Oracut
DeutschCreate account

Privacy Policy

Last updated: 14 October 2026

This policy explains which personal data we process when you use the website www.oracut.com and the Oracut plugin in ChatGPT, why we do so and what rights you have. In short: we show no ads, use no tracking or analytics services, sell no data and do not use your videos to train AI models.

1. Controller

Handgraaf, Luca & Leineweber, Kai GbR, represented by the partners Luca Handgraaf and Kai Leineweber
Girardetstraße 76, 45131 Essen, Germany
Email: support@oracut.com · Contact form

We are not required to appoint a data protection officer. For any privacy question, please contact us at the address above.

2. Visiting the website

When you open our website, our hosting provider Vercel processes technically necessary access data: IP address, date and time, the requested address, amount of data transferred, browser and operating system. This is necessary to deliver the website, run it reliably and fend off attacks (Art. 6(1)(f) GDPR). These logs are kept only briefly, at most 30 days.

Fonts and images are served from our own server; your browser does not connect to Google or other third parties for them.

We choose the language of the website (English or German) automatically from your browser's language settings; if your browser names neither language, from the country Vercel derives from your IP address. This happens only at the moment of the request and is not stored (Art. 6(1)(f) GDPR).

Cookies

We set only strictly necessary cookies: oracut_session keeps you signed in to the website until you sign out, for at most 30 days. oracut_lang remembers the language you picked in the language switch, for one year. Both are strictly necessary for the service you requested (§ 25(2) no. 2 German TDDDG) and therefore require no consent. There are no tracking, advertising or analytics cookies, which is why you see no cookie banner.

3. Account and sign-in

For an account we process your email address, a hash of your password (we never know or store your password in plain text), your name if you provide it, your plan, and the time you confirmed your email address and accepted the terms. We use this to provide Oracut to you (Art. 6(1)(b) GDPR) and keep it until you delete your account, which you can do at any time under My account.

To activate your account we send you an email with a confirmation link. This and other emails relating to your contract (e.g. confirmations of receipt) are sent via the email service of our hosting provider Hostinger (Art. 6(1)(b) GDPR).

4. Use within ChatGPT

When you connect Oracut in ChatGPT, you sign in on our website and allow ChatGPT to access your Oracut account on your behalf (OAuth). ChatGPT receives a time-limited access token. During use, ChatGPT sends us your requests to the Oracut tools, and we return their results, e.g. the status of your clips, the recognised sentences and captions. OpenAI is independently responsible for the processing within ChatGPT; OpenAI’s privacy policy applies. Our legal basis is Art. 6(1)(b) GDPR. You can disconnect at any time in ChatGPT.

5. Videos, clips and their processing

At the core of Oracut, you upload videos and we create clips from them. We process the video itself (image and sound, including the appearance and voice of the people in it), the transcript with timestamps, the edit list, captions, motion graphics, the finished clips, preview videos and thumbnails, and technical details such as length, size and resolution. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

  • Your browser uploads the video directly to our file storage (Cloudflare R2, located in the EU) – not via ChatGPT.
  • On Scaleway servers in Paris the audio track is extracted and sent to an AI service for transcription (section 6). The video is then cut, captioned and rendered.
  • For landscape videos, software on these servers detects where faces are in the frame so that the 9:16 crop follows the speaker. Only positions in the frame are determined; people are not identified or recognised, no biometric templates are stored, and the position data is deleted after processing.
  • Nobody at Oracut watches your videos. We use them for no purpose other than creating your clips.

Files are deleted automatically:

  • Uploaded original videos: on the Free plan after 7 days, on paid plans after 14 days.
  • Finished clips, previews, thumbnails and caption files: on the Free plan after 7 days, on paid plans after 60 days.
  • Transcripts, edit lists and caption texts remain with the clip in your account until you delete the account.
  • Upload and download links are valid for 1 hour only.

People in your videos: If other people can be seen or heard in your videos, you are responsible for being allowed to show them (see our terms). We process their data only on your behalf to create your clips, based on our legitimate interest in providing the service you ordered (Art. 6(1)(f) GDPR).

