Privacy Policy

Last updated: November 1, 2026

1. Who We Are

AutoCut is a product of Gameplay do Boy, the trade name of RAFAEL HENRIQUE ANONI DO NASCIMENTO LTDA, Brazilian company registration (CNPJ) 48.011.000/0001-13, located at Rua Paraíba, 3336, Patrimônio Velho, Votuporanga/SP, ZIP 15502-150, Brazil. The company is the controller of the personal data processed on the website, in the desktop program and in the apps.

Privacy contact (the "encarregado" under Brazil's LGPD): Rafael Henrique Anoni do Nascimento, at contato@autocut.com.br.

This policy applies to customers in every country and follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and, for people in the European Union, the General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Sign-up

• Name, email and password (stored only as a bcrypt hash, which cannot be reversed).
• Chosen country and language.
• Brazil: CPF (Brazilian taxpayer ID) and address. Other countries: phone number with country code and billing address.
• Record of your acceptance of the Terms, this Policy and the option to receive marketing emails, with date and IP.

2.2 Payment

• Card details are typed directly into Stripe's form and stay with Stripe. The full card number and security code never pass through our servers.
• We keep only what is needed for billing and support: card brand, last 4 digits, expiry date, the customer and card identifiers at Stripe, and the payment history (amount, currency, date and status).
• Subscriptions bought in the iPhone and iPad app are paid to Apple. From Apple we receive only the purchase confirmation: transaction identifier, plan and expiry.

2.3 Use of the service

• IP, browser and device, access dates and program version.
• Number of videos edited per cycle, to enforce plan limits. We do not keep your videos.
• Messages and images you send to support.
• Messages sent through the feedback form, with the email you provide.

2.4 Cloud processing during editing

Editing happens on your device and your video files are not sent to us. To deliver the result faster, some steps use the cloud:

• Transcription: the video's audio is sent to our servers to be turned into text (captions and cut points). The audio file is deleted as soon as transcription finishes, and the transcribed text is deleted from the server within 15 minutes, after it is delivered to your device.
• Artificial intelligence: the transcribed text (to choose the best moments, cuts and effects) and, during visual review, some images from the edit preview are sent to AI providers (DeepSeek, in China, and Google Gemini), which return the analysis. Your name, email and sign-up data are not sent with them. Keep in mind that the text and images may contain what appears or is said in your video, including faces, voices and names.
• Media library: to suggest B-roll videos, keywords from the edit are used in searches on Pixabay.

2.5 Error reports and app diagnostics

In the Android app we use Google Firebase (Crashlytics and Analytics) to measure crashes and performance: crash reports, device model, system and app version, processing times and in-app usage events. The iPhone and iPad app does not use Firebase.

When an edit fails in the apps (Windows, Android and iOS), we send a report with the error code and description, technical device data (model, processor/graphics card, operating system and app version) and the log of that edit, with the steps executed and where it stopped. This log does not include the content of your videos, audio or images. The report carries the email of the signed-in account for one purpose only: to let you know when the error is fixed. That email is not used for marketing or shared.

2.6 Ads in the Free plan of the mobile apps

In the Android and iPhone apps, the Free plan shows ads from Google AdMob. To show and measure these ads, Google may collect device identifiers (such as the advertising ID), the IP address and interactions with the ad, according to Google's advertising policy. Paid plans show no ads, and neither do the website and the desktop program. You can reset or limit the use of the advertising ID in your device settings.

2.7 Mobile app permissions

• Gallery / storage: to open the videos you choose to edit and save the finished video to your gallery.
• Notifications: to show editing progress in the background (which keeps the system from stopping the process), to let you know when support replies, and to send notices about the service. You can turn notifications off in your device settings.

3. Why We Use Data and Legal Basis

• Providing the contracted service (account, editing, transcription, AI analysis, plan limits, support): performance of the contract.
• Billing, renewal and account notices (payments, due dates, failed charges): performance of the contract.
• Keeping tax, payment and access records: compliance with a legal obligation (including Brazil's Internet Civil Framework, the Marco Civil da Internet).
• Security, fraud prevention and bug fixing: legitimate interest.
• Ads in the Free plan of the apps: legitimate interest, because the free plan is funded by the ads.
• Marketing and news emails: only with your consent, which you can withdraw at any time in your dashboard or through the link in every email. Notices about the service and your account (for example, changes to the terms or billing) are not marketing and are sent to all customers.

