EditorAIPrivacy Policy
This Privacy Policy explains how FORB LABS, S.L. processes personal data when you use the EditorAI mobile application and its related websites and services (the "Service"). It has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD") and the other laws listed in section 3.
1. Data controller
The controller of your personal data, within the meaning of Article 4(7) GDPR, is:
- Company: FORB LABS, S.L. (Sociedad Unipersonal), a Spanish private limited company
- Tax ID (NIF): B93833242
- Registered office: C/ Francisco Benedito Roda 29, 30510 Yecla (Murcia), Spain
- Registry: Mercantile Registry of Murcia, 1st entry dated 22 July 2026
- Privacy contact: contact@editorai.me
- Application: EditorAI (iOS bundle identifier com.alejandroforte.autocut) · Website: editorai.me
Given the nature and scale of the processing, FORB LABS, S.L. is not required to appoint a Data Protection Officer. All privacy questions and requests can be sent to the email above.
2. Definitions
- App: the EditorAI application for iPhone.
- Service: the App, our servers and the websites operated by us for EditorAI.
- You or User: any person who downloads or uses the App.
- Personal data: any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
- Processing: any operation performed on personal data (Article 4(2) GDPR).
- Processor: a provider that processes personal data on our behalf (Article 28 GDPR).
- App identifier: a random code (UUID) created by the App on your iPhone the first time you use it and stored in your iPhone's Keychain. It is not your name, email, phone number or Apple ID, and it is not derived from your device's hardware.
- Edit: one run of the automatic editing on a video you choose.
3. Laws we follow
This Policy applies worldwide. We have designed the Service to comply with, among others:
- the GDPR and the LOPDGDD;
- Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE) and the ePrivacy Directive 2002/58/EC as transposed in Spain;
- the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025;
- the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other U.S. state privacy laws;
- Canada's PIPEDA and Quebec's Law 25;
- Brazil's General Data Protection Law (LGPD, Law 13.709/2018);
- Switzerland's Federal Act on Data Protection (FADP) and Australia's Privacy Act 1988.
If you live somewhere else, we apply the highest of these standards, without prejudice to any additional rights your local law gives you.
4. Data we process
4.1 Your videos
Videos you record in the App or pick from your Photos library stay on your iPhone. The App plays, cuts and exports them on the device. We never upload your videos or images. Drafts are saved in the App's private storage on your iPhone.
4.2 The audio of the video you edit
When you start an Edit, the App extracts the audio track of that video (compressed, 16 kHz mono) and sends it over an encrypted connection to our server. The audio contains your voice and whatever is said in the video, so it can include personal data about you or about other people who can be heard. Before the first Edit, the App explains this and asks for your explicit permission (see section 8).
Our server forwards the audio to Deepgram, which converts it to text with a timestamp for each word, and forwards that text (not the audio) to Anthropic's Claude model, which decides which takes to keep. The result (the words with their timings and the suggested cuts) is sent back to your iPhone. We do not store the audio or the transcript on our servers. See section 9 for how long our providers keep them.
4.3 Transcripts and edits on your iPhone
The transcript and your editing choices (which takes you keep, trims, drafts) are saved only on your iPhone, as part of the project, so you can come back to it. They are deleted when you delete the project or the App.
4.4 Teleprompter script
Text you write for the teleprompter, and the position and size of the teleprompter on screen, are stored only on your iPhone. We never receive them.
4.5 App identifier and integrity data
We store the App identifier on our server together with the data Apple's App Attest service produces to prove that requests come from the genuine App on a real iPhone: a key identifier, a public key and a counter. This data proves the integrity of the App; it does not reveal who you are.
4.6 Usage and limits
To apply the limits of your plan we store, linked to the App identifier: the seconds of video edited in the current monthly period and in the current day, the number of Edits, when each period started, and the last time the App contacted us. We also keep the plan we last checked with the subscription provider and when we checked it.
4.7 Subscriptions and purchases
Payments are made through Apple's App Store. We never receive your card or bank details. Our subscription provider, RevenueCat, receives from Apple and gives us: which product you bought, whether it is in its free trial, active, cancelled or expired, the relevant dates, the country or currency of the store, and transaction identifiers, linked to the App identifier.
