Privacy policy
This policy explains how we process personal data when operating AverCut — a presentation website and an online studio for creating vertical videos with AI — under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. We have tried to keep it plain; if anything is unclear, please contact us.
1. Data controller
The controller is AdvisorOS s.r.o., company ID (IČO) 295 03 311, registered office Kotojedy 56, 767 01 Kroměříž, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, section C, insert 151654 ("we", "us").
For privacy matters contact us at support@avercut.com or by post at the registered office. We have not appointed a data protection officer; the scope and nature of the processing do not require one.
2. What data we process
- Account data: e-mail, name or nickname, language, account settings, sign-in method (e-mail and password, Google account or Apple ID — you can connect more than one to a single account) and two-factor authentication details if you enable it. If you sign in with Apple and choose to hide your e-mail, we only receive a relay address from Apple that forwards our e-mails to you. We do not know your password — the sign-in service stores it only in hashed form.
- Videos, audio and transcripts: uploaded videos and audio capturing your face, voice and possibly other personal data (also of other people in the video), transcripts, captions, scripts, edit analyses, previews and finished videos.
- Brand assets and library: logo, colours, fonts, your website address and its screenshots for the brand kit, B-roll, music, sounds and images, reference videos for style analysis, links to public videos (know-how) and the rules your AI agent learned from your corrections.
- Usage and billing data: number of processed videos, limit usage, internal processing costs and your plan; once paid plans launch also billing details and payment history (your card number is processed by Stripe, we never see it).
- Technical records: IP address (for rate limiting we store only a keyed fingerprint of it; the full IP address may appear in the cloud provider's operational logs), browser type, sign-in times, processing job records, error and security logs.
- Waitlist: e-mail, language, where you signed up (e.g. "landing"), status (awaiting confirmation, confirmed, invited) and the times of sign-up and confirmation.
- Communication: the content of messages you send us.
We process your face and voice in a video only as part of the content we edit for you (cuts, cropping, captions, colour). We do not use them to biometrically identify people and we do not create biometric templates from them.
3. Why we process data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Registration, sign-in and account management | account data | performance of a contract (Art. 6(1)(b) GDPR) |
| Creating videos in the studio: upload, transcription, AI editing, captions, graphics, rendering, editor, library, AI agent | videos, audio, transcripts, brand assets, library | performance of a contract (Art. 6(1)(b) GDPR) |
| Waitlist and beta invitations | e-mail, language, waitlist status | consent (Art. 6(1)(a) GDPR) — you can withdraw it at any time |
| Service e-mails (e-mail verification, password reset, invitations, important notices about your account and the service) | e-mail, language | performance of a contract; for notices legitimate interest (Art. 6(1)(f) GDPR) |
| Security and protection against abuse and excessive costs (rate limits, bot protection, logs) | technical records, IP fingerprint, usage data | legitimate interest in operating the service securely (Art. 6(1)(f) GDPR) |
| Plan limits, billing and accounting | usage data; once paid plans launch, billing details | performance of a contract; for accounting documents a legal obligation (Art. 6(1)(c) GDPR) |
| Improving the service based on aggregate statistics (without video content) | usage data | legitimate interest (Art. 6(1)(f) GDPR) |
| Website traffic measurement (analytics cookies) — only if we enable it | pseudonymous visit data | consent (Art. 6(1)(a) GDPR) given in the cookie bar |
| Answering enquiries and support | content of communication, e-mail | performance of a contract, or legitimate interest |
| Establishing and defending legal claims | data needed for the dispute | legitimate interest (Art. 6(1)(f) GDPR) |
We do not send marketing messages yet. If we start, it will be only with your consent or within the limits of the law, always with an easy way to unsubscribe.
4. AI processing of videos
Edit proposals, captions and graphics are generated automatically by artificial intelligence. For this we pass the speech transcript, selected frames from the video and the necessary metadata (e.g. clip lengths and style settings) to AI providers; a full preview of the video only to Google models (Gemini) where the feature requires it (video understanding, cut review, B-roll Fit, library item descriptions). The Claude model (Anthropic) never receives video or audio — only transcripts, edit plans, texts and selected frames.
- This is not automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR — the result is a proposal you can change or discard.
- We do not use your videos to train general AI models and we do not show them to other users.
- Your AI agent learns from your corrections only for your workspace. You can view the learned rules and reset them at any time.
- The AI providers we use have contractually committed not to use data sent through their APIs to train their models.
