Personal Data Processing Policy AICutter

1. General provisions and scope of application

1.1. The Policy defines the goals, grounds and procedure for processing personal data when using https://aicutter.app, account creation, working with projects, payment and support requests. The operator and his contact details are listed in section 14.

1.2. The Policy has been compiled taking into account Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" and other applicable requirements. It is publicly available and is valid for processing performed by the Operator. Processing on independently visited payment sites and other external services is also regulated by their documents.

1.3. The data necessary for certain legitimate purposes are processed. Provision of redundant information is not required. The service is not intended for self-registration of minors.

2. Basic concepts

2.1. Personal data — information relating directly or indirectly to a specific or identifiable natural person. Processing includes actions with such information with or without automation.

2.2. User content — downloadable files, AI tasks, transcripts, installation documents and results. Such content may contain information about people; the presence of copyright on the video by itself does not determine all the grounds for processing personal data.

2.3. Depersonalization should prevent the identification of a specific person without additional information. Shrinking the image, changing the file format, or deleting only the name does not guarantee depersonalization.

3. Data goals and categories

3.1. Account and authorization: user name or selected designation, email, secure password hash, account ID, email confirmation and session information. The goal is to create an account, log in, secure access and execute the contract.

3.2. Task completion: video and audio, technical information about files, selected frames, speech transcription, task description, editing document, processing history and results. The goal is to perform user—selected editor functions and provide the result.

3.3. Payment and accounting: order and payment identifiers, amount, package, payment or refund status, movement of units on the balance sheet and information provided by law for the receipt. The full bank card number and security code AICutter are not stored.

3.4. Support and protection of rights: email, content of the request, relevant identifiers and confirmations provided. The goal is to answer, correct an error, verify account ownership, fulfill a requirement, or resolve a dispute.

3.5. Security and confirmation of actions: technical information about requests, IP address when accessing the server, browser settings, time of events, errors, information about the acceptance of documents. The scope is determined by the need to protect the service and evidence of appropriate actions.

4. Legal grounds

4.1. The data required for registration and execution of the agreement selected by the user are processed on the basis of conclusion and execution of the agreement on the initiative of the data subject, including paragraph 5 of part 1 of Article 6 of Federal Law No. 152-FZ.

4.2. Compulsory accounting, tax and other statutory accounting shall be carried out on the appropriate legal basis. When a specific processing requires consent, the Operator receives independent, specific and informed consent. The text of such a document is posted on a separate page.

4.3. Acceptance of the offer and familiarization with the policy does not mean consent to any processing, advertising, dissemination of information or transfer of data to other people. Each additional goal requires its own applicable basis. This policy is not consent in itself.

5. Principles and operations of processing

5.1. The Operator restricts processing to the stated goals, ensures proportionality of the data composition, takes measures to clarify inaccurate information and stops processing after achieving the goal, unless there is another legal basis.

5.2. Collection, recording, systematization, accumulation, storage, clarification, extraction, use, provision of access to authorized persons, transfer for assignment execution, depersonalization, blocking, deletion and destruction are carried out to the required extent.

5.3. Project materials are available through account ownership checks. They do not become public due to the download. Publishing in the public gallery, using the service in advertising, and training the Operator's own models on user materials are not included in the goals of regular work with the project.

6. User materials and information of third parties

6.1. The User is obliged to verify the legality of the source footage and delete redundant data, documents, payment details and legally protected secrets. Consent to the processing of your account data is not the consent of the persons depicted in the frame or mentioned in the speech.

6.2. The Service is not intended for identification by face or voice, making decisions about a person based on biometrics or processing special categories of data. The user should not send medical information and other special categories of data to tasks and files.

6.3. Before using external AI modes, it is necessary to delete or securely depersonalize identifying information in images, speech, texts, file names and metadata. If a specific operation involves the processing of personal data by an external provider, it is permissible only if there are legal grounds and the applicable requirements are met.

6.4. Violation of the rules by the user does not create the consent of another person and does not release the Operator from his own duties. If illegal processing is detected, the Operator has the right to restrict access, stop further processing and take measures provided for by law.

7. Data recipients and external technologies

7.1. The hosting provider's infrastructure and storage are used to host the service. Access is provided to the extent necessary for the operation, protection and maintenance of the service. Personal data is not sold for independent advertising use.

7.2. During automatic video editing, depending on the mode, the task, decryption, selected reduced frames and technical parameters are transferred to external AI services. The current route also uses OpenRouter the providers of the selected models. In separately available functions, for example, voice or audio preparation, Kie can be used. The composition of the data is determined by the selected function.

7.3. Local speech recognition is performed in the service infrastructure. If a configured remote speech recognition server is used, the audio required for this operation is transmitted to it. Email, password hash, and bank card information are not necessary inputs for scene selection or speech recognition.

