Legal
Privacy Policy
ShotFlick — operated by Comfort Earning Production
Effective date: 15 September 2026
Last updated: 15 September 2026
1. Who we are
ShotFlick is an AI-assisted video editing service operated by Comfort Earning Production, a Sole Proprietorship registered in India.
- Address: Krishna Complex, Ateli Mandi, Mahendragarh, Haryana 123021, India
- GSTIN: 06KXZPS5808G1ZH
- Contact: [email protected]
For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary. For users in the EEA/UK, we act as the Data Controller under GDPR.
2. The short version
- We collect the minimum needed to run the service: your email, your uploaded video, and payment records.
- Your uploaded video and your output video are deleted after 7 days. We do not keep a library of your videos.
- We do not sell your data. Ever.
- To edit your video, parts of it are sent to third-party AI services. This is explained in section 5 — please read it.
- You can delete your account and all associated data at any time from Profile → Delete account.
3. What we collect
3.1 Information you give us
| Data | Why | Kept for |
|---|---|---|
| Email address | Account login, delivery notifications, support | Until account deletion |
| Name (optional) | Invoices, addressing you in emails | Until account deletion |
| Country and state | Correct pricing, currency, and legally required GST place-of-supply | Until account deletion |
| GSTIN (optional, business users) | To issue you a GST invoice you can claim credit on | 8 years (tax law) |
| Billing address (if required by your payment method) | Tax compliance | 8 years (tax law) |
| Uploaded videos and audio | To perform the editing you requested | 7 days |
| Editing instructions / preferences you enter | To produce the output | With the job record |
| Support messages | To help you | 2 years |
3.2 Information created by using the service
| Data | Why | Kept for |
|---|---|---|
| Output videos | To deliver your result | 7 days |
| Job records (status, duration, error codes, Tokens used) | Billing accuracy, refunds, debugging, fraud prevention | 3 years |
| Token ledger (purchases and usage) | Financial record, dispute resolution | 8 years (tax law) |
| IP address, device type, browser, app version | Security, fraud and abuse prevention, regional pricing | 12 months |
| Crash and error logs | Fixing bugs | 90 days |
3.3 What we never collect or store
- Card numbers, CVV, UPI PIN, bank credentials. These are entered directly with our payment providers and never reach our servers. We only receive a payment reference, the amount, status, and the last 4 digits / payment method type.
- Your contacts, photo library, location (beyond country/state), microphone, or any device data we do not need.
- Sensitive personal data as defined under applicable law. Please do not upload videos containing such data if you can avoid it.
4. Why we process your data (legal basis)
| Purpose | Basis (DPDP) | Basis (GDPR) |
|---|---|---|
| Creating and running your account | Consent | Contract |
| Processing the videos you submit | Consent | Contract |
| Taking payment and issuing invoices | Legal obligation | Contract / Legal obligation |
| Preventing fraud, abuse and illegal content | Legitimate use | Legitimate interests |
| Security and service reliability | Legitimate use | Legitimate interests |
| Product emails you opt in to | Consent | Consent |
We do not use your videos or your data to train our own AI models, and we do not use your content to build datasets.
5. Third-party AI processing — please read
To edit your video, our system sends parts of your content — which may include video frames, audio, and transcribed speech — to third-party AI providers that we use as sub-processors. These currently include: third-party AI service providers located in the United States and the European Union.
What this means for you:
- These providers process your content only to return a result to us, under their business/API terms.
- We use their API tiers that exclude customer content from model training wherever such a tier is offered.
- Some of these providers operate servers outside India, which means your content may be processed abroad (see section 8).
- We cannot control a provider's own retention period beyond what their terms state, though these are typically short (hours to 30 days) for abuse monitoring.
If you are not comfortable with this, please do not upload the content. There is no way to run this service without third-party AI processing.
6. Who else we share data with
We share data only with service providers who need it to make the product work. Each is bound by contract to protect it.
| Provider | What they get | Purpose |
|---|---|---|
| Cloud storage provider | Your uploaded and output videos | File storage |
| Cloud compute / render provider | Your video during processing | Rendering |
| Database & authentication provider | Email, account data | Login, records |
| AI providers (third-party AI service providers located in the United States and the European Union) | Content as described in section 5 | Editing |
| Razorpay (India) | Email, amount, order reference | Payment processing |
| Paddle (international) | Email, amount, country | Payment processing, tax handling |
| Email delivery provider | Email address | Notifications, OTP |
| Content safety provider | Sample frames of your video | Detecting illegal content (section 7) |
| Error monitoring provider | Technical error data | Fixing bugs |
| Our Chartered Accountant | Invoice and payment records | Statutory compliance |
We do not sell, rent, or trade your personal data with anyone, for any purpose.
