Privacy Policy

Last updated: October 13, 2026

1. Who We Are

AutoCut, developed by Gameplay do Boy, is the controller of the personal data processed on the website, in the desktop program, and in the apps. Contact for our data protection officer: contato@autocut.com.br.

This policy applies to customers in all countries and follows the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018) and, for those located in the European Union, the General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Registration

• Name, email, and password (stored only as a bcrypt hash, which cannot be reversed).
• Selected country and language.
• Brazil: CPF (Brazilian taxpayer ID) and address. Other countries: phone number with country code and billing address.
• A record of your acceptance of the Terms, of this Policy, and of the option to receive marketing emails, with date and IP address.

2.2 Payment

• Card details are entered directly into Stripe's form and are held by Stripe. The full card number and the security code never pass through our servers.
• We store only what is necessary for billing and customer support: card brand, last 4 digits, expiration date, the customer and card identifiers at Stripe, and the payment history (amount, currency, date, and status).
• Subscriptions purchased in the app for iPhone and iPad are paid to Apple. From Apple we receive only the purchase confirmation: transaction identifier, plan, and expiration date.

2.3 Use of the service

• IP address, browser and device, access dates, and program version.
• Number of videos edited per cycle, to enforce plan limits. We do not store your videos.

2.4 Cloud processing during editing

Editing is done on your device, and your video files are not sent to us. To deliver the result faster, some steps use the cloud:

• Transcription: the video's audio is sent to our servers to be converted into text (captions and cut markers). The audio file is deleted as soon as transcription is complete, and the transcribed text is deleted from the server within 15 minutes after being delivered to your device.
• Artificial intelligence: the transcribed text (to choose the best moments and cuts) and, during visual review, some images from the edit preview are sent to AI providers — DeepSeek and Google (Gemini) — which return the analysis. Your name, email, and registration data are not sent along with them.
• Media library: to suggest B-roll footage, keywords from the edit are used in searches on Pixabay.

2.5 App error reports and diagnostics

In the mobile apps, we use Google Firebase (Crashlytics and Analytics) to measure failures and performance: crash reports, device model, operating system and app version, processing times, and app usage events.

When an edit fails in the apps (Windows, Android, and iOS), we automatically send a report containing the error code and description, technical device data (model, processor/graphics card, operating system, and app version), and the log of that edit — the steps executed and where it stopped. This log does not include the content of your videos, audio, or images. The report carries the email address of the signed-in account for a single purpose: to notify you when the error has been fixed. This email address is not used for marketing or shared.

2.6 Mobile app permissions

• Photo library / storage: to open the videos you choose to edit and to save the finished video to your photo library.
• Notifications: to show the progress of the edit in the background, which prevents the system from interrupting the process.

3. How We Use Data and on What Legal Basis

• Providing the contracted service (account, editing, plan limits, support) — performance of a contract.
• Billing, renewal, and account notices (payments, due dates, billing failures) — performance of a contract.
• Keeping tax and payment records — compliance with a legal obligation.
• Security, fraud prevention, and bug fixing — legitimate interest.
• Marketing and news emails — only with your consent, which may be withdrawn at any time in the dashboard or via the link in each email.

4. Who We Share Data With

We do not sell your data. We share only what is necessary with these providers:

• Stripe — payment processing (name, email, country, billing address and phone number, and card details).
• Apple — payment for subscriptions purchased through the App Store.
• Google Firebase — crash reports and usage metrics for the mobile apps (Section 2.5).
• Hostinger — hosting of the website, the database, and the transcription servers.
• Brevo — sending account emails and, if you have consented, marketing emails.
• DeepSeek and Google (Gemini) — artificial intelligence analysis of the transcribed text and of preview images, without your registration data (Section 2.4).
• Pixabay — searching for B-roll footage by keyword (Section 2.4).
• Telegram — internal notifications to our support team (for example, a new account or a payment failure), with the customer's email and plan.
• Authorities — when required by law or by court order.

5. International Transfers

Some of these providers process data outside the country where you are located, for example in the United States, the European Union, and China (DeepSeek). These transfers take place in order to provide the service you contracted and follow the safeguards set forth in the LGPD (art. 33) and the GDPR, such as the data protection terms and standard contractual clauses adopted by these providers.

6. Your Rights

At any time, you may:

• Confirm whether we process your data and access it;
• Export your data (button in the account dashboard) or request data portability;
• Correct incomplete or inaccurate data;
• Delete your account and your data (dashboard, deletion page, or app);
• Withdraw your marketing consent;
• Object to processing or request its restriction, where permitted by law.

To exercise these rights, write to contato@autocut.com.br. We respond within 15 days. You may also file a complaint with the ANPD (Brazil's National Data Protection Authority), in Brazil, or with the data protection authority of your country, in the European Union.

7. How Long We Keep Data

• Account: for as long as it remains active.
• Audio sent for transcription: deleted as soon as transcription is complete; the transcribed text, within 15 minutes.
• Error reports: for as long as necessary to fix the problem.
• Access logs: 90 days.
• Payments and tax data: 5 years, as required by law.
• After account deletion: name, email, CPF, phone number, and address are erased (anonymized), and the card is unlinked. Only the payment records required by law are retained, without any data that identifies you. Backup copies are deleted within 30 days.

8. Security

• Connections protected by HTTPS.
• Passwords stored as bcrypt hashes (irreversible).
• Card data protected by Stripe, which is PCI-DSS certified.
• Access keys for our providers are kept only on our servers, never in the apps.
• Daily backups of the database.

9. Cookies

On the website, we use only necessary cookies: the session cookie, which keeps you signed in, and the language preference cookie. On payment pages, Stripe uses its own cookies to prevent fraud. The website does not use advertising cookies or third-party tracking tools. In the mobile apps, crash and usage metrics are handled by Google Firebase (Section 2.5), not for advertising purposes.

10. Minors

Paid plans are intended for persons 18 years of age or older, or for minors with the authorization of their parent or legal guardian. If you become aware that a minor has provided us with data without such authorization, contact us so that we can remove it.

11. Changes to This Policy

We may update this Policy. Material changes will be announced by email, and the date of the last update is shown at the top of this page.

12. Contact

Questions or requests about your data: contato@autocut.com.br.