4.8 Usage events (analytics)
We record a small number of events inside the App, linked to the App identifier, to understand which parts of the App and which plans work: for example, the answers you choose in the welcome questions (what you film, where you post, what slows you down, how long editing takes you, how many videos you post), that you saw, closed or used the subscription screen, the plan you selected, whether a purchase started, succeeded, failed or was cancelled, whether you restored purchases and whether the welcome flow was completed. Events do not contain your videos, audio, transcripts or scripts.
4.9 Social media usernames (optional)
If you choose to type your TikTok, Instagram or YouTube username during the welcome questions, we store it together with the usage events. It is entirely optional: you can skip that step and the App works exactly the same. We use it to understand what kind of creators use EditorAI and, in aggregate, to improve the product and our marketing. We do not connect to your social media accounts, do not access them and do not post anything.
4.10 Feedback
If you send us a message from Settings → Send Feedback, we store the text, the App version and the date, linked to the App identifier, so we can understand and act on it. Please do not include sensitive information in your messages.
4.11 Free edit and abuse prevention
Without a subscription you can try one free Edit. To keep it to one per device, even if you delete your data, we keep a one-way cryptographic hash (SHA-256) of the App identifier. To stop one place from obtaining many free Edits by cycling devices, we also keep a hash of your IP address combined with a secret key, which cannot be turned back into the address. Neither is linked to any other data about you.
4.12 Technical and security data
When the App connects to our server, our infrastructure provider (Cloudflare) necessarily processes your IP address and technical request data (time, route, response code, approximate size). We use them in real time to route the request, protect the Service (for example, rate limits per device and per IP address) and diagnose errors. Server logs include the App identifier, the length of edited audio, processing times and technical outcomes, never the audio or the transcript.
4.13 Device permissions
The App asks for the following permissions only when you use the related feature. You can change them at any time in iOS Settings.
- Camera and microphone: to record videos inside the App. Recordings stay on your iPhone.
- Photos: to let you pick videos to edit and to save the edited video to your library. We do not upload anything from your library.
5. What we do not collect
We do not collect your name, email address, phone number, postal address, contacts, precise or coarse location, photos or videos, face or biometric data, health data, advertising identifier (IDFA), or payment card details. We do not create accounts. We do not use cookies or similar technologies in the App. We do not knowingly collect special categories of data (Article 9 GDPR); however, if you record content that reveals them (for example, your health or beliefs), the audio is processed only to edit your video, as described in section 4.2, and is not stored by us.
6. Where the data comes from
Directly from you and your use of the App (sections 4.2 to 4.13), from Apple (App Attest results and App Store transactions, through RevenueCat) and from our own systems (usage counters and logs).
7. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Editing your video automatically (speech-to-text and choice of takes) | Audio of the video you edit, transcript | Your explicit consent to send it to AI providers (Art. 6(1)(a)), and performance of the contract you ask us for (Art. 6(1)(b)) |
| Providing the App, applying your plan's limits, refunding usage when something fails | App identifier, usage and limits, plan | Performance of the contract (Art. 6(1)(b)) |
| Managing subscriptions and restoring purchases | Subscription data | Performance of the contract (Art. 6(1)(b)) |
| Proving requests come from the genuine App, preventing fraud and abuse of free Edits, securing the Service | Integrity data, hashes, IP address, logs | Our legitimate interest in protecting the Service and its users (Art. 6(1)(f)); also Art. 6(1)(b), as limits are part of the plans |
| Understanding how the App is used and improving it | Usage events | Our legitimate interest in improving a product people pay for (Art. 6(1)(f)), with minimal, first-party events, and your right to object at any time |
| Understanding who uses EditorAI | Optional social media usernames | Your consent, given by choosing to enter them (Art. 6(1)(a)) |
| Answering and acting on your messages | Feedback | Your consent (Art. 6(1)(a)) and our legitimate interest in improving the Service (Art. 6(1)(f)) |
| Complying with legal obligations and defending legal claims | Any of the above, only as needed | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed it against your rights and kept the data to a minimum. You can object at any time (section 12). Data collected for one purpose is not used for an incompatible purpose without your consent. Providing data is not a legal requirement; the audio is necessary for the automatic editing, and the rest is either needed to run the Service or optional as indicated.
