Privacy Policy

1. Who is responsible

The data controller is TONVI TECH SL (CIF B-19780394), Calle Puerta del Mar 18, 5th floor, 29005 Málaga, Spain — the company behind OpenShorts (openshorts.app). For anything about your data, write to [email protected]. This policy is also available in Spanish; for residents of Spain, the Spanish version prevails in case of discrepancy.

2. What we process, why, and on what legal basis

Your account

Your email address (and, if you sign in with Google, your Google account identifier), sign-up and last-login dates. We use passwordless magic links, so we never store a password. Basis: performance of the contract (Art. 6.1.b GDPR).

Billing

Payments run entirely on Stripe: we store your Stripe customer reference, plan and subscription state, never your card number. Invoicing data is kept because tax law requires it. Basis: contract (Art. 6.1.b) and legal obligation (Art. 6.1.c).

The videos you process

The videos you upload or instruct us to fetch, their transcripts, and the clips generated from them are processed to deliver exactly the job you requested. Basis: contract (Art. 6.1.b). Where a video contains personal data of other people (their image, their voice), you are the controller of that data and we act as your processor on your instructions — see Section 6 of the Terms of Service.

Your rights declaration

Each time you submit a job you confirm you have the rights to the content. We keep that declaration with its date, your IP address and browser identifier, as evidence of diligence in case of copyright or image-rights disputes. Basis: legitimate interest in establishing and defending legal claims (Art. 6.1.f).

Service emails

We email you magic links, receipts, renewal reminders, clip-ready and deletion warnings. These are part of the service, not marketing. Basis: contract (Art. 6.1.b). If we ever send commercial newsletters, we will ask for your consent first and every message will carry an unsubscribe link.

Product analytics

We run our own analytics (a self-hosted OpenPanel instance on our own servers). No third-party trackers, no advertising pixels, no cross-site tracking, and nothing is shared with anyone. Aggregate audience measurement is exempt from consent under the Spanish supervisory authority's (AEPD) criteria; usage events linked to your account (which features you use, whether jobs succeed) are processed under our legitimate interest in improving and securing the product (Art. 6.1.f) — you can object at any time by emailing [email protected].

Security and anti-abuse

Server logs, IP-based rate limits and fraud signals, kept to protect the service and its users. Basis: legitimate interest (Art. 6.1.f).

We do not process special categories of data (Art. 9 GDPR) as part of the service, we make no automated decisions with legal effects on you (Art. 22 GDPR), and we do not use your content or your data to train AI models — ours or anyone else's — nor sell it.

3. Cookies and local storage

The site sets no third-party cookies and shows no cookie banner because it does not need one: everything stored in your browser is strictly necessary to provide what you asked for. Specifically: your session token (to keep you signed in), your interface preferences (like your last-used editor settings), and — if you use bring-your-own-key mode — your AI provider API keys, which are stored encrypted in your own browser and are sent only to perform your jobs, never stored on our servers. Our self-hosted, first-party audience measurement operates under the AEPD's consent exemption for strictly statistical analytics; identifiers live no longer than 13 months and raw data no longer than 25 months.

4. Who receives data (processors) and where

We use a short list of providers, each bound by a data processing agreement, and only for the purpose stated:

• Google (Gemini API) — AI analysis of your video's transcript and frames to select moments and layouts. Google's paid API terms prohibit using customer data to train models. USA.
• ElevenLabs — AI dubbing, only when you request it. USA.
• Stripe — payments and invoicing. USA/EU.
• Cloudflare R2 and Amazon Web Services S3 — storage of your clips and project files. EU/USA regions.
• Hetzner and Contabo — the servers the service runs on. Germany.
• Upload-Post — publishing to social accounts you connect, only on your instruction. Operated by TONVI TECH SL under this same policy.
• Namecheap Private Email — delivery of service emails. USA.

Where a provider processes data outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified and, in any case, on the European Commission's Standard Contractual Clauses (Art. 46.2.c GDPR) as a fallback, together with the provider's technical safeguards. We prefer EU regions where the provider offers them.

5. How long we keep things

• Free-plan clips: 7 days, then permanently deleted (we warn you by email first).
• Paid-plan projects and clips: while your subscription is active, plus 7 days.
• Account data: while your account exists; after deletion, only what is needed to meet legal obligations or resolve disputes.
• Invoicing data: 6 years (Spanish commercial law).
• Rights declarations and related logs: up to 5 years, matching the statute of limitations for civil claims.
• Analytics identifiers: 13 months; raw analytics data: 25 months.

6. Your rights

You can ask us for access, rectification, erasure, restriction, portability of your data, and object to processing based on legitimate interest — just email [email protected] from your account address; we answer within one month. Deleting your account from the dashboard removes your content on the schedule above. If you believe we are mishandling your data, you can complain to the Spanish supervisory authority (AEPD, aepd.es) or to the authority of your own EU country.

7. Age

The service is not directed at children. You must be at least 16, or the age of digital consent in your country if higher, to create an account.

8. Changes

If we change this policy in any meaningful way we will tell you by email or in-app before the change takes effect, and the date on this page always reflects the current version.