Privacy policy

The controller for your personal data on hypevideoshorts.com is Moritz Bärwolf, Am Schlosspark 4, 45899 Gelsenkirchen, Germany. Email: moritz.baerwolf@outlook.de. More details are in our legal notice.

We are not required to appoint a data protection officer. For any question about your data, write to the email address above.

• We process your data to run Hypevideoshorts: your account, your uploads, the gameplay videos and shorts we make from them, and your plan.
• We do not sell your data, show ads or track you across websites.
• We do not use your videos, your voice or your texts to train AI models. We have switched off model training at Deepgram and use Gemini as a paid service, where Google does not train on our data.
• You can delete single videos at any time, and your whole account in your account settings.

When you open hypevideoshorts.com, your browser sends technical data to our hosting provider Vercel. Vercel delivers the pages from Frankfurt, Germany, and runs our server functions in the USA.

• Data: IP address, date and time, the page requested, browser and operating system. When you are signed in, our server logs can also contain your user ID.
• Purpose: to deliver the website, find errors and keep it secure.
• Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR); when you use your account, also the contract (Art. 6(1)(b) GDPR).
• Recipient: Vercel.
• Storage: Vercel deletes these logs automatically after a period set by our hosting plan, at most 30 days.

We use no analytics, no advertising pixels and no third-party scripts. Our fonts are delivered from our own website.

To use Hypevideoshorts you need an account. Sign-in runs through our provider Clerk. You can sign up with your email address or with Sign in with Google.

• Data: email address, your password (handled by Clerk, we never see it), your name if you enter it, user ID, sign-in times, the time you accepted the terms, and the IP address and browser of your sessions. With Sign in with Google, Google passes your name, email address and profile picture to Clerk. In our own database we store your user ID, your plan and the email address for notifications.
• Purpose: to create your account, sign you in, keep you signed in and let you delete your account.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Recipients: Clerk; Supabase (our database); with Sign in with Google also Google.
• Storage: as long as your account exists. When you delete your account, we delete these data and Clerk deletes your account (see the Clerk privacy policy).

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only ask Google for your name, email address and profile picture, and use them only to create and run your account. We do not access anything else in your Google account.

When you upload a gameplay recording, we turn it into a gameplay video and shorts. Your recording can contain your voice and anything you say in it.

• Data: the video file with picture and sound, including your voice; the file name, which we use as the title; the transcript of the speech with word timings and language; the results of the analysis, such as scene descriptions, suggested clips and edit plans.
• Purpose: to analyze your recording, write the transcript, find the best moments and cut your gameplay video and shorts.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Recipients: your browser uploads the file directly to Cloudflare, which stores it and sees your IP address. Our processing server at Hostinger in Frankfurt, Germany, prepares the file and renders your videos. When demand is high, extra servers at Hetzner in Germany or Finland do this too. Deepgram receives the sound track as an audio file and returns the transcript. Google receives short video segments with sound, and the transcript, through the Gemini API and returns the analysis. Supabase stores the transcript and the analysis results in our database.
• Storage: we delete your upload 7 days after processing ends, counted from the last step we ran for it (the analysis, your gameplay video, a short or thumbnails), whether that step succeeded or failed. While it still waits for processing or something is still being made from it, we keep it. Working copies on our processing servers are deleted earlier; an extra server at Hetzner is deleted with everything on it once we no longer need it. Transcripts and analysis results stay until you delete the video or your account.

Our processing servers also write technical logs with your user ID and video ID so that we can find errors (legitimate interest in a working service, Art. 6(1)(f) GDPR). We delete them once we no longer need them.

Deepgram and Google work for us as processors. We have switched off Deepgram's model improvement program for every request, so Deepgram keeps the audio only as long as it needs to create the transcript. We use the Gemini API as a paid service: Google does not use prompts or responses to improve its products and keeps them only for a limited time to detect misuse. We delete every file we upload to Gemini after use; if that fails, Google deletes it after 48 hours.

• Data: your finished gameplay video, your shorts, their preview images and the titles and texts we write for them.
• Purpose: to show them in your library and let you download them.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Recipient: Cloudflare stores the files. When you watch or download them, your browser loads them directly from Cloudflare.
• Storage: until you delete them or your account. We do not delete finished videos automatically.

We send a welcome email after sign-up, confirmations about your plan (reservation, purchase, cancellation), a reminder before your plan renews, notices when your video is ready to edit, when your gameplay video is ready and when your shorts are ready, and, if you reserved a plan, a note when buying opens.

• Data: your email address, the content of the email (for example the title of your video, your plan and amounts) and delivery information.
• Purpose: to inform you about your account, your videos and your plan.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Recipient: Resend, which sends our emails from servers in the EU.
• Storage: we keep no copies of these emails. Resend keeps sending logs as described in the Resend privacy policy.

In the app you can rate videos and shorts, answer short questions and send us messages.

