Privacy policy
Version 2026-10b, 16/10/2026.
Controller: Marc Llonch, tax ID 48197341N, C/ Llonch, 11, 08201, Sabadell. Privacy contact: soporte@shortvu.com. We have no data protection officer because we aren't required to appoint one.
What we process, why, and on what basis
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Account and login | Email, hashed password (scrypt), language, sign-up, verification and login dates | Contract (Art. 6(1)(b) GDPR) | While you have an account |
| Making videos | Topics, niches, angles, channel profiles, scripts, videos and thumbnails | Contract | Topics and scripts: while you have an account or until you delete the video. MP4s and thumbnails: your plan's period (7 to 90 days) |
| Payments, invoicing and tax | Stripe customer ID, plan, amounts, country, VAT number if you're a business, invoices and each purchase's credits (credit usage history is deleted with the account) | Contract and legal obligation (Art. 6(1)(c): VAT and invoicing rules, Spanish Commercial Code, General Tax Law) | 6 years after the contract ends, restricted |
| Proof of acceptance and consents (terms, immediate start) and withdrawals | Version accepted, date and time, withdrawal details | Legal obligation and legitimate interest in defending claims (Art. 6(1)(c) and (f)) | 6 years, restricted |
| Moderation and abuse prevention | Text you send and generated scripts (checked by an automated classifier), usage limits | Legitimate interest in a safe service and in complying with our providers' policies, and Digital Services Act obligations (Art. 6(1)(f) and (c)) | Blocked text isn't stored |
| Security | IP address and, for login attempts, the email, turned into rate-limit counters with a secret key (HMAC); never stored in plain text. We keep no access logs with IPs | Legitimate interest (Art. 6(1)(f)) | As long as each limit lasts (24 hours at most) |
| Free trial | A keyed hash (HMAC) of your mailbox without tags, not the email itself | Legitimate interest in stopping the trial from being repeated with aliases (Art. 6(1)(f)) | Kept even if you delete your account, so the trial isn't repeated |
| AI video checker (/verify) | The file you upload | Legitimate interest and legal obligation (Art. 50, Regulation (EU) 2024/1689) | Analysed and deleted immediately |
| Customer service, complaints and content notices | What you write and your contact details | Contract, legal obligation (consumer law; Art. 16 Digital Services Act) and legitimate interest | 5 years after closure |
| Marking AI-generated content | The final file's hash and the watermark ID, with no personal data | Legal obligation (Art. 50, Regulation (EU) 2024/1689) | As long as the technical record exists |
We need your email to create an account; without it we can't provide the service. We don't profile you for marketing or use your data to train AI models, and our providers' contracts don't allow them to either.
Automated decisions: the moderation filter decides automatically whether a text can be used. It has no legal effect on you, but you can ask for a person to review it by emailing us.
Who else processes your data (processors and recipients)
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Hetzner Online GmbH (Alemania / Germany) | Servers, database, videos and backups | EU |
| Anthropic Ireland, Limited (Ireland) | Writes scripts and ideas from your text | Processed in the US by Anthropic, PBC under standard contractual clauses |
| OpenAI Ireland Ltd (Ireland) | Synthetic voice, transcription, AI-generated images and text moderation | Processed in the US under standard contractual clauses or the EU-US Data Privacy Framework |
| Stripe Payments Europe, Ltd. (Ireland) | Payments, subscriptions, invoices and tax. For fraud prevention and its legal obligations, Stripe acts as an independent controller | EU and US, under standard contractual clauses, the Data Privacy Framework and binding corporate rules |
| Resend, Inc. (EE. UU. / US) | Sending service emails | Sent from the EU region; US company, under standard contractual clauses |
| Contabilidad propia | Bookkeeping and tax filings | Spain |
| Pexels GmbH (Germany) | Stock footage search. It only receives English search terms generated from the script, with no account data | EU |
| Clerk, Inc. (US) | Sign-in: email, sign-in method (Google, code or password), IP and device data to protect the account | US, under the EU-US Data Privacy Framework and standard contractual clauses |
| Supabase, Inc. (US) | The app's database (accounts, scripts, purchases) | Servers in the EU (region chosen in Supabase), under standard contractual clauses |
| Cloudflare, Inc. (US) | Domain DNS, Turnstile bot check and video storage (R2). The website doesn't go through its network: your browser connects directly to our server | Global network; under the Data Privacy Framework and standard contractual clauses |
| Upstash, Inc. (US) | Abuse counters (attempt limits). It only stores hashed identifiers, never your email or IP in plain text | EU region chosen in Upstash, under standard contractual clauses |
| Functional Software, Inc. (Sentry, US) | Technical error logs, without cookies, IPs or emails | Sentry's EU region, under standard contractual clauses |
| PostHog Inc. (US) | Usage analytics, only if you accept it (pseudonymous ID, never your email) | Servers in the EU (Frankfurt), under standard contractual clauses |
We also share data with the tax authorities, courts and other authorities when the law requires it. You can ask us for a copy of the safeguards for international transfers. We'll email you 30 days before adding any new processor.
Cookies
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| sc_session | Keep you logged in, protect forms (CSRF token) and remember the language you pick | 14 days | First-party, strictly necessary, exempt from consent |
| __session, __client_uat, __client | Sign-in with Clerk (on the sign-in pages and Clerk's domain) | Session, up to 1 year | Strictly necessary, exempt from consent |
| __cf_bm, cf_clearance | Cloudflare bot protection | 30 minutes to 1 year | Security, exempt from consent |
| sv_consent | Remember whether you accept or reject analytics | 6 months | First-party, strictly necessary |
| ph_*_posthog | Usage analytics (PostHog, EU) | 1 year | Analytics, only with your consent |
Analytics only runs if you accept it in the cookie notice; you can change your choice anytime under "Cookies" at the bottom of every page. We use no advertising cookies. Fonts are served from our own server. When you pay, Stripe's payment page (checkout.stripe.com) uses its own cookies to process payments and prevent fraud, under Stripe's privacy policy.
Your rights
You can access, correct, erase, object to, restrict and port your data. From Account you can download your data and delete your account. For anything else, email us from your account address and we'll reply within one month. You can also complain to the Spanish Data Protection Agency (aepd.es) or your local authority.
When you delete your account, we erase your content and videos immediately. Purchase, consent and withdrawal records are kept restricted (accessible only to meet legal obligations or handle claims) for the periods above, then deleted.
Security and minors
We use encrypted connections (HTTPS), passwords hashed with scrypt, protection against request forgery, rate limits and EU hosting. The service is for people aged 18 and over only.