Privacy Policy

Controller

Lucas Scariot, French sole trader (micro-entrepreneur), 5 Square Laperrine, 89000 Auxerre, France — SIREN 833 441 066 — SIRET 833 441 066 00028 — registered with the RNE, not the RCS — VAT FR91833441066. Data contact: support@onecut.mov.

Data, purposes, bases and periods

OneCut processes email addresses, the Google identifier, name and avatar supplied by Google, the OneCut user ID and session, the chosen profile and handle, video files, thumbnails, filenames, captions, colour profiles, edit and visibility choices, review decisions, job and payment references, download history, consented attribution, funnel events and technical logs.

• Contract: authenticate, manage the account and library, create, charge, render, deliver, share or publish according to the user's choice, notify, refund and process withdrawal.
• Legitimate interests: secure the service, moderate publications, prevent fraud, diagnose failures and defend legal claims.
• Consent: measure the funnel and attribution only after opt-in, withdrawable at any time.
• Legal obligation: invoices and required accounting evidence for 10 years.
• Incomplete, cancelled and failed uploads: immediately or within 24 hours; completed source clips: 24 hours; anonymous output: 7 days; an account's finished video: until deletion; trash and an account pending deletion: 30 days; operational identifying data: minimised after 90 days; consented events: at most 13 months; Cloud Logging: 30 days.

Recipients and transfers

Need-to-know recipients and processors are Google Identity (authentication), Google Cloud (hosting and processing; media in europe-west1), Google Analytics (consent-based audience measurement), Stripe (payment, currency conversion, fraud and refunds), and Mailgun (contract email; the current configuration uses its US API endpoint). Public profile information and public videos are available to everyone; an unlisted video is available to anyone with its link.

Recorded safeguards are the Google Cloud and Google Analytics Data Processing Addenda, including standard contractual clauses where applicable; Stripe's Data Transfers Addendum, which prioritises the Data Privacy Framework and then standard contractual clauses; and the Sinch Email/Mailgun DPA, which includes standard contractual clauses, with the Data Privacy Framework where applicable. These safeguards, encryption and minimisation govern transfers outside the EEA.

Your rights

You may request access, correction, deletion, restriction, portability or objection where applicable, withdraw consent prospectively and set post-death instructions. Email support@onecut.mov; ID is requested only where reasonable doubt exists. You may complain to the CNIL or your local authority.

Security, visibility and decisions

Media is transferred over HTTPS and stored with restricted technical access. Sources remain private. Finished videos are private by default; the user can create an unlisted link or request public publication. Status and unlisted links act as access secrets and should be shared only with chosen recipients.

OneCut makes no automated decision with legal effects; free-export eligibility and fraud checks may use technical rules. An administrator performs publication review.