• Data: your user ID, email address, plan, the page and video concerned, your ratings (stars, thumbs, recommendation score), a category, your reasons when you cancel, and your message.
• Purpose: to improve Hypevideoshorts and to answer you.
• Legal basis: our legitimate interest in improving our service (Art. 6(1)(f) GDPR). Feedback is voluntary.
• Recipients: Supabase (our database). Messages and cancellation reasons also reach us as an email: Resend sends it, and our mailbox is a Gmail account, so Google stores it.
• Storage: feedback stays in our database until you delete your account. We delete feedback emails in our mailbox once we no longer need them.

You can reach us through our contact form.

• Data: your name if you give it, your email address, your message and the time we received it. Your IP address is used briefly in memory to prevent misuse and is not stored.
• Purpose: to answer your request. We reply to the email address you give.
• Legal basis: the contract or steps before a contract (Art. 6(1)(b) GDPR) where your request concerns one; otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR).
• Recipients: Vercel (website), Resend (sends your message to us), Google (our Gmail mailbox).
• Storage: the message is not stored in our database. We delete it from our mailbox once your request is settled, unless a statutory retention period applies.

If you write to moritz.baerwolf@outlook.de, we use your email address and your message to answer you, on the same legal bases and with the same storage as for the contact form. This mailbox is hosted by Microsoft (Outlook.com), so Microsoft stores these emails.

Anyone can report content on Hypevideoshorts that they consider illegal (see our terms). When we decide on a report, or restrict content or an account, we tell the people concerned.

• Data: for a report, the name and email address of the person reporting, the report and the content concerned; for a decision, the user ID and email address of the affected user, the content, our decision and its reasons.
• Purpose: to check reports, decide on them, confirm receipt and tell the person reporting and the affected user our decision.
• Legal basis: our legal duties under the Digital Services Act (Art. 6(1)(c) GDPR with Art. 16 and 17 DSA); keeping the records as proof: our legitimate interest in defending legal claims (Art. 6(1)(f) GDPR).
• Recipients: Microsoft (our Outlook.com mailbox, through which reports arrive and we reply); a report sent through our contact form also reaches us through Resend (sends the message) and Google (our Gmail mailbox). Where strictly necessary, we tell the affected user who made the report (Art. 17(3)(b) DSA).
• Storage: we keep reports, decisions and the related emails for up to three years from the end of the year of the decision (regular limitation period, §§ 195 and 199 of the German Civil Code).

Before buying opens, you can reserve a plan.

• Data: your user ID, the plan, the time of the reservation and the email address for notifications.
• Purpose: to hold your spot and tell you when buying opens.
• Legal basis: steps before a contract at your request (Art. 6(1)(b) GDPR).
• Recipients: Supabase (our database), Resend (emails).
• Storage: until you cancel the reservation or delete your account.

Paid plans are sold through Stripe. You enter your payment details on Stripe's own checkout page, and you manage payment methods and invoices on Stripe's billing pages. We never see your card or bank details.

• Data: your email address, user ID, the plan, the price, the time of purchase, the status of your subscription, invoices and payment status, and the version and date of your consent to the early start, stored with your subscription at Stripe. Stripe also processes your payment details.
• Purpose: to sell and run your plan, take payment, send invoices and meet our tax and accounting duties.
• Legal basis: contract (Art. 6(1)(b) GDPR) and our legal duties under tax and commercial law (Art. 6(1)(c) GDPR).
• Recipient: Stripe. Stripe processes payments for us and, where the law allows, also uses the data for its own purposes such as fraud prevention; for those purposes Stripe is responsible itself (see the Stripe privacy policy).
• Storage: invoices and payment records for as long as German tax law requires, generally 8 years, books and records 10 years (§ 147 of the German Fiscal Code, Abgabenordnung). These records stay at Stripe even after you delete your account.

You can cancel your plan or withdraw from your contract online, also without signing in.

• Data: your name, your email address, the contract concerned, the type of cancellation and when it should take effect, for an extraordinary cancellation the reason, for a withdrawal the order date if you give it, the date and time of your request and, if you are signed in, the ID of your account. Your IP address is used briefly in memory to prevent misuse and is not stored.
• Purpose: to carry out your cancellation or withdrawal and to confirm it to you.
• Legal basis: our legal duties for cancellations and withdrawals (Art. 6(1)(c) GDPR) and the contract (Art. 6(1)(b) GDPR).
• Recipients: Vercel (website); Clerk, for an ordinary cancellation only (we find the account by your sign-in or by the email address you give, and look up the account's email address); Resend (delivers the confirmation to the address you give, also to the account's email address when an ordinary cancellation concerns a paid plan, and our messages about these requests to our own mailbox); Stripe (where we set your cancellation); Google (our Gmail mailbox, which receives extraordinary cancellations, withdrawals and ordinary cancellations we could not process automatically).
• Storage: for an ordinary cancellation we keep no copy of the confirmation email; the cancellation itself is recorded with your subscription at Stripe. If we could not process an ordinary cancellation automatically, our mailbox receives a message with the data above so that we can carry it out by hand. We keep that message, and the email of an extraordinary cancellation or a withdrawal, in our mailbox as proof for up to three years from the end of the year of the request (regular limitation period, §§ 195 and 199 of the German Civil Code). Where a request leads to a refund, we keep the documents on it longer where tax law requires it, generally 6 years (§ 147 of the German Fiscal Code).

