SKIP TO CONTENT ↓
EARLY ACCESS · IN TRAININGSIGN INOpenMake your first short
Open

LEGAL

Privacy Policy

EFFECTIVE DATE: JULY 16, 2026

WHAT CHANGED (JULY 16, 2026): Section 2 now describes edit-decisions sharing and the Training Circle as two live, separate programs, and states the Studio/enterprise process-capture exclusion; Section 3.6 adds edit-interaction data; Section 4 adds the Training RCM 1 purpose; Section 7 adds training-copy retention and consent-ledger survival after account deletion; Section 8 clarifies withdrawal locations; Sections 3.1, 5, and 10 correct the authentication provider to Better Auth (Google/Facebook sign-in).

1. Who We Are

Real Cut is an automated video editing service: you upload raw footage, and RCM 1 — our own editing model — returns an edited cut. Your personal data is processed by:

Company: NotBW d.o.o., Ljubljana, Slovenia

VAT Number: SI97958328

Data Controller: Žan Bassanese

Contact: zan@realcut.ai

2. The Training Promise

Your footage is never used to train RCM 1.

Not your uploads, not your edited cuts, not your Google Drive imports.

What trains RCM 1. RCM 1 is trained on our own edits, paid narrated editing sessions, licensed footage, and data customers explicitly choose to share. Nothing is scraped. RCM 1 learns to see and decide like an editor. We will never generate videos from your footage, and we will never clone you — not your face, not your voice, not your likeness. What we capture, when you choose to share it, are perception signals connected to reasoning and decision-making during editing: what was looked at, what was marked, what changed, in what order, and why. Your pixels are never generative training material — under any plan, ever.

Two sharing programs exist, both off until you turn them on:

(1) Edit-decisions sharing— the timing and structure choices you make when refining a cut: your notes, the parts you mark, and the before/after of the edit’s structure. Never your footage, never your audio. Available on every personal plan. New accounts make this choice at sign-up — an explicit choice, with no preselected answer — and anyone can switch it on or off at any time in Settings → Data. Declining changes nothing about your product. Sharing is never retroactive: it applies from the moment you turn it on, and nothing you did before that moment becomes training data.

(2) The Training Circle — a per-project exchange where your footage and both edits become training data and a paid, credited human editor also cuts your project, free. It has its own consent step, asked per project — never at sign-up. Your footage is never used to train RCM 1 outside the Training Circle — under any plan, ever.

Studio and enterprise accounts: we don’t train on any of your data, full stop — no toggle exists because nothing is collected to toggle. API and MCP usage is never used for training unless your organization explicitly opts in (personal-plan keys only).

Withdrawing stops all future use within 30 days and removes your data from the training library; an already-trained model version can’t unlearn, and we say so up front. A change to this section’s terms never silently re-applies a choice you made under older terms — we ask again.

Friends-of-the-founder test accounts and paid editors work under separate, explicit agreements that make their sessions — including narration when the microphone is on — part of the training library; that is what those programs are for. When one of our own editors works on a personal account’s footage that has not joined the Training Circle, we may use the editing process itself to improve RCM 1: the editor’s narration, the sequence of editing decisions, and the timecodes they refer to. Your footage — the pixels and the audio, including every proxy copy — is stripped from that record before any training use. The editor’s commentary is scrubbed of personal identifiers and is never used to identify anyone, and you can decline even this process capture in Settings → Data. Editing sessions on Studio and enterprise footage are excluded from even this process capture. Nothing in this paragraph touches the footage promise above.

To operate and improve the Service we do use limited technical data — error logs, processing timings, feature usage — none of which contains your media. Section 4 describes this.

3. What We Collect

3.1 Account information

  • Name and email address, received from Google or Facebook when you sign in
  • User ID and authentication session data
  • Account creation and activity timestamps

3.2 Your content

  • Videos and audio you upload, stored and processed by Mux
  • Images, documents, and finished cuts, stored on Cloudflare R2
  • Files you select for import from Google Drive
  • Editing instructions, notes, and project settings

Your content is processed automatically by RCM 1 to produce your cuts. It is used only to provide the Service to you (see Section 2).

3.3 Google Drive data (optional)

If you choose to import files from Google Drive, we request the per-file scope:

https://www.googleapis.com/auth/drive.file

This permission allows us to:

  • Display files and metadata inside the folders you select
  • Let you choose which files to import
  • Download only the files you explicitly select
  • Transfer the selected files securely to our storage for editing

We do not:

  • Access folders you did not select
  • Modify, delete, or create files in your Drive
  • Store your Google Drive credentials
  • Use Drive content for marketing, analytics, or model training

This integration complies with the Google API Services User Data Policy, including its Limited Use requirements. See the Google Drive Data Disclosure.

3.4 Technical and usage data

  • IP address and approximate location (country level)
  • Browser, operating system, and device type
  • Pages visited and feature interactions, collected by our own first-party analytics
  • Error logs and processing telemetry
  • Content-free counters about refine interactions — how many rounds, note lengths, languages, outcomes — never the text or the media itself

If you consent to marketing cookies, the Meta pixel also collects events on our site (see Section 6).

3.5 Payment information

Payments are processed by Stripe. We receive transaction details, billing history, and payment status. We do not store card numbers or other sensitive payment credentials.

3.6 Edit-interaction data (only if you share it)

If — and only if — you turn on edit-decisions sharing (Section 2), we keep training copies of perception signals from your editing sessions: the actions you take on the timeline, the notes and instructions you write when refining a cut, the parts you mark, and the before/after structure of each edit (the cut’s timing document — never the media itself). The same rule applies on every channel: the web app, the MCP server (when you edit through your own AI agent), the REST API, and any plugin or integration we ship later. For API and MCP keys, sharing is off by default and can be turned on only by an explicit organization-level opt-in; business plans are never offered it. Transcripts follow the media they transcribe: if the footage isn’t shared, neither is its transcript. This data identifies decisions, not people: we never build face or speaker identification from anything in the training library.

