Legal

Privacy policy

Applies to the closed beta of MiroClips. Last updated: 2 November 2026.

Draft for the closed beta, pending legal review. It describes how the service works today, but a lawyer has not checked the wording yet. The operator details are not configured yet (name, postal address, and e-mail address missing), so this page cannot name the controller. The hosting provider's name and server location are not configured yet.

1. Who is responsible

The controller under Art. 4(7) GDPR is:

not configured yet (see the notice at the top of this page).

E-mail for all privacy questions: (e-mail address not configured yet)

We have not appointed a data protection officer: the legal thresholds for a mandatory appointment (Art. 37 GDPR, §38 BDSG) are not met.

2. What we process and why

Account. Your e-mail address, an internal user ID, when you signed up and last signed in, and the one-time codes or links we send for sign-in. Purpose: create your account and let you sign in. Legal basis: Art. 6(1)(b) GDPR (performance of our contract with you).
Invite list. While sign-up is by invitation only, we keep the invited e-mail address, the date of the invitation and a short internal note such as who referred you. Purpose: let only invited people create an account. Legal basis: Art. 6(1)(b) GDPR where you asked us for access yourself; otherwise Art. 6(1)(f) GDPR, our legitimate interest in running a small invite-only beta. If someone else gave us your address, we tell you who when we invite you.
Sign-in and security logs. IP address, browser type, time and outcome of sign-in attempts and of requests to our servers. Purpose: keep the service secure, stop abuse and fix errors. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service.
Videos you upload or link. The file you upload, or the link you paste. For a link, our server downloads the video from the platform (for example YouTube) itself. Purpose: make clips from it. Legal basis: Art. 6(1)(b) GDPR.
Transcripts. Created from the audio track with Whisper on our own server, without any third party, and stored only there. Purpose: find the moments worth clipping and write captions. Legal basis: Art. 6(1)(b) GDPR.
Clips and project settings. Generated clips, captions, thumbnails, titles, scores and your settings such as caption style or clip length. Purpose: show, edit and download your clips. Legal basis: Art. 6(1)(b) GDPR.
Usage and credits. A ledger of credits granted, reserved, used and refunded, plus project status and processing times. Purpose: apply the monthly free credits and plan capacity. Legal basis: Art. 6(1)(b) GDPR.
Error events. When processing fails: project ID, processing step, error code and message. Purpose: notice and fix failures. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a reliable service.
E-mail to us. Your address and your message. Purpose: answer you. Legal basis: Art. 6(1)(b) GDPR where it concerns your account, otherwise Art. 6(1)(f) GDPR (our interest in answering inquiries).

People in your videos. Videos and transcripts can contain personal data of other people who are seen or heard in them. You decide what you upload or link and must be allowed to use it (see the terms). We process such data only to create your clips; towards the people concerned the legal basis is Art. 6(1)(f) GDPR, the legitimate interest in editing video that you are entitled to use. To keep the speaker in frame, our server detects faces in the video automatically. Nobody is identified, and no face templates or other biometric data are created or stored; only the position of the crop is kept.

You need an e-mail address to use the app; without it we cannot create an account. Everything else you provide is your choice. The language model only suggests clips; there is no automated decision with legal or similarly significant effect on you (Art. 22 GDPR).

3. Who else processes data

These service providers process data on our behalf under a data processing agreement (Art. 28 GDPR). Nobody receives data for advertising, and we sell none.

Our server hosting provider (name not configured yet)

Task: Rents us the virtual server that runs the website, the app and the processing worker. Downloading linked videos, transcription with Whisper, face detection for reframing and rendering all happen on this server; no third party is involved in transcription.
Data: A working copy of every project: the source video (for a link, the copy our server downloaded), its audio track, the full transcript, reframing data and the rendered clips. Also server logs with IP addresses.
Location: Not configured yet.
Safeguards: Data processing agreement under Art. 28 GDPR.

