Privacy Policy

1. Introduction & Scope

Welcome to Caption Cut Shot. This Privacy Policy explains how Yaholy Corp ("we," "our," or "us") collects, uses, discloses, and safeguards your information when you use our Caption Cut Shot application and related services (collectively, the "Service").

Caption Cut Shot is an AI-powered platform that helps content creators transform long-form videos into engaging short-form clips optimized for social media platforms including TikTok, Instagram Reels, YouTube Shorts, and more. Our Service uses advanced AI technology for scene detection, highlight identification, and automated clip generation.

By using Caption Cut Shot, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account, we collect your email address, name, password, and optionally a profile picture.
• Video Content: Videos you upload to our platform for processing and clip generation. These files are temporarily stored during processing.
• Payment Information: For paid subscriptions, payment details are processed securely through our third-party payment processor (Stripe). We do not store complete credit card information on our servers.
• Support Communications: When you contact our support team, we collect the information you provide in those communications, including messages, attachments, and contact details.
• Feedback and Surveys: Information you provide when participating in surveys, contests, or providing feedback about our Service.

2.2 Information Automatically Collected

• Usage Data: We collect information about how you interact with the Service, including clips created, features used, processing time, export formats, and time spent in the application.
• Device Information: We collect information about your computer, mobile device, or tablet, including operating system version, browser type, hardware model, screen resolution, and unique device identifiers.
• Log Data: Our servers automatically record information including IP address, browser type, referring/exit pages, timestamps, and clickstream data.
• Cookies and Tracking: We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities and preferences.

2.3 Video Content & AI Processing Data

• Uploaded Video Files: Original video files you upload for clip generation are temporarily stored on our secure servers during processing.
• Audio Extraction: Audio tracks extracted from your videos for scene detection and analysis purposes.
• Scene Detection Data: AI-generated metadata including scene boundaries, highlight scores, visual analysis data, and audio pattern recognition.
• Generated Clips: Short-form video clips created by our AI, along with associated metadata, thumbnails, and export settings.
• Processing Metrics: Technical data about video processing, including resolution, duration, file size, encoding parameters, and processing duration.

2.4 Social Media Integration Data

• Platform Connections: If you connect social media accounts, we collect authentication tokens and profile information necessary for integration.
• Publishing Data: Information about clips published to social platforms, including publication status, platform-specific metrics, and timestamps.

3. Legal Bases & Compliance Frameworks

We process your personal information in compliance with applicable data protection laws and regulations, including:

• GDPR (General Data Protection Regulation): For users in the European Union and European Economic Area, we process data based on consent, contractual necessity, legitimate interests, and legal obligations.
• CCPA (California Consumer Privacy Act): For California residents, we comply with all CCPA requirements regarding data collection, use, and sale disclosures.
• State Privacy Laws: We comply with privacy laws in Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), and Utah (UCPA).
• PIPEDA: For Canadian users, we comply with the Personal Information Protection and Electronic Documents Act.
• Other Jurisdictions: We adhere to applicable data protection requirements in all jurisdictions where we operate.

Our legal basis for processing includes: (1) your consent, (2) performance of our contract with you, (3) compliance with legal obligations, and (4) our legitimate business interests in providing and improving the Service.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Maintain the Service: To operate Caption Cut Shot, process videos, generate clips, and deliver the features you request.
• AI Processing: To perform scene detection, identify highlights, analyze video content, and generate optimized short-form clips.
• Improve Our Service: To understand how users interact with our platform, identify areas for improvement, and develop new features.
• Customer Support: To respond to your questions, provide technical assistance, troubleshoot issues, and resolve disputes.
• Account Management: To manage your subscription, process payments, send service-related notifications, and provide account information.
• Security and Fraud Prevention: To detect, prevent, and address technical issues, fraudulent activity, unauthorized access, and violations of our terms.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
• Marketing Communications: With your consent, to send promotional materials, feature announcements, and newsletters (you may opt out at any time).
• Analytics and Research: To analyze usage patterns, conduct research, and generate aggregated statistics (de-identified data).

