This Privacy Policy explains how MomentCut (“we”, “us”, the “Service”) collects, uses, stores and deletes information when you use our website and app. By using the Service you agree to this policy.
Information we collect
- Account information. You can sign in with Google or with an email magic link. Signing in with Google gives us your name, email address and profile image. Signing in by magic link gives us only your email address, which our login provider (Magic) verifies by emailing you a one-time link. We use this to create and identify your account.
- Instagram connection. When you connect an Instagram account, we receive your Instagram user ID, username and profile picture, and an access token that lets us publish reels on your behalf. The access token is stored encrypted at rest and is never shared.
- Content you provide. Videos you upload or links you submit, and the reels, captions, thumbnails and transcripts the Service generates from them.
- Usage data. Job history, scheduling, your remaining minute balance and the daily job count needed to run the Service and enforce its fair-use limits.
- Payment data. Payments are handled by our payment processor, Stripe, on its own hosted checkout page. We never receive or store your card details. For each completed purchase we keep a record of the Stripe checkout session reference, the email used, which minute pack was bought, the minutes credited and the amount charged. We do not store a saved payment method, and because there are no subscriptions there is no subscription status to store.
- Analytics. We use Google Analytics and Vercel Analytics to measure aggregate site traffic (pages viewed, approximate region, device and referrer). These are set on our public pages; we do not use them to build advertising profiles and we do not sell the data.
How we use your information
- To provide the Service: transcribe videos, detect clips, render reels.
- To publish and schedule reels to your connected Instagram account at your direction.
- To manage your account, your minute balance and the Service’s fair-use limits.
- To secure the Service and comply with legal obligations.
Legal basis for processing
- Performance of a contract — creating and running your account, processing the videos you submit, publishing to the Instagram account you connect, and handling payments.
- Legal obligation — retaining purchase records for accounting and tax purposes.
- Legitimate interests — securing the Service, preventing abuse, and measuring aggregate site traffic.
How we share information
We do not sell your personal data. We share data only with service providers that help us run the Service:
- Meta / Instagram — to publish reels via the Instagram API, in accordance with Meta’s Platform Terms.
- Google — for sign-in (authentication) and, separately, for aggregate site analytics.
- Magic — to send and verify email magic-link sign-ins.
- Stripe — for payment processing.
- Vercel — to host the website and provide aggregate traffic analytics.
- Cloud infrastructure & storage — to host the app and store your videos and rendered reels.
- Transcription provider — audio from your videos may be processed to generate transcripts and captions.
Some of these providers are based in, or process data in, the United States. Those transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
Data retention
- Rendered reels and their source media are automatically deleted after 7 days.
- Reviews/jobs that are never acted on are cleaned up within about 1 day.
- Account and Instagram-connection data are kept while your account is active. When you disconnect Instagram or delete your account, the related tokens and records are removed (see below).
- Purchase records (date, amount, minutes and the email used) are kept for as long as accounting and tax law requires, even after you delete your account. This is the one category we cannot erase on request.
Your rights and choices
- Disconnect any Instagram account at any time from the app — this deletes the stored token and its scheduled posts.
- Request deletion of your data at any time (see our Data Deletion page).
- Depending on your location (e.g. the EU/EEA under GDPR), you may have rights to access, correct, export or erase your personal data. Contact us to exercise these rights.
- You also have the right to lodge a complaint with the data-protection supervisory authority in your country of residence.
Security
We protect access tokens with encryption at rest and restrict access to your data. No method of transmission or storage is 100% secure, but we take reasonable measures to safeguard your information.
Children
The Service is not directed to children under 14 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.
Changes to this policy
We may update this policy from time to time. We will revise the “Last updated” date above when we do.
Contact
Questions about this policy or your data? Email us at lucas.erlacher.29@gmail.com.