Your data,
handled honestly.

• Account email — via Google OAuth or email credentials through NextAuth.
• Uploaded clips and audio you provide to the editor.
• Auto-generated transcripts produced from your clips by our AI pipeline.
• Final exported MP4s rendered through our Remotion Lambda pipeline.
• Usage data — analyses run, exports made, credits consumed (used for billing and quota enforcement).
• Error logs via Sentry with PII scrubbed (no email, no IP, no session tokens).

We share only what is required for each service to function. We never sell your data.

• OpenAI — Whisper transcription + GPT-4o-mini visual concept extraction.
• AWS Bedrock (Anthropic Claude Haiku) — content analysis + editor synthesis.
• Cloudflare R2 — encrypted storage for your video assets.
• Vercel — frontend hosting.
• Railway — backend hosting.
• Supabase — account database.
• Dodo Payments — payments and tax. Dodo is the seller of record on your invoice and handles VAT/GST/sales tax globally.
• Sentry — error monitoring (PII-scrubbed).
• Vercel Analytics & Speed Insights — privacy-friendly, cookieless traffic and performance metrics. Aggregated; no cross-site tracking.
• PostHog (when enabled) — product analytics and session replay, to understand how features are used. Linked to your account id only once you are signed in; configured to avoid capturing sensitive input fields.
• Google Analytics (when enabled) — aggregate traffic measurement. Uses cookies (see Cookies below).
• Pexels, Brandfetch, Wikipedia, Unsplash — read-only stock asset fetches. No user data is sent to these. Assets they return are royalty-free / free to use; see our Terms for how stock assets and your own uploads are licensed.

• Free tier — clips and exports are deleted 14 days after upload.
• Paid tiers — deleted when you delete the project or your account.
• Account email and billing records — kept while your subscription is active. Financial records are retained for a minimum of 7 years per applicable law.
• Sentry logs — 90-day rolling retention.

We aim to honor GDPR- and CCPA-style data rights for all users globally, regardless of jurisdiction. We do our best in good faith.

• Legal basis (EEA / UK) — we process your data to perform our contract with you (running the Service), on your consent (where we ask for it, e.g. optional analytics), and our legitimate interests (security, abuse prevention, and improving the product), balanced against your rights.
• Access — request a copy of your data via privacy@editorop.com.
• Deletion — delete from account settings. Kills all videos and exports. Billing records are retained per law.
• Portability — download your finished video as an MP4, plus an SRT caption file.
• Correction — update your account email from settings.
• Object, restrict & withdraw consent — you can object to or restrict processing, and withdraw any consent you gave, at any time.
• California (CCPA / CPRA) — you have the right to know, delete, and correct your personal information, and to opt out of its "sale" or "sharing." We do not sell or share your personal information, and we will never discriminate against you for exercising any privacy right.
• Children — EditorOP is for adults (18+). We do not knowingly collect data from anyone under 18; tell us if you believe a minor signed up and we will delete it.
• Complaints — EEA / UK users may lodge a complaint with their local data protection authority. We'd appreciate the chance to put things right first.

• NextAuth session cookies — required for sign-in. HTTP-only, secure, SameSite.
• Sentry error context — anonymized debugging session ID.
• Analytics & product cookies — our default traffic analytics (Vercel) are cookieless. Where enabled, PostHog and Google Analytics may set cookies or use local storage to measure usage. We use no advertising or cross-site-tracking cookies, and we never sell your data.
• Essential sign-in and security cookies always remain. To opt out of optional product analytics, email privacy@editorop.com.

EditorOP is operated from India; for data-protection purposes the data controller is EditorOP (contact privacy@editorop.com). Data is processed in the United States and India (AWS, OpenAI, Sentry, Cloudflare edges, and our hosting). EEA / UK users acknowledge this international transfer when signing up; we rely on Standard Contractual Clauses with our sub-processors where applicable.

We'll notify users by email for any material changes, with at least 30 days notice. Continued use of the Service after the effective date constitutes acceptance.

For privacy questions or data requests, email privacy@editorop.com. For security issues, see our Security page.