5. Who we share data with
Data is processed by our processors — only on our instructions and under a data processing agreement:
| Processor | What it does for us | Where | Safeguards |
|---|---|---|---|
| Google Cloud EMEA Limited (Google Cloud, Firebase) | hosting of the website and the studio, database, file storage, sign-in (Firebase Authentication / Identity Platform), computing and video rendering, bot protection (reCAPTCHA Enterprise), Vertex AI services (Gemini — video understanding, reviews, B-roll Fit, descriptions; Veo and Lyria — generating footage and music from text prompts) | EU: Frankfurt (europe-west3), rendering in Belgium (europe-west1); the sign-in service and the Gemini models run on Google's global infrastructure, so processing may also take place outside the EU | Cloud Data Processing Addendum, standard contractual clauses, EU-US Data Privacy Framework |
| Anthropic, PBC | AI processing of speech transcripts and selected video frames (Claude model): edit, caption and graphics proposals, the AI assistant in the editor, scripts | USA | data processing agreement (DPA), standard contractual clauses |
| Resend, Inc. | sending e-mails from the domain noreply.avercut.com (waitlist confirmation, invitations, e-mail verification, password reset, account notices) | USA | data processing agreement (DPA), standard contractual clauses |
| Stripe Payments Europe, Limited — once paid plans launch | payment and subscription processing, customer portal | EU (Ireland), USA | data processing agreement, standard contractual clauses |
| The operator's accountants and tax advisers — once paid plans launch | bookkeeping (tax documents) | Czech Republic | data processing agreement, duty of confidentiality |
If you enter your website address (brand kit) or a link to a public video (know-how), we fetch only publicly available content from them; none of your data is sent to their operators. We may also disclose data to public authorities where the law requires it. We do not sell personal data.
6. Transfers outside the EU
Some processors (Anthropic, Resend, partly Google and Stripe) may process data in the United States. Transfers are safeguarded by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914) and, where the provider is certified, by the adequacy decision for the EU-US Data Privacy Framework. We will provide a copy of the relevant safeguards on request.
7. How long we keep data
| Data | Retention |
|---|---|
| Processing work files (temporary cuts, audio, frames) | 30 days from creation, then deleted automatically |
| Preview renders | 14 days |
| Export of your data (downloadable copy) | 7 days |
| Source videos, library, finished videos, brand kit, AI agent data | until you delete them, at the latest until the account is deleted |
| Account and workspace data | until the account is deleted; then erased immediately, from backups within 8 weeks at the latest |
| Waitlist | until registration or withdrawal of consent, at most 24 months; unconfirmed sign-ups 30 days |
| Beta invitations | until used or expired (at most 90 days) |
| Technical and security records (operational logs) | 30 days |
| Rate-limit records (IP fingerprint) | at most 2 days, deleted automatically |
| Records of administrative actions (account IDs and reason only, no content) | 24 months |
| Payment records (once paid plans launch) | for the duration of the contract and 5 years after (limitation of claims); accounting and tax documents 10 years as required by law |
8. Your rights
- Access (Art. 15 GDPR) — you can find out what data we process about you and get a copy (in the studio, account settings, data export).
- Rectification (Art. 16) of inaccurate or incomplete data.
- Erasure (Art. 17) — you can delete your account yourself in the studio settings; we also delete all videos and data of your workspace.
- Restriction of processing (Art. 18) and data portability (Art. 20) in a machine-readable format.
- Objection (Art. 21) to processing based on legitimate interest.
- Withdrawal of consent (waitlist, cookies) — withdrawal does not affect the lawfulness of processing before it.
- Complaint to the supervisory authority — Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.
Send requests to support@avercut.com. We handle them free of charge, without undue delay and within one month at the latest; for complex requests we may extend the deadline by two further months, in which case we will inform you. To verify that the request really comes from you, we may ask you to reply from your account e-mail or to sign in to the studio.
9. Security
- Encrypted transfer (HTTPS) and encryption of stored data.
- Data of individual accounts and workspaces is separated at the database and file storage level.
- Files are private; access is only possible through short-lived signed links.
- You can enable two-factor authentication (TOTP) for your account.
- Rate limits and abuse protection; operational logs contain no video content, passwords or tokens.
- Our team does not routinely look into the content of your projects; platform administration works with aggregate data (usage, account status) and every administrative action is recorded.
- Regular database backups (daily and weekly) and point-in-time recovery for the last 7 days.
10. People in videos and third-party content
If you upload videos or audio featuring other people, you are responsible for having a legal basis for it (typically their consent). If you use the service for your business or clients, you are the controller towards those people and we are your processor; we process their data only on your instructions, which you give by using the studio. A data processing agreement under Art. 28 GDPR is available on request at support@avercut.com.
11. Children
The service is not intended for persons under 18. If we learn that a child has provided us with personal data, we delete it.
12. Cookies and local storage
The website and the studio store only technical items needed for operation and your preferences (language, theme, sign-in). Analytics or marketing tools are used only with your consent given in the cookie bar; you can change it at any time via Cookie settings in the website footer. Details are on the Cookies page.
13. Changes to this policy
We may update this policy, for example when adding a new feature or processor. We inform you about material changes by e-mail or in the studio at least 14 days before they take effect. The current version is always available on this page.