Privacy Policy

1. Controller

Tim Adrian Ribbat
trading as AiCutting
c/o Online Impressum #8217
Europaring 90
53757 Sankt Augustin
Germany
Email: XAOS.shop@gmail.com
Website: https://dronecutai.com

2. General information

We process personal data only where necessary to operate AiCutting, perform contracts, process payments, secure the service, communicate with users or comply with legal duties.

3. Categories of data

  • Account and authentication data: email address, password hash, user identifier, account timestamps and session state.
  • Usage and job data: uploads, render jobs, chosen style, aspect and quality, progress, timestamps, credit balance and ledger, quotes, refunds, and legal-acceptance evidence.
  • Payment data: pack, amount, payment status, Stripe Checkout and transaction references. Full card details are handled by Stripe and are not stored by AiCutting.
  • Uploaded content: drone videos, audio, selected Google Drive files and generated renderings. This content may contain faces, voices, vehicles, number plates or properties.
  • Communication data: support enquiries and related correspondence sent directly to the published contact address.
  • Technical and security data: IP address used for short-lived in-memory rate limiting, browser/request information, server logs and security events.

4. Purposes and legal bases

Account management, quoting, processing uploads, rendering, credit administration, downloads and payment handling are based on performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR). Tax, accounting and other statutory records are processed under Article 6(1)(c) GDPR. Security, abuse prevention, service diagnostics and legal defence are based on legitimate interests under Article 6(1)(f) GDPR. Where consent is specifically requested, processing is based on Article 6(1)(a) GDPR and may be withdrawn for the future.

5. Uploaded footage and audio

Uploaded material is processed to create the requested quote and video result, provide the download, support the user and protect the service. AiCutting does not publish uploaded content without authorisation. Users must ensure they are entitled to upload and process any third-party personal data contained in their material.

6. Payment provider: Stripe

Stripe processes payment and billing data for credit-pack purchases, payment confirmation, fraud prevention and legally required payment records. Stripe's own privacy information applies to its processing. AiCutting receives the status and identifiers needed to allocate purchased credits and prevent duplicate grants.

7. Storage, hosting and rendering

Depending on deployment, uploads and results are stored on local server storage or in Cloudflare R2 object storage. The application, SQLite database and render worker may run on the configured hosting server. Files are copied to temporary local storage where required for FFmpeg and AI-assisted processing, then persisted to the configured output storage.

8. Google Drive import

If the optional Google Drive picker is used, the user authorises access to specifically selected files through the limited drive.file scope. AiCutting receives a short-lived OAuth access token and uses it only to download the selected files for the requested job. The token is not stored in the account database.

9. Transactional email: Brevo

AiCutting sends transactional emails — password resets, notices that a cut is finished or has failed, and occasional service announcements — through the email provider Brevo (Sendinblue GmbH / Brevo SAS, EU). For this purpose the recipient address and the message content are processed by Brevo on our behalf. Service announcements can be stopped at any time by replying to the message; account and order emails are required to perform the contract. Support enquiries can always be sent directly to the published contact address.

10. Recipients and international transfers

Recipients may include Stripe, Cloudflare R2, Google Drive, Brevo, Anthropic (see section 15), hosting and render providers, technical contractors, professional advisers and public authorities where required. Where personal data is transferred outside the EU or EEA, the transfer is based on an adequacy decision, appropriate safeguards such as standard contractual clauses, or another lawful transfer mechanism.

11. Storage and deletion

Account and job data are retained while the account exists and while needed to provide the service. Users can export or delete their account data in the account area. Account deletion removes application account data, jobs, uploads and renderings from the active service. Payment, tax, contractual or legal-defence records may be retained separately for applicable statutory periods. Rate-limit entries exist only in memory for their short configured window.

12. Cookies and similar technologies

AiCutting uses a signed, technically necessary session cookie for login, security, flash messages and upload-session state. Its maximum lifetime is 14 days. It is required to provide the service requested by the user.

On the public pages we additionally offer advertising measurement with the Google Ads tag (Google Ireland Ltd.), which tells us which advertisement led to a visit. It is loaded only after explicit consent (Article 6(1)(a) GDPR, § 25(1) TDDDG): until you agree, no Google script is requested and nothing is stored on your device — Google Consent Mode starts in the denied state. Consent can be declined with equal ease and withdrawn at any time by clearing this site's data in your browser; the decision itself is kept in your browser's local storage, not in a cookie. Data processed on consent may be transferred to Google LLC in the USA under the safeguards described in section 10. Inside the signed-in account there is exactly one measurement, and only with the same consent: a completed credit purchase is reported once as a conversion, with its amount, currency and the payment reference that prevents it from being counted twice. Nothing else you do in your account — no upload, no cut, no download — is measured for advertising.

13. Rights of data subjects

Subject to the statutory requirements, data subjects have rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent for future processing. They also have the right to lodge a complaint with a competent data protection supervisory authority. Requests can be sent to XAOS.shop@gmail.com.

14. Security

We use appropriate technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access and alteration. No internet service can guarantee absolute security.

15. AI-assisted editing and Anthropic

The automatic edit is produced by an artificial intelligence system operated on our own infrastructure: uploaded footage is analysed, selected and assembled by software. Where the optional AI Director review is active, individual sampled frames of the uploaded footage and technical shot metadata are additionally processed by Anthropic PBC (USA) as our processor to review the selection; account data is not shared with Anthropic. Transfers to the USA are safeguarded as described in section 10. Delivered videos are marked as AI-edited in their file metadata and on the result page (Article 50 of Regulation (EU) 2024/1689).

16. Changes to this policy

This Privacy Policy may be updated when the service, providers or legal requirements change. The current version is published on this website.