Supabase, Inc., USA

Task: Database, sign-in (authentication) and file storage for uploads and clips.
Data: Account e-mail, the invite list, sign-in and security logs with IP addresses, projects (the video link or uploaded source file, settings and status), a small preview copy of each source video for the framing editor (removed after 7 days without activity), clips with burned-in captions, their titles and thumbnails, error events and the credit ledger. Full transcripts are not stored here.
Location: Stored in the EU: AWS region eu-central-1, Frankfurt, Germany.
Safeguards: Data processing agreement under Art. 28 GDPR. Where staff of the US company access data from outside the EU, for example for support: Transfers to the USA rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the company is certified, otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Resend, Inc., USA

Task: Delivers the e-mails with your sign-in code or link.
Data: Your e-mail address, the content of the message and its delivery status.
Location: Sent from the EU sending region (Ireland); the company is based in the USA.
Safeguards: Data processing agreement under Art. 28 GDPR. Transfers to the USA rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the company is certified, otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), China

Task: Its language model reads excerpts of the transcript with timestamps and suggests which moments become clips and, when you add B-roll to a clip, where stock cutaways fit and what to search for. It receives no video, no audio and no account data.
Data: Transcript text. Transcripts can contain personal data of the people speaking in the video, including what they say about themselves or others.
Location: Processed in the People's Republic of China.
Safeguards: DeepSeek's terms of use and privacy policy apply. The European Commission has not issued an adequacy decision for China, so the level of data protection there is not recognised as equivalent to the EU's. Use only material whose spoken content may be processed there.

Video platforms. When you paste a link, our server requests the video from the platform. The platform sees our server's IP address and the requested video, nothing about you.

Sign-in with Google. Only if this option is offered and you choose it: Google Ireland Limited confirms your identity and shares your name, e-mail address and profile picture with us. Google's own privacy policy applies to your Google account.

We disclose data to authorities only where the law obliges us to.

4. How long we keep it

Projects in your account (the video link or uploaded source file, clips, titles and settings): during the closed beta, until you delete the project or your account is deleted. Deleting a project in the app removes it and its clips from your account and deletes an uploaded source file from our storage provider.
Working copies on our processing server: for every project our server keeps a working folder with the source video (for a link, the copy it downloaded), its audio track, the full transcript and intermediate files. Video and audio files are deleted automatically 7 days after the project was last processed; if you retry a project or change a clip's captions later, we fetch the source again. The transcript and intermediate files are not deleted automatically while the project exists. When you delete a project, its whole working folder goes within 7 days of its last processing. We delete working copies earlier when you ask us to, when your account is deleted, and when the closed beta ends.
Invite list: until the closed beta ends or you ask us to remove your address.
Account data and the credit ledger: until your account is deleted. There is no delete button in the app yet: write to (e-mail address not configured yet) and we delete your account together with its projects, clips, uploads and working copies.
Error events, sign-in and security logs, and server logs: 30 days.
E-mail with us: until your request is resolved.

Deleted data can remain in the rolling backups of our database provider for a short time until they are overwritten. Where the law requires longer retention, we keep the data only for that purpose. Before paid plans start we will set fixed retention periods for projects and update this policy.

5. Cookies and local storage

We use no tracking, analytics or advertising cookies and load no third-party scripts. Fonts come from our own server. We store only the following on your device. Each is strictly necessary for a service you asked for, so none needs consent (§25(2) No. 2 TDDDG):

Session cookie (name starts with sb-): keeps you signed in. It is set when you sign in and deleted when you sign out; otherwise it expires after 400 days at the latest.
mc_handoff (cookie): keeps the video link you pasted on the homepage while you sign up, so the project form can offer it again. No project starts until you confirm the rights and submit the form. It expires after 60 minutes or as soon as it has been used.
Upload resume entry (local storage, name starts with tus::): while you upload a video, your browser notes the file's name, type, size and date, the upload address at our storage provider and when the upload started, so an interrupted upload can continue where it stopped. It is deleted when the upload finishes or you cancel it; after an interrupted or failed upload it stays in your browser until you clear the site data.

There is nothing to opt out of. If we ever add optional cookies, we will ask first and the choice will live here.

6. Your rights

Under the GDPR you have the right to:

access the data we hold about you (Art. 15);
have incorrect data corrected (Art. 16);
have your data deleted (Art. 17);
have processing restricted (Art. 18);
receive your data in a portable format (Art. 20);
object at any time, on grounds relating to your situation, to processing based on Art. 6(1)(f) GDPR (Art. 21).

Write to (e-mail address not configured yet); we answer within one month. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where you think the infringement happened.

7. Security

All connections are encrypted (HTTPS). Access rules in the database ensure that only you can see your projects and clips.

8. Changes

We update this policy when the service changes, for example when paid plans arrive. The date at the top shows the current version; we tell you about material changes by e-mail.