8. AI processing and automated decisions
EditorAI uses third-party artificial intelligence to edit your video: Deepgram (speech recognition) and Anthropic's Claude (choice of takes). As required by Apple's App Review Guideline 5.1.2(i), the App tells you this and asks for your explicit permission before any audio is sent for the first time. If you do not give it, you can still record, use the teleprompter and manage drafts, but the automatic editing will not run. You can withdraw your permission at any time (section 14).
Both providers act as our processors under data processing agreements. They process the data only to provide their service to us, and do not use it to train their models: we send every request to Deepgram with its Model Improvement Program opted out, and Anthropic does not train on data sent through its commercial API.
The editing is an automated suggestion about your own video. It does not produce legal effects concerning you or similarly significantly affect you, so it is not a decision covered by Article 22 GDPR. You always review the result and can restore, swap or trim any take before saving.
9. How long we keep data
| Data | Retention |
|---|---|
| Videos, projects, transcripts, scripts | Only on your iPhone, until you delete them or the App |
| Audio sent for editing | Not stored by us. Deepgram keeps it only while processing the request |
| Transcript sent to Claude | Not stored by us. Anthropic deletes API inputs and outputs within 30 days, except where the law requires longer or to enforce its usage policies |
| App identifier, integrity data, usage and limits, plan | While you use the App, and deleted 24 months after your last activity, or earlier if you use Delete My Data |
| Usage events and optional usernames | 24 months from collection, or until you use Delete My Data |
| Feedback | 24 months from receipt, or until you use Delete My Data |
| Hashes used for the free Edit | 24 months from the free Edit |
| Server logs | Up to 7 days |
| Purchase records held by Apple and RevenueCat | As set by those companies and by tax and accounting law |
After these periods, data is deleted or irreversibly anonymised. Where the law requires it, data may be kept blocked, available only to courts and authorities, for the limitation period of any possible liability.
10. Service providers and recipients
We do not sell or rent your personal data. We share it only with the following providers, who act as our processors under written agreements that require at least the same level of protection described in this Policy, and only as needed to provide the Service:
| Provider | What they do | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting of our server and websites, network and security | Global network; United States |
| Supabase, Inc. | Database (identifier, limits, events, feedback) | United States (Oregon) |
| Deepgram, Inc. | Speech-to-text of the audio you edit | United States |
| Anthropic, PBC | AI model (Claude) that chooses the takes, from the transcript | United States |
| RevenueCat, Inc. | Subscription management and restore | United States |
Apple Inc. and its affiliates process data as independent controllers when you buy through the App Store and when App Attest verifies the App, under Apple's own privacy policy. We may also disclose data to public authorities, courts or advisers when the law requires it or to defend our rights, and to a successor in the event of a merger, acquisition or sale of the business, who will be bound by this Policy.
11. International transfers
Some providers are located in, or may access data from, the United States and other countries outside the European Economic Area. Transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (and the UK and Swiss addenda), with additional measures such as encryption in transit and data minimisation. You can ask us for a copy of the relevant safeguards at the contact address.
12. Your rights
You have the right to:
- Access your data and receive a copy;
- Rectify inaccurate data;
- Erase your data ("right to be forgotten");
- Restrict processing in certain cases;
- Portability of the data you provided, in a structured, machine-readable format;
- Object to processing based on legitimate interest, including analytics;
- Withdraw consent at any time, without affecting processing already carried out;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects;
- lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). You may also contact the authority where you live or work.
How to exercise them. Because there are no accounts, the App identifier is how we find your data. The simplest ways are: Settings → Delete My Data (erasure, immediately), or Settings → Send Feedback, writing which right you want to exercise: messages sent from the App are linked to your App identifier, which lets us find your data and verify the request without asking for any identity document. You can also write to contact@editorai.me; in that case we may ask you to send the request from the App so we can link it to your data. We will answer within one month, extendable by two further months for complex requests, in which case we will tell you. Exercising your rights is free.
