Privacy Policy

Last updated: 16 October 2026

This policy describes the personal data processed by MomentCut, why, with which subcontractors, for how long, and your rights under the General Data Protection Regulation (GDPR). The French version prevails in case of discrepancy.

1. Data controller

2. Data processed and purposes

E-mails. Service e-mails are always sent, because the account needs them or the law requires them: sign-in code or link, account deletion confirmation, warning before an inactive account is deleted, notice before an annual subscription renews. Payment receipts and invoices are issued by Freemius. Commercial e-mails (offers, discounts) are only sent if you ticked the box provided for that purpose, unticked by default, at sign-up or in “My account”; you can unsubscribe at any time with the link in every offer e-mail or by unticking the box in “My account”.

We do not sell your data and do not use it for third-party advertising. No profiling or automated decision-making with legal effects is carried out.

3. Subcontractors and recipients

• Cloudflare (Cloudflare, Inc., United States, with infrastructure in the European Union): hosting of the application (Workers), database (D1) and storage of videos, transcripts and exports (R2). Transfers are governed by standard contractual clauses and the EU-US Data Privacy Framework.
• Hetzner Online GmbH (Germany): processing server that temporarily downloads the video to transcribe it and assemble exported clips. Working files are deleted at the end of each task; only a technical copy of the source video, so that it is not downloaded again for every export, and a lightweight copy of that video (picture scaled down to 640 pixels on its longest side, 2 frames per second, mono sound), used to detect shot changes and for the “picture + sound” video analysis, are kept on this server. They are deleted at the latest 24 hours after it was last used and, if you delete the project or your account, within minutes (at most four hours if the server is finishing a task in progress).
• Groq API (Groq, Inc., United States): speech-to-text transcription with timestamps (Whisper large v3 turbo model), used for every analysis run on our server. Only the audio track is sent, extracted on our server and sent in 10-minute slices over an encrypted connection (HTTPS): neither the video itself, nor the file name, nor any of your account data (e-mail address, name, identifiers) is sent. If Groq is unavailable, transcription is carried out directly on our server at Hetzner. The transfer to the United States is governed by the European Commission’s standard contractual clauses. The data sent is processed under Groq’s terms applicable to data submitted to its API; please refer to Groq’s terms and privacy policy for details, which may change.
• Brevo (Sendinblue SAS, France): sending sign-in and service e-mails (including the renewal notice for annual subscriptions) and, if you asked for them, our offers.
• Sign in with Google (Google Ireland Ltd / Google LLC): only if you choose “Continue with Google”. Google authenticates you on its own pages and then sends us the data described in section 2 (“openid email profile” scope); for this authentication it acts as a separate controller, under its own terms and privacy policy. You can remove MomentCut’s access at any time from your Google account settings; sign-in with an e-mail code always remains available.
• Google Gemini API (Google LLC / Google Ireland Ltd): analysis of transcripts to select the best passages and draft the suggested texts. When you explicitly start the “picture + sound” video analysis, the lightweight copy of the video (640 pixels, 2 frames per second; the source video itself only if that copy could not be made) is temporarily sent to Google for analysis, and the uploaded copy is deleted once the analysis ends. Under the terms applicable to the paid Gemini API we use, Google states that it does not use submitted content to train or improve its models; please refer to Google’s terms and privacy policy for details, which may change.
• Freemius (Freemius, Inc., United States): reseller (“Merchant of Record”) that processes payments, invoices and refunds. Freemius collects your billing data (name, address, country, payment method) directly, as controller for the transaction; MomentCut neither receives nor stores card numbers, and only receives from Freemius the notifications needed to link the purchase to an account (e-mail address and customer identifier, name, item, amount, billing country, transaction identifiers), kept for at most 90 days. Transfer to the United States governed by the European Commission’s standard contractual clauses. See Freemius’s privacy policy.

Data may also be disclosed to authorities where required by law.