6. Artificial intelligence

Oracut uses AI models for three tasks: transcribing the compressed audio track into text with word timestamps; suggesting the strongest passage for the chosen target length and a title; and suggesting moments and short texts for motion graphics.

For this we send only the audio track or the text – never the image – to the service OpenRouter (OpenRouter, Inc., USA), which routes the requests to AI model providers. We have technically restricted routing to providers that neither store the data nor use it for training (“zero data retention”). Which provider handles a request depends on availability (data centres of major cloud and AI providers such as Google, Anthropic or OpenAI, including in the USA); we will tell you the specific providers on request. The results are suggestions that you can change at any time. No automated decision with legal effect on you within the meaning of Art. 22 GDPR takes place.

7. Payment

Paid plans are sold and billed by Lemon Squeezy, LLC (USA) as reseller (“merchant of record”). You enter your payment details directly with Lemon Squeezy; we do not receive them. Lemon Squeezy is independently responsible for this processing; its privacy policy applies (lemonsqueezy.com). We receive from Lemon Squeezy the information we need to activate your plan and support you: name, email address, country, plan, order and subscription number and subscription status. The legal basis is Art. 6(1)(b) GDPR and, where we must retain records, Art. 6(1)(c) GDPR together with commercial and tax retention periods (up to 10 years).

To account for your credits we keep a ledger of credit bookings (grant, reservation, charge, refund, expiry) and the monthly cost of AI processing for your account, to perform the contract (Art. 6(1)(b) GDPR) and to protect against misuse and disproportionate costs (Art. 6(1)(f) GDPR).

8. Contact form, withdrawal, cancellation and notices

If you contact us via the contact form, by email or via the forms “Withdraw from contract”, “Cancel contracts here” or “Report content”, we process your details (e.g. name, email address, contract, message) to handle your request and send you a confirmation of receipt. The legal basis is Art. 6(1)(b) GDPR (requests about your contract), Art. 6(1)(c) GDPR (legal obligations, e.g. withdrawal, cancellation and notices under the Digital Services Act) and otherwise Art. 6(1)(f) GDPR. We delete this data when it is no longer needed, at the latest after three years (end of the regular limitation period), unless longer statutory retention periods apply.

9. Service providers and recipients

We work with carefully selected processors who process data only on our instructions (Art. 28 GDPR):

  • Vercel Inc., USA – hosting of the website and plugin server; server region Frankfurt.
  • Neon Inc., USA – database (account, credits, clip data); located in Frankfurt.
  • Cloudflare, Inc., USA – R2 file storage for videos and clips; located in the European Union.
  • Scaleway SAS, France – video processing (analysis, cutting, captions, rendering); data centre in Paris.
  • OpenRouter, Inc., USA – routing to AI model providers (section 6), including their sub-processors.
  • Hostinger International Ltd., Cyprus – sending and receiving emails.

Independent controllers: Lemon Squeezy, LLC, USA (sale and billing of paid plans, section 7) and OpenAI (operation of ChatGPT, section 4).

Beyond this, we only disclose data where we are legally obliged to (e.g. by order of an authority) or where necessary to enforce our rights.

10. Transfers outside the EU

Some service providers are based in the USA, so data may be transferred to the USA. We choose storage and processing locations in the EU wherever possible (website, database, files and video processing). Where data does reach the USA, this is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) if the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

11. Security

All connections are encrypted (TLS). The file storage is private; files can only be accessed via short-lived signed links. Passwords are stored only as a secure hash. Access to our systems is limited to the partners and protected by strong passwords and separate access keys with minimal permissions.

12. Minimum age

Oracut is intended for people aged 16 and over. We do not knowingly process data of children under 16.

13. Obligation to provide data

You are not obliged to provide data. Without an email address and password, however, we cannot create an account, and without a video we cannot create a clip.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) – you can delete your account with all data at any time yourself –, restriction of processing (Art. 18) and data portability (Art. 20).

Right to object (Art. 21 GDPR): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation.

Just contact support@oracut.com. You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

15. Changes

We update this policy when Oracut or the law changes. The version published here applies; we inform registered users of material changes by email.

This English version is provided for information. In case of discrepancies, the German version prevails.