Our servers send short alerts and reports to a private Discord channel, so that we notice errors quickly and see how our service is running, for example when processing a video fails for good, a queue gets long or costs rise.

• Data: counts and states, such as the type of a failed job, its error class and number of attempts, queue lengths, waiting times, server load, numbers of accounts per plan and costs, plus short error messages from our providers, with IDs, addresses and paths removed. The messages contain no personal data: no email addresses, names, user IDs, video IDs, video titles or file paths.
• Purpose: to find and fix errors and keep our service running.
• Recipient: Discord.
• Storage: we delete messages once we no longer need them.

We set no cookies of our own and use no tracking. What is stored in your browser is strictly necessary for the service you asked for, so it needs no consent (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

• Sign-in cookies from Clerk: __session and __client_uat on hypevideoshorts.com, and __client on clerk.hypevideoshorts.com. They keep you signed in.
• localStorage: clipper.subtitleStyle and hv.filmSubtitleStyle remember your subtitle style; hv.hookChoice.<videoId> remembers your hook choice for a video.
• sessionStorage: hv-tour remembers where you are in the product tour, and hv-toast holds a short notice, such as why an upload was turned down, until it is shown once. Both are removed when you close the tab.
• Stripe sets its own cookies only on its checkout and billing pages.

You can delete these entries in your browser settings at any time. You will then be signed out.

We use these service providers. Some of them are based in the USA or process data there.

• Clerk (USA): sign-in. EU-US Data Privacy Framework. Clerk privacy policy
• Google: Sign in with Google, Gemini API, our Gmail mailbox. Data can be processed in the USA. EU-US Data Privacy Framework. Google privacy policy
• Supabase: our database, stored in the EU; support and subprocessors in the USA and Singapore work under standard contractual clauses. Supabase privacy policy
• Cloudflare (USA): file storage. Cloudflare chooses the storage location automatically, which can be outside the EU. EU-US Data Privacy Framework. Cloudflare privacy policy
• Hostinger (Lithuania): our processing server in Frankfurt, Germany. No transfer outside the EU. Hostinger privacy policy
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: our processor for extra processing servers in Germany and Finland, which prepare and render your videos when demand is high. No transfer outside the EU. Hetzner privacy policy
• Deepgram (USA): transcripts. Standard contractual clauses. Deepgram privacy policy
• Stripe: payments. Data can be processed in the USA. EU-US Data Privacy Framework and standard contractual clauses. Stripe privacy policy
• Resend (USA): emails, sent from the EU. EU-US Data Privacy Framework. Resend privacy policy
• Vercel (USA): website hosting; pages are delivered from Frankfurt, server functions run in the USA. EU-US Data Privacy Framework. Vercel privacy notice
• Discord (USA): error alerts and service reports, without personal data. Discord privacy policy
• Microsoft: our email inbox. Data can be processed in the USA. EU-US Data Privacy Framework. Microsoft privacy statement

For companies certified under the EU-US Data Privacy Framework, the European Commission has found an adequate level of data protection (Art. 45 GDPR). For Deepgram and Supabase, and for Stripe in addition to the framework, we rely on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

You can get a copy of these clauses from us at moritz.baerwolf@outlook.de. The European Commission publishes them on its page on standard contractual clauses.

You can delete your account at any time in your account settings. A running subscription then ends immediately (see our terms). We delete your account data, your uploads, transcripts, analysis results, finished videos, shorts, reservations and feedback, including all files.

What remains: invoices and payment records at Stripe (tax law), emails already sent or received, server logs until they are deleted, and technical job records that contain only internal IDs.

We make no decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR). The AI creates content from your recordings; it does not decide anything about you.

Hypevideoshorts is only for people who are 18 or older. We do not knowingly process data of anyone younger.

You are not legally obliged to give us any data. Without an email address and your uploads, however, we cannot provide the service.

You have the right to:

• get access to your data (Art. 15 GDPR)
• have it corrected (Art. 16 GDPR)
• have it deleted (Art. 17 GDPR)
• have its processing restricted (Art. 18 GDPR)
• be told which recipients we informed about a correction, deletion or restriction (Art. 19 GDPR)
• receive your data in a common, machine-readable format (Art. 20 GDPR)
• object to processing (Art. 21 GDPR, see below)

Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). At present we base no processing on consent.

To use your rights, email moritz.baerwolf@outlook.de.

You can object at any time, for reasons arising from your particular situation, to processing that is based on our legitimate interests (Art. 6(1)(f) GDPR). We then stop, unless we have compelling legitimate grounds that outweigh your interests or we need the data to establish, exercise or defend legal claims (Art. 21(1) GDPR).

You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen in Düsseldorf.

We update this policy when our service changes. The date at the top shows the current version.