5. AI Video Processing & Scene Detection

Caption Cut Shot uses advanced artificial intelligence technology to analyze your videos and generate short-form clips. Here's how this process works:

Processing Pipeline

• Upload: When you upload a video, it is transmitted securely via encrypted connection (TLS/SSL) to our cloud servers.
• Visual Analysis: Our AI analyzes video frames to identify scene changes, detect faces and objects, recognize on-screen text, and assess visual quality.
• Audio Analysis: Audio tracks are analyzed for speech patterns, music segments, silence detection, and emotional tone to identify engaging moments.
• Scene Detection: The AI identifies natural scene boundaries, transitions, and key moments that work well as standalone clips.
• Highlight Scoring: Each segment receives a score based on engagement potential, content coherence, and platform optimization criteria.
• Clip Generation: The system automatically generates short-form clips optimized for your selected platforms (TikTok, Instagram Reels, YouTube Shorts, etc.).
• Post-Processing: Generated clips are formatted, compressed, and prepared for download or direct publishing.

Data Security & Deletion

• Temporary Storage: Original uploaded videos are stored temporarily on our secure servers only during active processing.
• Automatic Deletion: Original video files are automatically and permanently deleted from our servers within 24 hours after processing is complete or if processing fails.
• Clip Retention: Generated clips are retained in your account until you delete them or close your account, enabling you to access and download them at any time.
• No AI Training: We do not use your video content, audio, or generated clips to train our AI models or for any purpose other than providing the Service to you.
• Processing Data: Intermediate processing data (scene detection metadata, analysis scores) is deleted within 7 days after processing completion.

Internet Connection Requirement

Video processing requires an internet connection as our cloud-based AI servers handle the computational workload. Once clips are generated, you can download and use them offline.

6. Data Sharing & Third-Party Services

We may share your information with third-party service providers and partners who assist us in operating the Service. All third parties are contractually bound to protect your data and use it only for specified purposes.

Third-Party Service Categories

• Payment Processors: Stripe processes subscription payments and billing. Stripe has its own privacy policy governing the use of your payment information.
• Cloud Infrastructure Providers: Hosting providers (such as AWS, Google Cloud, or similar) for secure data storage, server hosting, and content delivery.
• AI Processing Services: Third-party AI and machine learning services that power our scene detection and video analysis capabilities.
• Analytics Services: Tools that help us understand user behavior, measure performance, and improve the Service (e.g., Google Analytics, Mixpanel).
• CDN Providers: Content delivery networks that distribute and serve your generated clips quickly and reliably.
• Email Service Providers: Services for sending transactional emails, notifications, and marketing communications.
• Customer Support Tools: Platforms that help us provide customer support and manage support tickets.
• Social Media Platforms: If you choose to publish clips directly to social platforms, we share content with those platforms according to your instructions.

Data Processing Agreements

All third-party service providers with access to personal information have signed Data Processing Agreements (DPAs) ensuring GDPR compliance and appropriate data protection safeguards.

No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Under California law (CCPA), we do not "sell" personal information as defined by the statute.

Business Transfers

If we are involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

7. Data Storage & Security

We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, and destruction.

Security Measures

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using SSL/TLS protocols (HTTPS).
• Encryption at Rest: Stored data, including video files and account information, is encrypted using AES-256 encryption or equivalent standards.
• Secure Authentication: Password protection with industry-standard hashing (bcrypt), optional two-factor authentication (2FA), and secure session management.
• Access Controls: Strict role-based access controls limiting employee and contractor access to personal information on a need-to-know basis.
• Network Security: Firewalls, intrusion detection systems, and regular security monitoring to protect against unauthorized access.
• Regular Audits: Periodic security audits, vulnerability assessments, and penetration testing to identify and address potential weaknesses.
• Incident Response: Established procedures for detecting, responding to, and recovering from security incidents.
• Employee Training: Regular security awareness training for all employees and contractors with access to systems.

Data Storage Location

Your data is primarily stored on secure cloud servers located in the United States. We may use geographically distributed data centers for redundancy and performance optimization.

Limitations

While we strive to protect your information using commercially reasonable security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data. You are responsible for maintaining the confidentiality of your account credentials.

8. Data Retention Policies

We retain your information for different periods depending on the type of data and our legitimate business needs, legal obligations, and your choices.

Retention Periods

• Account Information: Retained for as long as your account is active and for up to 3 years after account closure for legal compliance and dispute resolution purposes.
• Uploaded Video Files: Original uploaded videos are automatically deleted within 24 hours after processing completion or processing failure.
• Generated Clips: Stored in your account until you manually delete them or close your account. Upon account closure, clips are deleted within 30 days.
• Processing Metadata: Scene detection data and AI analysis metadata are deleted within 7 days after processing completion.
• Audio Extraction Data: Temporarily extracted audio files are deleted immediately after analysis completion.
• Usage Logs: Application logs and usage analytics are typically retained for 90 days for operational and troubleshooting purposes.
• Payment Records: Billing and transaction records are retained for 7 years to comply with tax and financial regulations.
• Support Communications: Customer support tickets and communications are retained for 3 years after case closure.
• Marketing Data: If you opt out of marketing communications, your email is retained on our suppression list to honor your preference.

