Shortspilot

GDPR overview

Implementation is concrete rather than declarative. Section 8 of the terms commits to the GDPR and to German data protection law, and the privacy policy dated 3 October 2025 names twelve processors with their role, the data they receive, their location and the legal basis. Rights under Articles 15 to 21 are listed, data exports go through support@shortspilot.ai with a one-month deadline, and accounts can be deleted from the settings page. The competent authority is named: the Hamburg Commissioner for Data Protection and Freedom of Information. No data protection officer has been appointed, and the policy explains why under section 38 BDSG — fewer than twenty people process personal data regularly. Transfers outside the EEA rely on the 2021 Standard Contractual Clauses. No certification such as SOC 2 or ISO 27001 is claimed anywhere.

Who owns the data?

Under section 14 of the terms you keep all rights to the content you submit. In exchange you grant Chatbyte GmbH a non-exclusive, worldwide, royalty-free, transferable and sub-licensable licence to use that content, limited by the same clause to providing and improving the service. Rights to the application itself stay with the publisher. Storage is a facility inside the product rather than an archive: section 7 lets the publisher delete videos sixty days after upload, so anything worth keeping has to be downloaded. Sub-licensing that storage to third parties is not permitted, and the publisher may block access to material it reasonably suspects is unlawful.

Reuse rights

You may reuse what you generate without asking Chatbyte GmbH for permission. The licence in section 14 runs to the publisher, not the other way round, and your own rights over submitted content are left intact, so finished Shorts are yours to publish, monetise and repurpose. Two limits are contractual rather than about ownership. Section 3 confines use of the application to your own purposes and forbids reselling or sub-licensing the service itself, and section 15 makes you solely responsible for whether the generated content complies with the rules of the platforms you post it on. Section 10 adds that no outcome is warranted — not views, not income, not channel growth.

Data retention & training

Hosting summary

The production stack is stated to run inside the EU. Vercel hosts the front end and CDN in Frankfurt; Neon holds the PostgreSQL database with account and project content in Frankfurt; Clerk handles authentication in Frankfurt; Sentry collects error reports in Frankfurt; and Amazon Web Services sends transactional and marketing mail from its Frankfurt cluster. AI inference runs on Microsoft Azure OpenAI in Sweden. Payments go through Stripe in Ireland, sign-in and the YouTube API through Google in Ireland, the posting API through TikTok in Ireland and Norway, support chat through Intercom in Dublin, and the advertising pixel through Meta in Ireland with sub-processing in the United States. Section 8 of the terms allows transfers outside the EEA, the United States included, under Standard Contractual Clauses, and the terms' own disclaimer warns that request data may sit on servers operated by Microsoft and OpenAI. No data residency option is offered to users. The jurisdiction is German: German law governs the contract and the Hamburg authority is the competent supervisor.