2short.ai

GDPR overview

The privacy policy names the GDPR explicitly and enumerates six rights: access with a copy, rectification, erasure, restriction of processing, objection and portability. Requests go by email to hey@2short.ai. The same policy states that personal information is stored on secure servers located within the European Union. Implementation stops there. No data protection officer is named, no Article 27 representative is appointed, and no postal address or legal entity appears anywhere on the site. The policy mentions no customer DPA, no list of sub-processors, no legal basis for processing, no numeric retention period, no transfer outside the EU, no standard contractual clauses and no minimum age. It is dated 17 February 2023 and has not been revised since.

Who owns the data?

2short.ai publishes no terms and conditions at all: the /terms path simply returns the home page. Nothing on the site therefore states who owns the source material you submit or the clips the AI produces. The only legal text is a privacy policy dated 17 February 2023. It lists the personal data collected: IP address, email, first and last name, profile picture and language preference, plus full name, email, picture and language when you sign in with Google. It commits that "We do not sell or share your Google user data with any third-party companies, except as necessary to provide you with our services", allows processing agreements with contractors, and reserves disclosure on legal request, with notice unless notice is prohibited.

Reuse rights

Because 2short.ai publishes no terms and conditions, nothing on the site tells the end user what may be done with the clips they generate. There is no licence clause, no copyright wording and no assignment of rights anywhere in the published material. In practice the product is sold as a way to republish clips on YouTube, TikTok and Instagram, and the home page advertises unlimited 1080p exports with no watermark, so commercial reuse is plainly the intended purpose. That intent is carried entirely by the marketing copy, however, and is never formalised in a contract. Anyone who needs written permission to reuse their own output will not find it here.

Data retention & training

Hosting summary

The privacy policy states that the personal information collected by 2short.ai is stored on secure servers located within the European Union. That single sentence is the whole of the jurisdiction claim: no country is named and no hosting provider is identified. The policy adds that strict access controls and regular monitoring are in place, but gives no detail and cites no certification; nothing on the site mentions SOC 2, ISO 27001 or any equivalent audit. One AI sub-processor is named in prose, OpenAI with its GPT-3 model, without any indication of where that processing happens. No sub-processor list is published and no data processing agreement is offered to customers. The domain itself sits behind Cloudflare, at IP 172.67.133.188, which is an anycast delivery node rather than a storage location and therefore says nothing about where the data actually rests. In short: an EU claim at region level, no country, no named provider, no certification and no documented chain of sub-processors.