4. Why We Process Data

We process your data for the following purposes:

Providing the Service (performance of contract)

  • Storing your uploads, running RCM 1 on them, and delivering cuts and revisions
  • Authenticating you and managing your account and projects
  • Processing subscriptions and credit purchases

Operating and improving the Service (legitimate interest)

  • Diagnosing errors and keeping the Service reliable and secure
  • Understanding which features are used, through aggregate usage data
  • Preventing fraud and abuse

Improvement work uses technical and usage data, never your media (Section 2).

Training RCM 1 (consent)

  • Edit-decisions sharing, if you turned it on at sign-up or in Settings → Data (Section 2)
  • The Training Circle, per project you enrolled (Section 2)
  • You can withdraw either at any time; withdrawal stops all future training use within 30 days

Communication (performance of contract, legitimate interest)

  • Service notifications, such as a cut being ready
  • Responding to your messages

Advertising measurement (consent)

  • Measuring ad performance with the Meta pixel, only if you accept marketing cookies

Legal compliance (legal obligation)

  • Accounting, tax, and other statutory record keeping

5. Who Processes Data For Us

We share data only with the processors needed to run the Service:

  • Vercel — application hosting
  • Supabase — database hosting
  • Mux — video and audio processing and streaming
  • Cloudflare R2 — file storage
  • Stripe — payment processing
  • Google — authentication, only if you sign in with Google
  • Meta — authentication if you sign in with Facebook, and advertising measurement only with your consent (Section 6)

Each provider processes data under contractual safeguards. Meta acts as an independent controller for the data it receives; the others act on our instructions.

6. Cookies and the Meta Pixel

We use cookies for sign-in, referral attribution, and — with your consent — analytics and advertising measurement. The full list is in our Cookie Policy.

If you accept marketing cookies, the Meta pixel records events on our site (pages visited, actions such as starting an upload) together with cookie identifiers (_fbp, _fbc), device information, and IP address. Meta uses this data under its own privacy policy to measure and improve ad delivery.

You can withdraw consent at any time via:

7. Retention and Deletion

Projects and media

Deleting a project deletes the media in that project from our storage. Media is kept only as long as needed to provide the Service. On the Free plan, an inactive project’s media becomes eligible for deletion 60 days after your last activity on it. If a paid subscription lapses, its media becomes eligible for deletion 30 days after the lapse; media on an active paid subscription is retained. This process never deletes consent records, edit decisions, or accounting records.

Account data

Kept while your account is active. When you delete your account, your data — including all uploads and cuts — is deleted within 30 days.

Google Drive imports

Only the files you explicitly selected are stored; they follow the same deletion rules as other media, or earlier upon request.

Usage analytics

Aggregated or deleted after 2 years.

Training copies (data you chose to share)

Kept while your consent is active; excised from all future training runs within 30 days of withdrawal. Deleting your account withdraws every training consent automatically. Honest limit, stated up front: an already-trained model version can’t unlearn, but your data never appears in any future run. We keep the minimal consent ledger — your choices, their timestamps, and the exact text you saw, never your media — after account deletion, as proof of how your data was handled.

Payment records

Retained as long as accounting and tax law requires.

You can request earlier deletion of any of your data at zan@realcut.ai.

8. Your Rights Under GDPR

If you are in the EEA or the UK, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Have your data deleted
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent at any time, where processing is based on consent

For edit-decisions sharing, withdrawal is also available in-product — Settings → Data — and is exactly as easy as granting was. Training Circle withdrawal is per project, on that project’s Training Circle card, exactly as easy as enrolling was.

To exercise any of these rights, email zan@realcut.ai. We respond within 30 days.

9. US State Privacy Rights (including CCPA)

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, to access and correct it, to request its deletion, and to opt out of the sale or sharing of personal information.

We do not sell your personal information. If you accept marketing cookies, data sent to Meta for ad measurement may count as "sharing" under California law; you can opt out at any time through Cookie Settings in the site footer, and no consent means no sharing.

We do not discriminate against you for exercising these rights. To make a request, email zan@realcut.ai.

10. Security

  • Data is encrypted in transit (HTTPS/TLS)
  • Storage access is controlled and scoped per service
  • Authentication is handled by Better Auth, our own first-party authentication system, via sign-in with Google or Facebook; we never see or store your password
  • Access to production systems is restricted and logged
  • Training copies of data you choose to share (Section 2) are held on our own controller-operated infrastructure, never a third-party processor

No method is completely secure. If we learn of a breach affecting your data, we will notify you as the law requires.

11. International Data Transfers

We are a Slovenian company serving customers primarily in the United States and Canada. Your data is processed both inside and outside the EEA, including in the United States, by the processors listed in Section 5.

Transfers outside the EEA rely on:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions, including the EU-US Data Privacy Framework where the provider is certified

12. Children

The Service is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy as the Service develops. We will update the effective date at the top of this page and notify you by email of material changes. A change to the training promise in Section 2 would never be made silently; it would require your explicit opt-in.

14. Contact and Supervisory Authority

Email: zan@realcut.ai

Company: NotBW d.o.o., Ljubljana, Slovenia

Data Controller: Žan Bassanese

VAT: SI97958328

If you believe your data rights were not respected, you may lodge a complaint with your local data protection authority. For Slovenia, this is the Information Commissioner of Slovenia (ip-rs.si).

Questions: zan@realcut.ai