Backup Retention

Backup copies of data may persist in our backup systems for up to 90 days after deletion from production systems. Backups are securely encrypted and access-restricted.

9. Your Rights and Choices

Depending on your location, you have various rights regarding your personal information under GDPR, CCPA, and other privacy laws.

Universal Rights

• Right to Access: You can request a copy of the personal information we hold about you, including data categories, sources, purposes, and recipients.
• Right to Correction: You can update or correct inaccurate or incomplete personal information through your account settings or by contacting us.
• Right to Deletion: You can request deletion of your personal information, subject to certain legal exceptions (e.g., financial records retention requirements).
• Right to Data Portability: You can request your data in a structured, machine-readable format (JSON, CSV) and transmit it to another service provider.
• Right to Object: You can object to processing of your personal information for direct marketing purposes or based on legitimate interests.
• Right to Restrict Processing: You can request restriction of processing in certain circumstances, such as while we verify data accuracy.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time without affecting prior lawful processing.

California-Specific Rights (CCPA)

• Right to Know: Request disclosure of personal information collected, used, and shared in the past 12 months.
• Right to Delete: Request deletion of personal information we collected from you, subject to exceptions.
• Right to Opt-Out: Opt out of the "sale" of personal information (we do not sell personal information).
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request." We will respond to verified requests within:

• 30 days for GDPR requests (may be extended by 60 days if complex)
• 45 days for CCPA requests (may be extended by 45 days if necessary)
• 30-45 days for other state privacy law requests

We may request additional information to verify your identity before processing your request. You may designate an authorized agent to make requests on your behalf.

Right to Lodge a Complaint

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with a supervisory authority in your jurisdiction, such as your local data protection authority in the EU or your state attorney general in the US.

10. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities and improve your experience.

Types of Cookies We Use

• Essential/Strictly Necessary Cookies: Required for the Service to function properly, including authentication, security, session management, and load balancing. These cannot be disabled without affecting functionality.
• Preference Cookies: Remember your settings, language preferences, and customization choices to provide a personalized experience.
• Performance/Analytics Cookies: Help us understand how visitors interact with the Service by collecting anonymous usage statistics, page views, and performance metrics.
• Marketing/Retargeting Cookies: Used to deliver relevant advertisements and measure campaign effectiveness. These require your consent and can be disabled.

Third-Party Cookies

Some cookies are placed by third-party services that appear on our pages. We do not control these third-party cookies. Please review the privacy policies of these services:

• Google Analytics - Analytics and performance tracking
• Stripe - Payment processing and fraud detection
• Social media platforms - If you interact with social sharing features

Cookie Management

You can control cookies through your browser settings. Most browsers allow you to:

• View and delete cookies currently stored
• Block third-party cookies
• Block all cookies (may affect Service functionality)
• Receive notifications when cookies are set

You can also opt out of interest-based advertising through industry opt-out programs like the Network Advertising Initiative (NAI) and Digital Advertising Alliance (DAA).

Do Not Track Signals

Our Service does not currently respond to "Do Not Track" (DNT) browser signals. We will update this policy if we implement DNT support in the future.

11. Children's Privacy

Caption Cut Shot is not intended for use by individuals under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children.

Age Requirements by Jurisdiction

• United States: Minimum age 13 (COPPA compliance)
• European Union: Minimum age 16 (GDPR Article 8)
• Brazil: Minimum age 18 for certain data processing activities
• South Korea: Minimum age 14 for personal information collection
• Indonesia: Parental consent required for users under 21
• Vietnam: Minimum age 15 for data processing consent

Parental Consent

If we learn that we have collected personal information from a child without proper parental consent, we will delete that information as quickly as possible. If you believe a child has provided us with personal information, please contact us at [email protected].

COPPA Compliance

We comply with the Children's Online Privacy Protection Act (COPPA) in the United States and do not knowingly collect information from children under 13 without verifiable parental consent.

12. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States, where our servers and service providers are located.

Data Transfer Mechanisms

• EU-U.S. Data Privacy Framework: We comply with the EU-U.S. Data Privacy Framework (DPF) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States.
• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses for transfers of personal data to countries without an adequacy decision.
• Adequacy Decisions: We rely on European Commission adequacy decisions where available for certain countries.
• Binding Corporate Rules: For intra-organizational transfers, we may use Binding Corporate Rules approved by relevant data protection authorities.