We may disclose data if required by a valid legal order from an Indian authority or a court of competent jurisdiction, or to protect someone's safety. Where we are legally permitted to tell you, we will.
7. Content safety checks
Before rendering, our system automatically checks a small number of frames from your video against an automated content-safety service. This is done to detect illegal material — in particular child sexual abuse material — and content that violates our Terms.
- This check is automated. No human reviews your video as part of normal processing.
- If content is flagged, the job is refused and a record of the refusal is kept.
- Confirmed illegal material is reported to the relevant authorities as required by Indian law, and the account is terminated. No refund applies in that case.
8. International transfers
Our infrastructure and AI providers operate globally, so your data may be processed in countries outside India, including the United States and the European Union.
- Under the DPDP Act, we may transfer personal data outside India except to countries restricted by the Central Government.
- For EEA/UK users, transfers outside those regions rely on the EU Standard Contractual Clauses or an adequacy decision, as applicable to the provider.
9. How long we keep things
Our rule is: delete as early as legally possible.
- Input videos: automatically deleted after 7 days.
- Output videos: automatically deleted after 7 days.
- Account data: deleted when you delete your account.
- Financial records (invoices, payments, Token ledger): kept for 8 years — this is required by Indian tax law and we cannot delete these on request, even after you close your account. They are retained separately from your account and are not used for any other purpose.
- Logs: as stated in section 3.
Deletion is done by automated lifecycle rules on our storage, not by hand.
10. Your rights
You can, at any time:
| Right | How |
|---|---|
| See your data | Account → Settings → Download my data |
| Correct your data | Account → Settings, or email us |
| Delete your account and data | Profile → Delete account |
| Withdraw consent | Delete your account; this stops all processing going forward |
| Get an answer to a grievance | Section 11 |
| Nominate someone (DPDP) | Email us to nominate a person to exercise your rights if you are unable to |
EEA/UK users additionally have the rights to restrict or object to processing, to data portability, and to lodge a complaint with their local supervisory authority.
Account deletion is permanent. Your videos, job history and unused Tokens are destroyed and cannot be recovered. Unused Tokens are not refunded on account deletion.
We respond to all requests within 30 days. We may ask you to verify your identity via your registered email first.
11. Grievance Officer
As required by the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines) Rules, 2021:
- Name: Hawa Singh
- Designation: Grievance Officer
- Email: [email protected]
- Address: Krishna Complex, Ateli Mandi, Mahendragarh, Haryana 123021, India
We acknowledge complaints within 24 hours and resolve them within 15 days.
If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
12. Security
- All traffic is encrypted in transit (HTTPS/TLS).
- All stored files are encrypted at rest.
- Download links are signed and time-limited — they expire and cannot be guessed or shared indefinitely.
- API keys and credentials are held server-side only and are never present in our website or mobile app.
- Access to production systems is restricted and protected by multi-factor authentication.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected user without undue delay, as required by the DPDP Act.
13. Children
ShotFlick is not intended for anyone under 18. We do not knowingly collect data from children. Under the DPDP Act, processing a child's data requires verifiable parental consent, which our service is not designed to obtain. If we learn that a user is under 18, we will terminate the account and delete the data.
14. Cookies and tracking
We use only what the service needs:
- Essential cookies — to keep you logged in. These cannot be turned off.
- Basic analytics — aggregate page counts, to know what to improve.
We do not use advertising cookies, cross-site tracking pixels, or third-party ad networks.
15. Changes to this policy
If we make a change that materially affects your rights, we will notify you by email and in the app at least 7 days before it takes effect. The "Last updated" date above always reflects the current version.
16. Contact
Comfort Earning Production
Krishna Complex, Ateli Mandi, Mahendragarh, Haryana 123021, India
GSTIN: 06KXZPS5808G1ZH
General: [email protected]
Privacy & grievances: [email protected]