4. Retention periods

• Sign-in link: 15 minutes, single use. Session: 30 days after the last sign-in.
• Source video: automatically deleted after 30 days without use of the project (opening, editing or export) (clips, captions and texts are kept in the project), or as soon as you delete the project. The technical copy and the lightweight copy kept by the processing server (see Hetzner above) disappear at the latest 24 hours after it was last used, and within minutes of the project being deleted (at most four hours if a task is in progress).
• Exported files: 7 days after creation.
• Copy of the video sent to Google for video analysis: deleted when the analysis ends.
• Audio slices sent to Groq for transcription: deleted from our server at the end of the task; on Groq’s side, they are processed under Groq’s terms applicable to data submitted to its API.
• Projects, transcripts and account: until you delete them (immediately, from “My account” in the client area) or after 24 months without any activity on the account. A warning e-mail is sent 30 days before that inactivity deletion: simply signing in again keeps the account. An account with a running subscription or a running entitlement is never deleted for inactivity.
• Offers: the offer and the record of its sending are erased with the account. An objection to offers is kept (fingerprint of the address and date) so that it is still honoured if the address comes back.
• Billing data: statutory retention period for accounting records (10 years in France), at Freemius and in our records.
• Technical logs: 90 days at most, automatic purge included: payment events received from Freemius (whether or not linked to an account), the transcription and export job log, sign-in tokens, the per-IP anti-abuse counters (which only hold a fingerprint of the address and are erased after 24 hours), and the per-IP sign-up counter (one fingerprint of the address per account created, erased after 7 days: it limits how many accounts can be opened from the same connection).
• Anti-abuse fingerprint of the sign-up address: kept with no time limit, including after the account is deleted, because it is the only thing that stops the free trial from being recharged by deleting and recreating an account. That row holds neither your address nor anything that could identify or contact you: only an irreversible cryptographic fingerprint of the address, the number of sign-ups and the trial minutes already used. Write to us if you believe you lost the benefit of the trial unfairly: we can erase that row.
• Device identifier: on first sign-in, the site sets a random identifier in your browser (the mc_device cookie, two years) that holds no data about you and is never shared with anyone. We only keep an irreversible fingerprint of it, linked to the accounts created from that browser, together with the trial minutes already used: free accounts opened from the same device share a single trial offer. That fingerprint outlives account deletion, for the same reason as the previous one, and can be erased on request.
• Administration action log (granted credit, granted plan, suspension, account deletion, trial restoration) and renewal notices sent: 5 years. This log has evidential value (it lets us demonstrate that a request, in particular an erasure request, was actually carried out) and is therefore kept beyond the 90 days of the other logs. It holds the action, its date, its reason and the e-mail address concerned, never the content of your projects. Nobody can alter it from the interface.

5. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to set instructions regarding your data after your death.

From your account, without writing to us: the “My account” section of the client area lets you download all of your data as a JSON file (account, projects and their metadata, transcripts, clips, usage, subscription; the video files themselves are not included and remain downloadable from the studio while they are still available) and permanently delete your account. Deletion is immediate and irreversible: uploaded videos, projects, transcripts, clips, exported files, sessions and subscription entitlements are erased; any copies of a video (technical and lightweight) kept by the processing server are erased within minutes (at most four hours if a task is in progress there). What remains carries no link to your identity: the minutes already used (attached to an anonymous account so that our counters stay accurate), an irreversible fingerprint of your address together with the trial minutes already used (it keeps the free offer to one sign-up per address and cannot identify or contact you), the billing records for their statutory retention period, and the administration log entry evidencing the deletion. A confirmation e-mail is sent to you.

If a subscription is running, it must first be cancelled from the customer portal available in the client area: deleting the account does not stop the subscription, and Freemius would keep charging you. Deletion becomes available again as soon as the subscription is cancelled or has run out. If the paid period is still running, it is lost with the account, with no refund of the remaining period; a refund request provided for by the Refund Policy (in particular within 14 days of the first payment) must be made before deletion.

You may also exercise these rights by writing to contact@momentcut.co from your account’s e-mail address; we reply within one month. You may also lodge a complaint with the CNIL (cnil.fr) or the supervisory authority of your country of residence.

6. Cookies

MomentCut only uses strictly necessary cookies and storage: the mc_session session cookie (sign-in, 30 days, HttpOnly) and a language preference kept in your browser’s local storage. No advertising cookies or third-party analytics are set, so no consent banner is required. The sign-in form also uses the mc_device cookie described in section 4 (device identifier, two years, HttpOnly), a copy of that identifier in the browser’s local storage and, when enabled, the Cloudflare Turnstile service, which checks that a code request comes from a person rather than a script (without that check, a code is only sent to an address that already has an account) and may set its own technical cookie for the duration of the check. Signing in with Google uses the mc_google cookie (10 minutes at most, HttpOnly, signed), which protects the round trip to Google against tampering; it is deleted on return. These elements serve only to secure authentication and limit abuse of the free offer; they are exempt from consent (Article 82 of the French Data Protection Act, CNIL guidelines on trackers) and are used neither for advertising nor for audience measurement. During checkout, on the checkout page hosted by Freemius, it may set its own cookies, under its own policy.

7. Security

Traffic is encrypted (HTTPS), sign-in tokens are stored hashed, files are kept in a private space linked to your account and the processing server authenticates to the application with a dedicated secret. In the event of a data breach likely to result in a risk to your rights, we will inform you in accordance with the GDPR.

8. Minors

The service is intended for adults or minors with their legal guardian’s permission. We do not knowingly collect data from children under 15.

9. Changes

This policy may be updated; the date at the top of the page shows the latest version. Material changes are announced by e-mail or on the site.

10. Contact

For any question about your data: contact@momentcut.co.