Privacy Policy

3.1 Account and Contact Information

• Name, email address, password, role (Admin, Manager, Editor, Viewer, Speaker), organization name, job title.
• Contact details you provide when you sign up, log in, or contact support.

3.2 Event and Project Data

• Event metadata: event name, description, location, dates, runsheets (session titles, speaker names, scheduled times, speaker emails).
• Project metadata: stream key assignments, room/stage names, project names, brand kits, integration settings.

3.3 Video, Audio, and Transcript Data

When our clients stream or upload content into Eventcut, we process:

• Video and audio streams (live RTMPS/SRT ingest and uploaded footage).
• Automatically generated transcripts of sessions, including spoken words of speakers and participants, timestamps, topics, and quotes.
• AI-derived metadata (segments, topics, quotes, clips, storyboard suggestions) used to power our editing and agent features.

Depending on the content, this may include personal information such as names, voices, images, opinions expressed in sessions, job titles, and organization names.

3.4 Usage and Log Data

• IP address, browser type, operating system, device identifiers.
• Log data about your interactions with the platform: pages viewed, buttons clicked, time stamps, stream status (started/ended), processing and render events, error logs.
• Usage metrics (e.g., streaming hours, projects created, integrations used) for billing and performance monitoring.

3.5 Cookies and Similar Technologies

We use cookies and similar technologies to:

• Remember your login and organization workspace.
• Measure website and product usage (analytics).
• Improve performance and security.

Where required by law, we will provide a cookie banner and/or consent mechanism describing cookie categories and allowing you to manage preferences.

3.6 Support and Communications

• Content of support chats and tickets, including information provided to our built-in AI support assistant and human support technicians.
• Emails and other communications you send to us.

4.1 Providing and Operating the Eventcut Platform

Purposes:

• Authenticate users and manage accounts and roles.
• Ingest, process, and store streams and uploaded footage to provide real-time editing, segmentation, quotes, clips, branding, and exports.
• Implement runsheets, speaker delivery features, and event/project organization.

Legal bases (GDPR):

• Performance of a contract (Art. 6(1)(b))—with the client or user who has agreed to our terms.
• Legitimate interests (Art. 6(1)(f))—running and improving our platform for customers.

4.2 Agentic Reasoning and Automated Content Assistance

Purposes:

• Use AI and reasoning engines (including Sanscritic) to suggest segments, topics, quotes, highlight storyboards, and content structures for events.
• Assist users in finding important moments, generating clips, and structuring highlight reels.

Legal bases (GDPR):

• Performance of a contract (Art. 6(1)(b))—providing requested features to clients.
• Legitimate interests (Art. 6(1)(f))—innovating and improving event content workflows, balanced by appropriate safeguards.

Where required, we will obtain consent (Art. 6(1)(a)) for specific AI features or explain any automated decision-making that may have legal or similarly significant effects, and offer human review.

4.3 Integrations and Delivery

Purposes:

• Push rendered content (clips, highlight reels) to third-party platforms like YouTube, Vimeo, Facebook Pages, Instagram, cloud storage, and other integrations configured by the client.

Legal bases (GDPR):

• Performance of a contract (Art. 6(1)(b)) with the client.
• Legitimate interests (Art. 6(1)(f)) in providing delivery features requested by clients.

4.4 Billing, Administration, and Compliance

Purposes:

• Track usage and generate invoices (streaming hours, projects, seats).
• Manage subscriptions, seat licensing, hardware device licensing, and compliance (audit logs, GDPR-related records).
• Comply with legal obligations, such as tax and accounting requirements.

Legal bases (GDPR):

• Performance of a contract (Art. 6(1)(b)).
• Legal obligation (Art. 6(1)(c))—where laws require retention of certain records.

4.5 Security, Fraud Prevention, and Service Improvement

Purposes:

• Monitor and protect the security of the platform and data (e.g., abuse detection, incident response).
• Analyze usage patterns to improve performance and usability.

Legal bases (GDPR):

• Legitimate interests (Art. 6(1)(f)) in maintaining secure, reliable services.

4.6 Marketing and Communications

Purposes:

• Send product updates, announcements, and invitations to events (e.g., webinars, demos) to existing customers and prospects.
• Operate newsletters or similar communications if you subscribe.

Legal bases (GDPR):

• Legitimate interests (Art. 6(1)(f)) for B2B marketing, with opt-out options.
• Consent (Art. 6(1)(a)) where required (e.g., for certain email marketing).

You can opt out of marketing communications at any time using the unsubscribe link or by contacting us.

5.1 Service Providers and Processors

• Cloud hosting providers.
• Infrastructure and monitoring services.
• Email and ticketing providers.
• Analytics providers.

These parties are contractually required to process personal information only on our instructions and to maintain appropriate security.

5.2 Integrations Configured by Clients

When clients configure integrations (e.g., YouTube, Vimeo, Facebook Pages, Instagram, Google Drive, Dropbox, S3, JW Player, Wowza), we send rendered content and associated metadata to those platforms on their behalf.

Where a client connects a Facebook Page or an Instagram account, we use that connection only to deliver content the client has chosen to publish. With the client's authorisation we retrieve the list of Pages and Instagram accounts the connecting user administers, including those held in a Meta Business portfolio, along with each Page or account name, identifier and access token, and we read the Page or account metadata needed to show the client which destination they are publishing to. We use the access token to upload rendered video to the selected Page or account as a draft or unpublished post, so that the client reviews and publishes it themselves. We do not use the connection to read private messages, and we do not publish anything the client has not explicitly sent. We retain the identifier and token in line with section 7 (Data Retention) for as long as the client keeps the integration connected.

Those platforms act as independent controllers of the data once received; their privacy policies apply.

5.3 Affiliates and Professional Advisors

We may share information with our affiliates, lawyers, accountants, and other professional advisors as necessary for business operations and legal compliance.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal information may be transferred as part of the transaction, subject to applicable law.

5.5 Legal Requirements

We may disclose information where required by law, regulation, legal process, or governmental request, or to enforce our terms, protect our rights, or prevent harm.

8.1 Rights Under GDPR (EU/UK)

If you are in the EU/EEA or UK, you have the following rights regarding your personal data, subject to restrictions and exceptions:

• Right of access: obtain confirmation and a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): request deletion in certain circumstances.
• Right to restriction of processing: limit processing in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used format and transmit it to another controller.
• Right to object: object to processing based on legitimate interests or direct marketing.
• Right not to be subject to certain automated decisions, including profiling, that have legal or similarly significant effects.

You also have the right to lodge a complaint with a supervisory authority in your country if you believe our processing violates GDPR.

8.2 Rights Under CCPA/CPRA (California)

If you are a California resident and CCPA/CPRA applies to us as a “business”, you may have the following rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, and (if applicable) sold or shared in the preceding 12 months.
• Right to delete: request deletion of personal information we hold about you, with certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: if we sell or share personal information, you can opt out.
• Right to limit use of sensitive personal information: if we process sensitive PI, you may limit its use to what is necessary to provide services.
• Right to non-discrimination: we will not discriminate against you for exercising your rights.

We will provide at least two methods for submitting requests, such as an email address and a web form.

8.3 How to Exercise Your Rights

To exercise any of these rights:

• Email us at mail@editonthespot.com.
• Use any web forms or in-product mechanisms we provide for privacy requests.
• For California residents, we will follow applicable verification procedures for “verifiable consumer requests.”

We may need to verify your identity before fulfilling your request. In some cases, we may deny or limit a request where permitted by law (for example, when we must retain data for legal obligations or where rights conflict with client instructions).