OriginShorts ("we", "us", "our") operates the website originshorts.com and provides an AI-powered short-form video generation platform (the "Service"). This Privacy Policy explains how we collect, use, store, and share your personal information when you use the Service.
By using the Service, you agree to the collection and use of information as described in this Privacy Policy. Terms not defined here have the meanings given in our Terms of Service.
1. Information We Collect
Information You Provide
- Account information: Email address, username, and authentication credentials when you create an account (directly or via Google sign-in).
- Content you create: Scripts, topics, prompts, and generation settings you provide to create videos.
- Payment information: Processed by our payment provider (see Section 5). We do not store your credit card or bank details.
Information Collected Automatically
- Usage data: Pages visited, features used, video generation activity, credits consumed, and timestamps.
- Device and access data: IP address, browser type, and referring URLs. IP addresses are used for rate limiting (held in memory, not persisted) and may be logged at the infrastructure level as part of standard web server operation.
- Cookies: See Section 8.
2. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Process your video generation requests
- Manage your account and subscription
- Process payments and maintain transaction records
- Send transactional emails (account verification, password resets, subscription notifications, deletion confirmations)
- Send service-related notifications (e.g., automated series updates, low credit alerts)
- Monitor and enforce our Terms of Service
- Comply with legal obligations
We do not sell your personal information. We do not use your content to train our own AI models. Our AI service providers process your content solely to generate your videos, in accordance with their respective terms of service.
3. Legal Basis for Processing (EEA/UK Users)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
- Contract performance: Account management, video generation, payment processing, and transactional communications are necessary to provide the Service you requested.
- Legitimate interests: Usage analytics, security monitoring, rate limiting, and service improvement, where these interests are not overridden by your rights.
- Legal obligation: Retaining financial records and responding to lawful requests.
- Consent: Where applicable, such as optional analytics cookies. You may withdraw consent at any time.
4. Data Sharing
We do not share your personal information with third parties except as described below.
Service Providers
We use third-party service providers to operate the Service. These providers process data on our behalf under contractual obligations and are not permitted to use your data for their own purposes. Categories of providers include:
- AI content generation providers (US-based): We send your scripts, topics, and generation prompts to AI service providers to generate text, images, audio, and video. No personally identifiable information (such as your email or user ID) is sent to these providers.
- Payment processor (UK-based): Our merchant of record processes payments, manages subscriptions, and handles tax compliance. They receive your email address, subscription plan, and billing information.
- Cloud storage provider (global): Generated media files (videos, images, audio, thumbnails) are stored with a cloud storage provider. File metadata does not contain personally identifiable information.
- Email delivery provider (US-based): Transactional emails are sent through a third-party email service, which receives your email address and message content.
- Analytics provider (US-based): We use Google Analytics to collect aggregate usage statistics such as page views and traffic sources. This service operates subject to your cookie consent.
- Authentication provider (US-based): If you sign in with Google, we receive your email address and email verification status through Google OAuth. We request only the profile and email scopes.
- Font and CDN providers: Third-party services deliver fonts and media assets. Standard web requests (including your IP address) are visible to these providers.
Legal Requirements
We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of OriginShorts, our users, or the public.
5. International Data Transfers
Our service providers are located in the United States, United Kingdom, and the European Union, with some operating globally via content delivery networks. If you are located outside these regions, your data may be transferred to and processed in countries with different data protection laws than your own. We rely on appropriate safeguards for such transfers, including standard contractual clauses where required.
6. Data Retention
- Account data: Retained until you delete your account.
- Videos and media files: Retained until you delete your account.
- Activity logs: Retained until you delete your account.
- Financial transaction records: Anonymized upon account deletion (user identifier replaced with a placeholder) and retained for financial and legal compliance purposes.
- System logs: May be partially retained for security and audit purposes.
- Aggregate analytics: Retained indefinitely. These are statistical summaries not linked to individual users.
Account Deletion
You can delete your account at any time through your account settings or by contacting us at [email protected]. When you request deletion:
- Your subscription is cancelled immediately.
- All active sessions are invalidated.
- A 30-day grace period begins, during which you may reactivate your account.
- You will receive a reminder email 5 days before permanent deletion.
- After 30 days, your account, videos, media files, activity logs, and authentication records are permanently deleted.
- Financial transaction records are anonymized and retained for compliance.
- A confirmation email is sent upon completion.
7. Your Rights
All Users
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate personal information
- Delete your account and associated data
- Request a copy of your data in a portable format
EEA/UK Users (GDPR)
In addition, you have the right to:
- Restrict processing of your personal data
- Object to processing based on legitimate interests
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local data protection authority
California Users (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Request deletion of your personal information
- Opt out of the sale or sharing of personal information (we do not sell or share your personal information as defined by the CCPA)
- Non-discrimination for exercising your privacy rights
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (generally within 30 days for GDPR or 45 days for CCPA requests).
8. Cookies
We use the following cookies and similar technologies:
- Session cookie: Required for authentication. Expires on logout or session timeout.
- OAuth state cookie: Used during Google sign-in to prevent cross-site request forgery. Short-lived.
- Cookie consent cookie: Stores your cookie preferences. Persistent.
- Analytics cookies (optional): Google Analytics cookies are set only if you consent through our cookie banner.
You can manage your cookie preferences through the cookie consent banner displayed on our website.
9. Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Users between 13 and 18 must have parental or guardian consent to use the Service, as stated in our Terms of Service. If we become aware that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].
10. Security
We use commercially reasonable technical and organizational measures to help protect your personal information, including encrypted data transmission, secure authentication, session management, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of changes by posting the updated policy on this page with a revised "last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.