Privacy Policy

1. Controller

The controller for data processing on this website and in the AuraClip service is:

Burhan Sahin
SHN Studio – AuraClip
c/o Online-Impressum.de #10510
Europaring 90
53757 Sankt Augustin
Germany

Email: support@auraclip.io

We have not appointed a data protection officer because we are not required to. If you have questions about data protection, write to us at the address above.

2. Overview

AuraClip turns your videos into short clips with subtitles. To do this, we mainly process:

• Account data: first and last name, email address, password (hashed only), time of confirming the minimum age and the Terms, plan and minute usage.
• Content: your videos, their audio track, the transcript created from it (i.e. what is said) as well as the finished clips and your edits. The videos may contain the image and voice of you and other people.
• Usage and technical data: IP address, browser information and time of requests, technically necessary cookies.
• Billing data: payment is handled by Paddle; we only receive the plan, status and term of your subscription, no payment details.

We do not sell data, do not show ads and do not use tracking or analytics tools.

3. Hosting and infrastructure

Our servers and storage are located in Europe. Some providers are based in the USA; for transfers to third countries see section 12. We have concluded a data processing agreement under Art. 28 GDPR with all providers in this section. The legal basis is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (our legitimate interest in secure and stable operation).

4. User account

You need an account to use the Service. For this we process first and last name, email address and password (hashed only) as well as the time at which you confirmed that you are at least 18 years old and accept the Terms. We cannot create an account without this information. The legal basis is Art. 6(1)(b) GDPR.

5. Video processing and AI services

To find the best moments, the audio track of your video is converted into text (transcription). An AI reads the transcript and suggests highlights. We use the following processors for this:

• AssemblyAI, Inc., 228 Park Ave S #38407, New York, NY 10003, USA: transcription of the audio track. AssemblyAI receives the audio track. We have opted out of its use for training AssemblyAI’s own models; the audio and transcript are usually deleted at AssemblyAI after one day.
• Anthropic PBC, 548 Market St, PMB 15301, San Francisco, CA 94104, USA: highlight selection. Anthropic receives the transcript and, for gameplay videos, individual downscaled still frames (roughly every 6 seconds), not the video itself. The data is not used for training and is deleted after 30 days at the latest.
• OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, or OpenAI, L.L.C., San Francisco, USA): fallback if AssemblyAI or Anthropic are unavailable. OpenAI then receives the audio track (transcription) or the transcript (highlight selection). The data is not used for training and is deleted after 30 days at the latest.

If you write in the support chat, an AI assistant answers your message first. For this, Anthropic receives your chat messages, the category of your request and your plan, but not your name or email address. Via “Talk to support” you can reach our team at any time; the assistant then no longer replies.

The legal basis is Art. 6(1)(b) GDPR, as this processing is the core of our service. We do not use your content for our own purposes or to train AI models.

If other people can be seen or heard in your videos, you are responsible for being allowed to process and publish their data.

The AI only makes suggestions. You decide which clips you use. No automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you takes place.

6. Twitch

The provider is Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. To import VODs from your Twitch channel, you connect your Twitch account in the settings (there is no sign-in via Twitch). You will be redirected to Twitch to grant access there. When importing, we check with Twitch that the VOD belongs to your channel and then download it. We store your Twitch ID, user and display name as well as encrypted access keys to retrieve the list of your VODs. You can disconnect at any time in the settings; we then delete this data. The legal basis is Art. 6(1)(b) GDPR. Twitch is responsible for data processing on Twitch itself.

7. Payment via Paddle

Paid plans are sold by our reseller Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (or, for buyers in the USA and Canada, Paddle.com Inc. or Paddle.com (Canada) Ltd.). Paddle is the seller and is itself responsible for the payment and billing data you enter at checkout; the Paddle privacy notice applies.

We transmit your email address, user ID and chosen plan to Paddle so that Paddle can assign the purchase to your account. From Paddle we receive the plan, status, term and a customer or subscription identifier. We do not receive payment details such as card numbers. The legal basis is Art. 6(1)(b) GDPR.

8. Emails and contact

For system emails (e.g. email confirmation, password reset, “clips ready” notices, cancellation confirmations) we use Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. Resend processes your email address and the content of the email.

If you write to us via the contact form or by email, we process your information to handle your request. Messages from the contact form are delivered via Resend to our mailbox at Namecheap.

In the dashboard you can also write to us via the support chat. We store your messages and our replies in our database (see section 3), together with your name, email address, plan, selected language, information about your browser and the place in the app you wrote from. Messages from the contact form are stored there as well. We notify you of a new reply by email.

If you cancel via “Cancel contracts here”, we process your name, email address, time and details to carry out and confirm the cancellation.

The legal basis is Art. 6(1)(b) GDPR, for general enquiries Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries), and for cancellations additionally Art. 6(1)(c) GDPR (§ 312k BGB).

9. Cookies and browser storage

We only use what is technically necessary for the Service:

• Supabase cookies that keep you signed in.
• Where applicable, a cookie that stores your chosen language.
• Local storage (localStorage) in your browser that remembers the last crop and the preview size you chose in the editor. This stays in your browser and is not transmitted to us.

The legal basis is § 25(2) no. 2 of the German TDDDG (strictly necessary) and Art. 6(1)(b) or (f) GDPR. This is why there is no cookie banner. We do not use tracking or marketing cookies.

10. Server logs

With every request, our hosting providers process technical data (IP address, date and time, requested page, browser and operating system, referrer) to deliver the website, find errors and fend off attacks. This log data is only kept as long as necessary for these purposes. The legal basis is Art. 6(1)(f) GDPR.

11. Retention

• Source video, audio track and transcripts: deleted 48 hours after processing is completed.
• Finished clips: deleted 14 days after they are created. You can also delete clips yourself earlier.
• Render jobs (contain a copy of your edited subtitles): deleted no later than 7 days after completion.
• Account data and information about your videos (title, duration, status): until you delete your account.
• Twitch connection: until you disconnect it or delete your account.
• Enquiries, chat conversations and cancellations: up to 12 months after they are concluded, at the latest until you delete your account; where we need them as evidence, until the limitation period expires (usually 3 years).
• At the AI services: usually one day at AssemblyAI, no more than 30 days at Anthropic and OpenAI (see section 5).

Statutory retention obligations (e.g. under tax and commercial law) remain unaffected; invoices are issued and retained by Paddle.

12. Transfers to third countries

Our database is located in the United Kingdom. For the United Kingdom, the European Commission has found that an adequate level of data protection exists (adequacy decision under Art. 45 GDPR).

Some providers (Vercel, Cloudflare, DigitalOcean, Namecheap, Resend, AssemblyAI, Anthropic, OpenAI, Twitch) are based in the USA or access data from there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR); otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

13. Your rights

You have the right to

• access your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability, i.e. receiving your data in a common, machine-readable format (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

For all requests, an email to support@auraclip.io is enough. You can also delete your account yourself in the settings at any time.

Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority, for example where you live or with the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

14. Encryption

The connection to our website is encrypted via TLS. We additionally store access keys to your Twitch account in encrypted form.

15. Changes

We update this privacy policy when our service or the legal situation changes. The version published here applies.