7.4. The YUKASSA payment service and the connected means of generating checks are provided with the necessary information for payment, refund and mandatory accounting. In cases provided for by law, information may be provided to authorized state bodies.

7.5. The transfer or order of processing is executed on the applicable legal basis, taking into account the obligations of the recipient and the required amount of data. The involvement of an external service does not cancel the Operator's obligations to the data subject.

8. Localization and cross-border transfer

8.1. When collecting data of citizens of the Russian Federation, the primary recording, systematization, accumulation, storage, clarification and extraction are carried out using databases on the territory of the Russian Federation in cases established by law.

8.2. External AI suppliers may be located outside the Russian Federation. The transfer of identifying content to them may be a cross-border transfer of personal data. The indication of a foreign supplier in the policy or the user's mark during registration by themselves does not replace the requirements for such a transfer.

8.3. Prior to the cross-border transfer, the conditions provided for by law must be fulfilled, including an assessment of the grounds, necessary notifications and compliance with the restrictions of the authorized body. In the absence of the necessary conditions, the processing of personal data by the appropriate external route is not allowed; impersonal material should be used for the AI task.

9. Cookies and local settings

9.1. Technical session cookie provides login and account protection; its validity period is up to 30 days. The aicutter-language cookie stores the selected language for up to one year. When logging in for the first time, the browser language and the Yandex Browser attribute are taken into account; manual selection takes priority.

9.2. The theme, interface settings and confirmation of the cookie information message can be stored in the browser's local storage; information for continuing work or placing an order can be stored in the session storage. This data can be deleted using the browser, which may require re-logging in or selecting settings.

9.3. Built-in advertising trackers are not used. If optional analytics or marketing processing is introduced, separate conditions and applicable grounds should be defined for it. Confirmation of a technical cookie message does not constitute consent to an advertising newsletter.

10. Shelf life and disposal

10.1. Account data is stored during the use of the service and further only to the extent and for a period justified by law, unfulfilled obligations or the need to protect specific rights. Storage for uncertain future purposes is not provided.

10.2. The project and its working materials are stored until the user deletes or terminates the legal basis for storage. Before deleting a project, the active task must be canceled and wait for it to stop. You can request account deletion via support after checking the affiliation.

10.3. Information on payments, refunds, accepted documents and disputed transactions may be stored within the statutory time limits for mandatory accounting and protection of rights. They do not continue to be used for incompatible purposes just because they are saved for accounting.

10.4. After removal from the existing repository, certain information may temporarily remain in backup copies until they are replaced or deleted. Access to copies is restricted; when restoring, previously fulfilled deletion and blocking requirements must be taken into account. The legal deadlines for termination of processing also apply to working with backups.

10.5. Upon withdrawal of consent, processing based on it is terminated and the data is destroyed within the time limits established by law, if there is no independent legal basis for continuation. The revocation does not make illegal the processing that was lawfully performed before it.

11. Data protection and incidents

11.1. Access control, verification of the owner of projects and files, password hashing, secure sessions and HTTPS are applied. Access is granted to authorized persons in the scope of their tasks. Security measures are reviewed taking into account the nature of the data and current threats.

11.2. When an incident is detected, the Operator takes measures to stop the violation, establish the causes, reduce the consequences and fulfill the obligations provided for by law to notify authorized bodies and affected persons. Absolute invulnerability of information systems is not promised.

12. Subject's rights and treatment procedure

12.1. The Subject has the right to obtain information about the processing of its data, request clarification, blocking or destruction if there are grounds, withdraw consent and appeal the Operator's actions to Roskomnadzor or the court.

12.2. The request is sent to the e-mail from section 14. Specify the account's email address, the essence of the requirement and the information that allows you to establish a connection with the corresponding processing. To protect against an unauthorized request, the Operator has the right to request the necessary confirmation of authority; password and full card details are not required.

12.3. Requests shall be considered within the time limits prescribed by law for the relevant requirement. If an extension is permissible, it is accompanied by a reasoned notification. If execution is impossible, the grounds for refusal are reported in accordance with the established procedure.

13. Policy Update

13.1. The current edition contains the date and number. The new edition does not retroactively replace the saved confirmation of the previously accepted document and does not automatically extend the previously granted consent.

13.2. If a new goal requires a separate consent or other legal basis, the publication of the policy is not sufficient. The Russian text is the original version; translations help to familiarize with the terms and conditions and do not cancel the mandatory rights of data subjects.

14. Operator details

ИП Ярославцев Владислав Александрович

INN: 613304590712 · OGRNIP: 326619600051171

Website: https://aicutter.app. E-mail for requests about personal data, account deletion and withdrawal of consent: contact@aicutter.app.

Contact channels · Public offer · Separate consent.