Your footage is yours. Here is exactly what we do with it.

1. Who is responsible

The controller of your personal data is [COMPANY LEGAL NAME], organisation number [ORG NUMBER], [STREET ADDRESS, POSTCODE, CITY], Sweden ("GambitClip", "we"). We are established in Sweden and the General Data Protection Regulation (GDPR) applies to everything described here.

We serve customers worldwide. This policy applies to everyone. If the law where you live gives you more rights than it describes, you have them; the sections for the United States and for the EU say where the two differ.

Privacy questions and requests: hello@gambitclip.com. We answer within 30 days, usually much faster. We have not appointed a data protection officer; this address reaches the people who run the service.

2. What we collect, and why

Your account

When you sign in we receive your email address, your name if your sign-in provider shares it, and an account identifier. We use these to run your account, to send you messages about your runs and your subscription, and to answer support. Legal basis: performing our contract with you.

Your footage

To make clips we need the video. You either upload a file or give us a link, and we fetch the video from that link. From the footage we derive: the audio track; a transcript with timing and speaker labels; still frames and short segments used for visual analysis; written analysis notes produced by AI models (what happens on screen, what is said, where the good moments are); and the finished clips with their captions, titles and scores.

All of this exists for one purpose: producing the clips you asked for. The audio, the analysis notes and the working files live inside an isolated processing job and are discarded when the run finishes. We keep the footage itself for 7 days after the run, together with the transcript and the cut list, so you can adjust a clip's cuts and re-render it; after that they are deleted automatically. The finished clips with their caption files, titles, descriptions and scores stay for 30 days. Legal basis: performing our contract with you. Footage often contains other people (your friends on the call, your chat). You are responsible for having the right to upload it; we process it only on your instruction. We never ask for sensitive data (health, religion, biometrics and the like); if your footage happens to contain some, it is processed only as part of the footage and for nothing else.

Usage and billing

We record how many minutes of video you process, when, and the cost of each run, so that credits and subscriptions work and so that we can see what the service costs us. Payments are handled by Stripe. We never see or store your card number. We keep the records that Swedish bookkeeping law requires. Legal bases: performing our contract, and our legal obligations.

Technical data

Like every web service we receive your IP address, browser type and the pages you open, and we keep server logs and error reports. Error reports carry your account identifier so we can find and fix what broke for you; they never contain your footage. Legal basis: our legitimate interest in keeping the service secure and working.

Publishing platforms, only if you connect them

You can connect your own YouTube, TikTok, Instagram or X account and post a clip to it with one click. Connecting hands us a permission token for that account, which we store encrypted and use only to publish the clips you tell us to publish, to fetch your account name and picture for the button, and to check the platform's posting limits. We post only on your instruction: when you click Post, at a time you scheduled, or automatically for a recording you processed with automatic posting switched on in your settings. We never read your feed, your messages or your followers. We keep the identifier and link of each post we made for you, so your library can open it. You can disconnect any platform in your account settings or revoke the permission at the platform, and we delete the token when you do. Each platform then handles the posted clip under its own privacy policy: TikTok, Instagram (Meta), X, Google.

YouTube in particular

If you choose to publish a clip to YouTube from the app, you grant us permission through Google to upload that video to your channel. We use that permission only to upload the clips you tell us to upload, and for nothing else. GambitClip's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time in your Google account.

The waiting list

If you join the waiting list on our site, we keep your email address to tell you when GambitClip opens. Legal basis: your consent, which you can withdraw with one click in any email we send.

3. Automated processing

We may keep anonymised, aggregated statistics about the service (how many runs, average clip length, how often a feature is used) to run and improve it. They never identify you or anyone in your footage.

GambitClip selects, cuts, captions and scores clips automatically. The score is an estimate of how good a clip is, produced by our software from AI analysis of your footage. It affects only the order clips are shown in. No decision with legal or similarly significant effects on you is made automatically.

4. Who else sees your data

We do not sell your data and we do not share it for advertising. We use a small number of service providers ("processors") who act only on our instructions under data processing agreements. The ones that can touch your footage are marked.

Every AI provider above is used on terms under which your content is not used to train their models. The current list, with what each company does and where it runs, is our subprocessor page; we update it and its date at least ten business days before a new one handles your data, and business customers may object under our Data Processing Agreement.

Where your data lives. Our own service and database run in the European Union. Footage and clips are stored with Cloudflare and served from locations near you. Video processing and the AI providers run in the United States. Wherever you are, expect your data to be processed in both regions.