13. Deleting your data
Settings → Delete My Data deletes, at once and irreversibly, the record of your App identifier on our server (integrity data, usage and limits, plan), your usage events (including any usernames) and your feedback. It does not cancel your subscription, which is managed by Apple (Settings → your name → Subscriptions), and it does not delete the hash described in section 4.11, which is kept only to prevent repeated free Edits. Deleting the App removes everything stored on your iPhone except the App identifier in the Keychain, which iOS may keep so that your plan's limits continue to apply if you reinstall.
14. Withdrawing consent
You can withdraw your permission to send audio to our AI providers at any time from Settings in the App; the App will ask again before the next automatic Edit. To withdraw consent for other processing or to object to analytics, use Settings → Send Feedback or write to us. Withdrawal does not affect the lawfulness of processing carried out before it.
15. Security
We apply technical and organisational measures appropriate to the risk, including: encryption in transit (HTTPS/TLS) for every connection; verification with Apple App Attest that requests come from the genuine App on a real iPhone; short-lived signed access tokens; secret keys stored only on the server, never in the App; a database that only our server can access, with row-level security and no public access; rate limits and usage caps; one-way hashing of identifiers used for fraud prevention; minimisation (no audio or transcript is stored by us); and restricted access for staff on a need-to-know basis. No system is completely secure, but we review these measures regularly.
16. Data breaches
If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it where required (Article 33 GDPR) and, where the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay (Article 34 GDPR), through the App or our website.
17. On-device storage
The App stores on your iPhone: the App identifier and access tokens in the Keychain; your projects, drafts, script and teleprompter layout in the App's private storage; and whether you completed the welcome questions and gave your AI permission. These are necessary for the App to work (Article 22.2 LSSI-CE, strictly necessary exemption) or are your own content. The websites do not use cookies; they only store your language choice in your browser.
18. Children
The Service is intended for people aged 16 or over. We do not knowingly process data of children under 16 (or the higher age of digital consent in your country). If you believe a child has used the App, contact us and we will delete the data. Purchases by users under 18 require the consent of a parent or guardian, managed through Apple's Family Sharing and Ask to Buy.
19. Regional provisions
19.1 California and other U.S. states
In the last 12 months we collected the categories of personal information described in section 4: identifiers (App identifier, hashed IP address), commercial information (subscription status), internet or other electronic network activity (usage events, logs), audio information (processed transiently to edit your video, not retained by us) and, if you provide them, social media usernames and feedback. The business purposes are those in section 7. We do not sell or share personal information for cross-context behavioural advertising, have not done so, and do not use sensitive personal information for purposes that require a right to limit. You have the rights to know, delete, correct and opt out, and not to be discriminated against for exercising them. You may use an authorised agent. Requests are handled as described in section 12.
19.2 Canada and Quebec
You have rights of access, rectification and withdrawal of consent under PIPEDA and Law 25. The person responsible for the protection of personal information can be contacted at contact@editorai.me. Your data may be processed outside Quebec with the safeguards in section 11.
19.3 United Kingdom and Switzerland
You have the rights described in section 12 under the UK GDPR and the FADP. You may complain to the Information Commissioner's Office (ico.org.uk) or the Swiss FDPIC.
19.4 Brazil
Under the LGPD you have the rights listed in its Article 18, including confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing and revocation of consent. You may complain to the ANPD.
19.5 Australia
We handle personal information in line with the Australian Privacy Principles. You may complain to us and, if unsatisfied, to the Office of the Australian Information Commissioner (OAIC).
20. Tracking and advertising
EditorAI does not show advertising, does not use advertising or tracking SDKs, does not access your advertising identifier and does not track you across apps and websites owned by other companies. For this reason the App does not ask for App Tracking Transparency permission.
21. Changes to this Policy
We may update this Policy to reflect changes in the Service or the law. We will publish the new version with its date and, if the changes are significant, we will let you know in the App before they take effect and, where required, ask for your consent again.
22. Language
This Policy is written in English. If we provide a translation, the English version prevails.
23. Contact
FORB LABS, S.L. · C/ Francisco Benedito Roda 29, 30510 Yecla (Murcia), Spain · contact@editorai.me