply.

If you are located in the EEA or the UK, you also have the right to lodge a complaint with your local data protection authority.

10. Security

We use reasonable technical and organizational measures to protect personal data, including reputable hosting, storage, and identity providers. However, no system is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your login credentials and for notifying us of any suspected unauthorized access.

11. Third-party links and platforms

The Service may contain links to third-party websites or platforms. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review their policies before sharing information with them.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above and, where appropriate, provide additional notice. Continued use of the Service after an update means you accept the revised Policy.

If you do not agree to an updated Policy, you should stop using the Service and request deletion of your account.