Privacy Policy · Brollcut

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Miroslav Matev, [Company name – Einzelunternehmen, to be added], [Address, Austria]. Email: [email protected]. Full details are in the Impressum.

This policy explains what personal data Brollcut processes, why, how long we keep it and what rights you have. We keep data to the minimum the Service needs, and we never sell personal data.

2. Data we process

Category	What exactly	Why · legal basis
Account	Email address, name (optional), password stored only as an Argon2 hash, plan and credit balance. With Google sign-in: your Google account ID, name, email address and profile picture URL, as provided by Google.	Creating and running your account (contract, Art. 6(1)(b) GDPR)
Sign-in security	Session records with IP address, browser type and time; login attempt counters	Keeping your account secure and preventing abuse (legitimate interest, Art. 6(1)(f))
Content	Scripts you enter, your project settings, and the generated scenes, voiceover and videos	Producing your videos (contract, Art. 6(1)(b)). Deleted automatically 48 hours after rendering
Credits and billing	Credit history (grants, reservations, charges, refunds); later, payment and subscription records and invoices. Card details are processed only by Stripe.	Billing (contract) and keeping accounting records (legal obligation, Art. 6(1)(c))
Communications	Emails you send us, and transactional emails such as email confirmation or password reset	Answering you and running the Service (contract; legitimate interest)
Marketing	Your email address and name, only if you opt in to product news and offers	Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time
Technical	IP address, server and error logs, request times	Operation, security and troubleshooting (legitimate interest, Art. 6(1)(f))

We send product news and offers by email only if you have given consent, for example by ticking the optional box when you create an account with email. Signing in with Google does not opt you in. You can withdraw that consent at any time, for example by using the unsubscribe link in those emails or by writing to us. Withdrawing consent does not affect the lawfulness of emails already sent.

3. Legal bases

Art. 6(1)(a) GDPR, consent: for optional product news and offers by email. You can withdraw this consent at any time.
Art. 6(1)(b) GDPR, contract: to provide your account and produce your videos.
Art. 6(1)(c) GDPR, legal obligation: for example, keeping accounting and tax records.
Art. 6(1)(f) GDPR, legitimate interests: security, preventing abuse and fraud, troubleshooting, and answering your messages. You can object to processing based on legitimate interests (see “Your rights”).

4. Cookies and local storage

We use only cookies that are strictly necessary for the site to work. Because they are necessary, no consent banner is needed:

Cookie	Purpose	Lifetime
`as_session`	Keeps you signed in (random token; only a hash of it is stored on our side)	Up to 30 days, or until you log out
`as_csrf`	Protects forms against cross-site request forgery	Browser session
`as_oauth`	Only during Google sign-in: protects the sign-in flow	10 minutes

Your browser’s local storage also keeps a few preferences on your device, such as the colour theme and an unsent script draft. These are not sent to us until you submit them.

We use no analytics, advertising or tracking tools, and our public pages load no third-party scripts or fonts. If paid plans are switched on, the payment pages hosted by Stripe are covered by Stripe’s own cookie policy.

5. Service providers (processors)

Provider	Purpose
Stripe Payments Europe Ltd. (planned)	Payments and subscriptions, once paid plans are switched on
Cloudflare, Inc.	DNS, network protection and secure connection (tunnel/proxy) to our servers; forwarding of email to our addresses
Hetzner Online GmbH (planned)	Hosting of the servers that run Brollcut, in Germany/the EU
Google Ireland Ltd. / Google LLC	Google sign-in only, when you choose it. We receive your Google ID, name, email and profile picture URL; Google does not receive your scripts or videos.

These providers process data only on our instructions and under data-processing agreements. This list may still change before Brollcut launches publicly. For example, we may add a provider for sending transactional email. We will update this page before any new provider receives personal data.

6. Media sources and map lookups

To find footage, images and music for your script, our servers send search terms derived from your script to the stock libraries Pexels and Pixabay, and to Wikimedia Commons and, for the “Scene clips” look, YouTube search for Creative Commons videos. To draw maps, place names may be looked up with OpenStreetMap’s Nominatim service. These requests come from our servers and contain the search words only. They do not include your name, email or account. Please do not put personal data about yourself or others into your script unless you need to.

All AI processing (scene planning, image generation, voice and captions) runs on servers we operate. Your scripts are not sent to external AI providers.

7. Transfers outside the EU

We aim to process data within the EU. Some providers (Cloudflare, Google, Stripe) are part of groups based in the USA, so data may be transferred there. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or otherwise on the European Commission’s Standard Contractual Clauses.

8. How long we keep data

Account data: as long as your account exists. After you delete your account, it is deleted or anonymized within 30 days, except for what we must keep by law.
Projects and videos: deleted automatically 48 hours after rendering.
Session records: until the session expires, at most 30 days.
Billing and accounting records: 7 years, as required by Austrian tax law (§ 132 BAO).
Server logs: a short period, normally no more than 30 days, unless needed to investigate a security incident.
Support emails: up to 2 years after the conversation ends.

9. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on your consent, you can withdraw consent at any time with effect for the future.

To use these rights, email [email protected] from the address linked to your account. We answer within one month.

10. Complaints

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at. We would appreciate the chance to resolve your concern first, so please contact us.

11. Security

Passwords are never stored in readable form. We keep only a salted Argon2 hash. Session and one-time tokens are stored only as SHA-256 hashes. Connections to brollcut.com are encrypted with TLS (HTTPS). Forms are protected against cross-site request forgery, and sign-in attempts are rate-limited. Access to our servers is restricted to the operator. No system is completely secure. If a data breach affects you, we will inform you and the authority as the law requires.

12. Children

Brollcut is intended for adults (18+). We do not knowingly process data of children. If you believe a child has created an account, please contact us and we will delete it.

13. Changes to this policy

We update this policy when the Service or the law changes. The date at the top shows the current version. We will tell you about important changes by email or in the app.