4. Who We Share Data With

We do not sell your data. We share only what is necessary with these providers:

• Stripe: payment processing (name, email, country, billing address and phone, and card details).
• Apple: payment of subscriptions made through the App Store.
• Google: Firebase in the Android app (item 2.5), AdMob ads in the Free plan of the apps (item 2.6) and Gemini for AI analysis (item 2.4).
• DeepSeek: AI analysis of the transcribed text and preview images, without your sign-up data (item 2.4).
• Hostinger: hosting of the website, the database and the transcription servers.
• Brevo: sending account emails and, if you consented, marketing emails.
• Pixabay: B-roll video search by keywords (item 2.4).
• YouTube: the videos on the home page are loaded only if you allow it (item 9).
• Telegram: internal alerts to our team about account events (sign-up, payment, renewal, cancellation, deletion and new support tickets), with name, email, plan, amount and, for tickets, an excerpt of the message. Only our team has access.
• Authorities: when required by law or court order.

5. International Transfers

Some of these providers process data outside the country where you are: in the United States and the European Union (Stripe, Google, Apple, Brevo, Telegram) and in China (DeepSeek). These transfers are necessary to perform the service you contracted (LGPD, art. 33, item IX, together with art. 7, item V; for people in the European Union, GDPR art. 49(1)(b)). Where the provider offers data protection terms or standard contractual clauses, those also apply.

China has no adequacy decision from Brazil's ANPD or from the European Union. For that reason, we send DeepSeek only the minimum needed for the analysis (the transcribed text and some preview images), without name, email, ID or payment data, and only when the edit uses the artificial intelligence features.

6. Your Rights

At any time you can:

• Confirm whether we process your data and access it;
• Export your data (button in your account dashboard) or request portability;
• Correct incomplete or inaccurate data;
• Delete your account and your data (dashboard, deletion page or app);
• Withdraw your marketing consent;
• Object to processing or request its restriction, where the law allows.

To exercise these rights, write to contato@autocut.com.br. We reply within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD) or, in the European Union, with the data protection authority of your country.

7. How Long We Keep Data

• Account: while it is active.
• Audio sent for transcription: deleted as soon as transcription finishes; the transcribed text, within 15 minutes.
• Error reports: for as long as needed to fix the problem.
• Access records (IP and browser): 6 months, as required by Brazil's Internet Civil Framework. After that, the IP and browser are erased from the records. The record of your acceptance of the Terms and this Policy (date and IP at sign-up) is kept while the account exists, as proof of acceptance; after the account is deleted, that IP is also erased within 6 months.
• Payments and tax data: 5 years, as required by law.
• After account deletion: name, email, CPF, phone, address and password are erased (anonymized), and your customer record and cards at Stripe are deleted. Only the payment records required by law and the usage and support history remain, with no name, email or ID linked to them. Images sent to support are deleted. Backups are erased within 30 days.

8. Security

• Connections protected by HTTPS.
• Passwords stored as bcrypt hashes (irreversible).
• Card data protected by Stripe, PCI-DSS certified.
• Access keys to providers stay only on our servers, never in the apps.
• Daily database backups.

9. Cookies

On the website we use these necessary cookies, which do not require permission:

• PHPSESSID: keeps you signed in. It is deleted when you close the browser.
• ac_idioma: stores the chosen language, for 1 year.
• ac_cookies: stores your cookie choice, for 1 year.
• Stripe: only on payment pages, to prevent fraud.

Third-party content only with your permission: the videos on the home page come from YouTube (in privacy-enhanced mode) and are loaded only if you accept them in the cookie notice or click one of them. YouTube may then use its own cookies. The website uses no advertising cookies or third-party analytics tools, and fonts and icons are loaded from our own server. You can change your choice at any time through the "Cookies" link in the footer of the home page or by clicking here.

10. Minors

You must be at least 13 years old to create an account. Users under 18 need the authorization of a parent or legal guardian, including to subscribe to paid plans. If you learn that a minor gave us data without that authorization, contact us and we will remove it.

11. Changes to this Policy

We may update this Policy. Relevant changes are announced by email and the last update date is shown at the top of this page.

12. Contact

Questions or requests about your data: contato@autocut.com.br.