Social Shorts Privacy Policy

This Privacy Policy explains how 1A 2A, LLC, a Wyoming limited liability company ("Company," "we," "us," "our"), operator of Social Shorts (the socialshorts website), collects, uses, shares and protects personal information. We are the "controller" (GDPR) and "business" (CCPA/CPRA, if applicable) for this data.

1. Information We Collect

Account data: email address and magic-link authentication data (tokens, session identifiers) via Supabase.
Billing data: name, billing address, subscription, overage and bundle purchases, card brand/last four via Stripe.
User Content: files you upload, media from your own connected channels, Creator Program and Creative Commons sources you select, and the audio/video, transcripts and captions derived from them. These may include voices, faces, and names of people appearing in content. We do not use content to identify individuals. We do not create biometric identifiers: captions come from speech-to-text only, and we create no face prints or voice prints.
Usage data: minutes processed, clips generated, posts counted.
Connected social accounts: if you connect accounts to post, OAuth tokens and account identifiers. You connect your own YouTube, TikTok and Instagram accounts through OAuth so we can post on your behalf; you can disconnect them at any time.
Mailing-list consent records: email, opt-in status, consent timestamp, source.
Device and usage data: IP address, browser type, pages viewed, timestamps, and similar log data; cookies as described in our Cookie Policy.
Communications: messages you send to support.

We do not knowingly collect information from children under 13 (or under 16 in the EEA/UK). We do not collect full payment card numbers; Stripe processes them.

2. How We Use Information and Legal Bases (GDPR)

Purpose	Legal basis
Provide the Service, authenticate you, process subscriptions	Performance of contract
Send transactional emails (sign-in links, receipts, trial reminders, price-change notices)	Contract; legal obligation
Send marketing emails	Consent (withdrawable at any time)
Security, fraud prevention, debugging, improving the Service	Legitimate interests
Tax, accounting and legal compliance	Legal obligation

3. Mailing List

We do not currently send marketing emails. If we start, we will send them only if you opted in. We record your consent, including the date/time (timestamp), the form or page used, and your IP address. Before we do, each will include our valid postal address and an unsubscribe link. We process unsubscribes within 10 business days.

4. Subprocessors / Service Providers

Provider	Purpose	Location
Lovable Cloud / Supabase, Inc.	Web hosting, database, file storage, magic-link authentication, transactional email	United States
Stripe, Inc.	Payment processing, Checkout, billing	United States
Lovable AI gateway	AI processing (transcription, captioning, clip selection)	United States
Self-hosted worker (operated by us)	Video processing and rendering	United States

We will update this list when providers change. We do not use analytics or advertising trackers. We do not use User Content to train AI models, and we do not permit our AI providers to do so, under the terms we use.

5. Sharing

We do not sell personal information and do not "share" it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA). We disclose information to the service providers above under contract, when required by law or to protect rights and safety, and in connection with a merger, acquisition or asset sale.

6. International Transfers

We are based in the United States. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where a provider is certified.

7. Retention

We keep account data while your account is active and delete it 30 days after your account or subscription ends. Billing records are kept for 7 years, consent records as long as needed to prove consent, and logs until the same 30-day deletion. Backups are purged within 35 days after deletion.

8. Your Rights

EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of consent at any time, and the right to complain to your local supervisory authority.

California (CCPA/CPRA): the right to know/access the categories and specific pieces of personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or share), the right to limit use of sensitive personal information (we do not use it for purposes requiring that right), and the right not to be discriminated against for exercising rights. Categories collected in the last 12 months: identifiers (email, IP), commercial information (subscription history), internet activity, and inferences only as described above; sources and purposes are described in Sections 1-2. You may use an authorized agent. We will verify requests by confirming control of your account email.

To exercise rights, email cthruos+socialshorts@mail.grokbot.com. We respond within the time required by law (generally 30 days under GDPR, 45 days under CCPA).

9. Security

We use reasonable administrative, technical and physical safeguards, including encryption in transit. No system is perfectly secure.

10. Changes

We will post updates here with a new "Last updated" date and notify you of material changes.

11. Contact

1A 2A, LLC (Wyoming)
Contact: cthruos+socialshorts@mail.grokbot.com Email: cthruos+socialshorts@mail.grokbot.com
EU/UK representative: not currently appointed, unless the law requires one.