For customers in the EU, the EEA, the UK and Switzerland, transfers to providers outside those areas rest on the European Commission's adequacy decisions (including the EU-U.S. Data Privacy Framework for certified providers) and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two), with the UK International Data Transfer Addendum and the Swiss addendum where they apply. Business customers get the same commitments in our Data Processing Agreement.

Legal requests. We disclose data to authorities only when the law requires it, for example under a valid court order. Unless we are legally prevented from doing so, we tell you before we hand anything over, and we limit what we hand over to what the request covers. We have never received such a request.

We may also disclose data if the law requires it, or to protect the rights and safety of our users and ourselves.

5. How long we keep things

Clips expire automatically 30 days after their run; your library keeps the record of the run (titles, scores, dates) so you can see what you made, without the video files. When you delete a run, its clips and records are removed from our systems immediately and from backups within 30 days. When you delete your account, everything above is removed the same way, except the payment records we are required to keep, which are detached from your identity.

6. Your rights

Under the GDPR you have the right to access, correct, delete, restrict and port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time. Two of these you can do yourself, right now, in the app:

• Download my data in your account settings gives you a file with everything we hold about you.
• Delete run on any past run, and Delete my account in your account settings, remove your data as described above.

For anything else, email hello@gambitclip.com. You also have the right to complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or to the supervisory authority in your own country. If you are in the United Kingdom, Switzerland or Canada, you have equivalent rights under your own law (the UK GDPR, the Swiss FADP, PIPEDA) and can use the same channels; residents of other countries with a privacy law can too.

7. If you are in the United States

This section adds to the rest of the policy for residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and every other state with a consumer privacy law. It is written to those laws' definitions.

Categories of personal information we collect, and have collected in the past 12 months: identifiers (name, email, account identifier, IP address); commercial information (your plan and purchase history; card numbers are held by Stripe, never by us); internet activity (pages opened, runs started, technical logs); audio and visual information (your footage and the clips made from it); and the clip score, which is an inference about the clip, not about you. We collect it from you, from your sign-in provider and from our own systems, for the purposes in section 2, and we disclose it only to the service providers in section 4 for business purposes.

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for anything other than providing the service. We honor Global Privacy Control signals; in our case they change nothing, because we do not track you.

Your rights: to know what we have collected and to access it, to delete it, to correct it, to take a copy of it, to opt out of sale or sharing (there is none), and not to be treated differently for exercising any of these. Export and deletion are built into the app; for anything else, email hello@gambitclip.com. We verify requests by replying to the email on your account, and we accept requests from an authorized agent who shows your written permission. We answer within 45 days. If we decline a request, you can appeal by replying to our decision within 60 days; if you are still unsatisfied, you can contact your state attorney general.

Children. We do not knowingly collect personal information from anyone under 13, and we delete it if we learn we have. GambitClip is for people aged 16 and over.

8. Cookies

We use only strictly necessary cookies: the one that keeps you signed in, and the ones Stripe sets during checkout to prevent fraud. We do not use analytics cookies, advertising cookies or tracking pixels, which is why you will not see a cookie banner. The full list is on our cookie page. If that ever changes, we will ask first.

9. Security

Data travels encrypted (TLS) and is stored encrypted at rest with our providers. Access to production systems is limited to the people who operate the service. Footage is processed in isolated jobs and deleted on the schedule above. No system is perfectly secure; if a breach ever affects you, we will tell you, and the supervisory authority, within 72 hours of confirming it, as the law requires. We keep a record of our processing activities (GDPR Article 30) and review it whenever we change a provider or a feature.

10. Emails we send, and other sites

We email you about your account and your runs: a run has finished, a payment went through or failed, a change to these terms. You cannot switch those off while you have an account, because they are how the service talks to you. Marketing email only goes to people who asked for it, and every marketing email has an unsubscribe link that works with one click.

The app links to other services, for example YouTube when you publish a clip, and Stripe when you pay. Those services have their own privacy policies, and what you do there is between you and them.

11. Age

GambitClip is for people aged 16 or older, and we never knowingly collect data from children under 13. You must be 18 to buy a subscription, or have a parent or guardian do it for you.

12. Changes

When we change this policy we update the date at the top and, for changes that matter, tell you by email or in the app before they take effect.

Earlier versions of this policy are available on request. The processor list changes only with a new date on the subprocessor page.