Data Protection Safeguards

When transferring data internationally, we ensure appropriate safeguards are in place, including:

• Contractual commitments to protect data according to applicable standards
• Technical and organizational security measures
• Compliance with local data protection laws
• Regular assessments of transfer mechanisms and adequacy

Your Consent

By using Caption Cut Shot and providing your information, you consent to the transfer of your information to the United States and other countries where we operate, which may have data protection laws that differ from those in your jurisdiction.

13. Payment Processing & Financial Data

We use third-party payment processors to handle all payment transactions securely and in compliance with payment card industry standards.

Payment Processor

• Primary Processor: Stripe, Inc. processes all credit card and subscription payments.
• PCI-DSS Compliance: Our payment processor is certified as a PCI Level 1 Service Provider, the highest level of security in the payment card industry.
• Separate Privacy Policy: Stripe has its own privacy policy governing payment information. We encourage you to review it at stripe.com/privacy.

What We Store

• We DO Store: Billing name, billing email, last 4 digits of card number, card expiration date, billing address, transaction history, and invoice records.
• We DO NOT Store: Complete credit card numbers, CVV/CVC security codes, or full payment card data.

Transaction Records

We retain transaction records and invoices for 7 years to comply with tax regulations and financial record-keeping requirements. These records include purchase dates, amounts, subscription plans, and payment status.

Subscription Management

You can view your subscription details, update payment methods, and manage billing information through your account settings. For billing disputes or refund requests, please contact [email protected].

Refund and Billing Policies

• Non-Refundable Purchases: Subscription fees and credit purchases are non-refundable once the transaction is completed. This policy applies regardless of usage or account activity.
• Detailed Refund Policy: For complete information about our refund policy, cancellation procedures, and exceptional circumstances, please refer to Section 8 (Payment, Subscription & Billing) of our Terms of Service.
• Transaction Records: As noted above, we retain billing and transaction records for 7 years to comply with tax and financial regulations. These records document all purchases and are maintained regardless of refund requests.
• Platform-Specific Purchases: Purchases made through third-party platforms (Apple App Store, Google Play Store) are subject to those platforms' refund policies and must be requested directly through the respective platform.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

How We Notify You

When we make material changes to this Privacy Policy, we will notify you through one or more of the following methods:

• Email Notification: We will send an email to the address associated with your account at least 30 days before the changes take effect.
• In-App Notification: A prominent notice will be displayed when you log into Caption Cut Shot.
• Website Banner: A notification banner will appear on our website announcing the policy update.
• Updated Date: The "Last Updated" date at the top of this policy will be revised to reflect the effective date of changes.

Your Acceptance

Your continued use of Caption Cut Shot after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you should discontinue using the Service and may request deletion of your account.

Material Changes

Material changes include modifications to: how we collect or use personal information, third-party sharing practices, data retention periods, your rights and choices, or international data transfers. For non-material changes (such as clarifications or formatting), we may update the policy without advance notice.

Policy Version History

Previous versions of this Privacy Policy are available upon request. Contact us at [email protected] to request historical policy versions.

15. Complaint & Dispute Resolution

We are committed to resolving privacy concerns and complaints in a timely and transparent manner.

Contact for Privacy Concerns

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please first contact us at:

• Email: [email protected]
• Subject Line: "Privacy Concern" or "Privacy Complaint"
• Response Time: We will acknowledge your inquiry within 3 business days and provide a substantive response within 30 days.

Escalation to Supervisory Authorities

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority:

• EU/EEA Residents: Contact your national Data Protection Authority (DPA). A list is available at edpb.europa.eu.
• UK Residents: Contact the Information Commissioner's Office (ICO) at ico.org.uk.
• California Residents: Contact the California Attorney General's Office at oag.ca.gov.
• Other US Residents: Contact your state attorney general or consumer protection office.

Data Privacy Framework Dispute Resolution

For complaints related to our EU-U.S. Data Privacy Framework compliance that cannot be resolved directly with us, we have committed to refer unresolved privacy complaints to BBB National Programs, an alternative dispute resolution provider based in the United States.

If you do not receive timely acknowledgment of your DPF-related complaint from us, or if we have not addressed your complaint to your satisfaction, please visit bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided at no cost to you.

Binding Arbitration

Under certain conditions, you may invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For additional information, please visit dataprivacyframework.gov.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: