Privacy policy

The controller responsible for processing personal data on this website and in connection with the SCALECUT.AI platform is:

Sören Hammerschmidt
Andreas-Gayk-Straße 13
24103 Kiel
Germany
Email: [email protected]
Phone: +49 431 60802488

When you access our website, our hosting infrastructure processes technically necessary access data, including:

We process this information to provide the website, maintain its stability and security, and diagnose errors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and technically reliable provision of our online services.

If you contact us by email or otherwise, we process the information you provide to respond to your request.

The legal basis is Article 6(1)(b) GDPR where the request concerns entering into or performing a contract, and otherwise Article 6(1)(f) GDPR.

You can register on our website for the closed beta and information about available places, features, product updates, and selected news about SCALECUT.AI.

We use a double opt-in process. Registration becomes active only after you follow the confirmation link in the email, actively accept the terms and email consent on the following page, and complete the confirmation.

We process the information needed to manage the list, document consent, contact you, and prevent abuse, including:

Processing is based on your consent under Article 6(1)(a) GDPR. We retain evidence of consent to meet our accountability obligations under Articles 5(2) and 7(1) GDPR.

You can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal.

When you register for and use SCALECUT.AI, we process the data necessary to create and manage your user account and provide the platform.

This may include:

We process these data to take steps before entering into a contract, perform the contract, and provide the platform's functions.

The legal basis is Article 6(1)(b) GDPR.

SCALECUT.AI processes content that users upload to or create on the platform.

This includes in particular:

We process these data to provide the platform, carry out requested processing, diagnose errors, provide support, assure quality, and develop the platform's technical capabilities and functions.

Where necessary for operation, support, error diagnosis, or quality assurance, authorized people may also inspect and review content manually.

Internal access is restricted to people who need these data for operation, support, analysis, testing, or development.

For data from Google services and content derived from them, the narrower purpose and access restrictions in the Google Drive section take precedence. The general statements about quality assurance, development, and manual review do not expand these permissions.

The legal basis is Article 6(1)(b) GDPR. Processing beyond contract performance that is necessary for system security, abuse prevention, quality assurance, or product improvement is based on Article 6(1)(f) GDPR.

You can voluntarily connect a Google account to the Brand currently selected in ScaleCut. Sign-in and authorization take place at Google. ScaleCut receives the verified email address, a technical Google account ID, and access tokens; your Google password is not sent to ScaleCut.

The standard connection uses drive.file: ScaleCut can use files you explicitly select in Google Picker or create with ScaleCut. When you select video files as pipeline inputs, we initially store only references and metadata such as names, types, sizes, content identifiers, and technical file identifiers. Only before a pipeline run you request are new or changed media downloaded through a ScaleCut storage service, validated, and stored for processing. Unchanged, previously validated copies are reused. For exports, we transfer your selected processing results from ScaleCut storage to the Google Drive destination folder you authorize.

Optional folder imports and MAX-i Drive searches may require separate consent to drive.readonly once these features are enabled. This Google permission technically allows reading and downloading all accessible Drive files; it is not restricted to the selected folder. Setting up or refreshing linked input folders reads only metadata and references for suitable videos directly within them. Before a pipeline run you request, ScaleCut reconciles the current contents again; only then are new or changed media files downloaded. It does not follow subfolders or shortcuts. Read-only permission does not allow changes to or deletion of your Drive originals.

MAX-i accesses the authorized Brand connection only in response to a current Drive request. A search reads bounded file metadata, such as names, types, sizes, and file identifiers. Matching results with names, types, sizes, and Drive links are sent to OpenAI to answer your request. An explicitly named folder restricts the search to its direct contents; without a folder, a requested name search can cover the connected Drive. A search alone does not download media content. Ordinary conversation does not automatically load Drive contents or all search results into the conversation context.

If you explicitly ask MAX-i for a visual check, ScaleCut may temporarily download and validate selected videos or images before importing them. OpenAI receives newly generated contact sheets with file names and timestamps, using up to four frames sampled across each video. The original file is not sent to OpenAI for this visual check. These samples do not cover every moment of a video and include no audio analysis. A visual check alone does not import a file; import requires an explicit request, which can be given together with the visual-check request. Such a MAX-i import immediately downloads the selected media through the ScaleCut storage service into the requested pipeline input; it does not wait for a pipeline run.

The connection and its sources belong to the selected Brand. Authorized members of that Brand can use them through the available features and access imported project files. Only select content you intend to share with that Brand. Connecting an account does not itself start video or AI processing. Imported files are processed in the pipeline steps you request; the infrastructure and AI providers described under Service providers and recipients may receive the data necessary for those steps.

The following use restrictions take precedence for Google data and content derived from them: we use them only for the visible ScaleCut features you request. Google data must not be used or disclosed for advertising, sale of data, creditworthiness assessment, or training or improving general AI or machine learning models. These restrictions also apply to our service providers. They may receive Google data only as necessary to provide the requested feature or to meet a permitted security or legal obligation. This does not promise immediate deletion of technical processing or security data held by a service provider.

Staff and service providers may access Google data only with your prior explicit agreement to access the specific files or data, where necessary for security purposes such as investigating a bug or abuse, or where legally required. Internal analysis of aggregated, anonymized data is permitted only within applicable privacy law and Google policies. General acceptance of the terms does not replace consent to inspect specific Google files.

ScaleCut's use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. These restrictions apply to the Google data received and content derived from them. The applicable policies are linked below.

ScaleCut stores access tokens encrypted and retains technical job records for transfers, progress, and retries. Temporary download copies are removed after transfer; interrupted transfers are handled by cleanup routines. Completed import jobs are cleaned up after 30 days. Failed imports with no update for seven days are scheduled for cleanup, which removes retry eligibility and unpublished file copies. Operational disruptions may delay these cleanup processes.

MAX-i search references and contact sheets in the private preview cache are bound to a job with a maximum validity of 30 minutes. After expiry they cannot be retrieved through that job and are removed by cleanup; disruptions may delay physical cleanup. Temporary originals used for visual checks are removed after the check. This period does not apply to imported project files, answers and result links saved in chat, or technical job artifacts. Their retention and deletion follow the relevant project and job lifecycle.

Saved file and folder sources remain until the source is removed. Technical mappings between Drive files and imported files avoid copying unchanged media again and remain until the project is permanently deleted. When a file is absent during a successful source reconciliation before a pipeline run, only the copy proven to belong to that source is removed from its input cache. Removing a source does the same for its associated cached input files. Storage cleanup protects files still referenced elsewhere. Manual uploads, other project files, previously generated outputs, and Drive originals are not deleted by this cleanup. Historical copies without a proven source association remain. If reconciliation fails, the previous contents remain and a pipeline start with stale inputs is rejected. You can delete project files in ScaleCut. Projects moved to the trash are scheduled for permanent deletion after 30 days; active jobs or restores can delay deletion. You can also use the project's permanent deletion function before that period ends.

You can disconnect the account under Settings → API & Integrations or revoke access in your Google account. Disconnecting removes the active access tokens from the ScaleCut connection. Previously imported project files and files already exported to Google Drive remain and are managed in the respective service. Backup copies may remain until their scheduled deletion or overwrite; the 30-day period above does not promise simultaneous deletion of all backups. For access or deletion requests, contact the privacy email address above.

When you book an appointment through ScaleCut, we process the contact and appointment information entered in the booking form to arrange it. If Google Calendar is connected, we check busy periods in the connected business calendar. The public booking page shows available times; it does not publish private calendar entries.

After you confirm the booking, the necessary details, including your name, email address, appointment time, and any information you provide about the appointment, are sent to Google Calendar. Google creates the calendar event and, where available, a Google Meet link and sends the calendar invitation. A cancellation through ScaleCut is forwarded to the corresponding Google event.

Where we process personal data on behalf of customers, this is governed by a data processing agreement under Article 28 GDPR.

We use technical service providers to deliver our services, particularly for hosting, infrastructure, authentication, storage, email, analytics, and AI processing.

Recipients or categories of recipients may include:

Where legally required, we engage these providers under data processing agreements.

Where we use providers in third countries or transfers to third countries cannot be ruled out, transfers take place only in accordance with legal requirements.

Where required, we rely in particular on adequacy decisions or standard contractual clauses.

We retain personal data only as long as necessary for the relevant processing purposes or required by law.

We generally retain account and contract data for the duration of the contractual relationship and subsequently within statutory retention periods.

We generally retain platform content only as long as necessary to provide features, support, error diagnosis, security, or meet contractual obligations.

Unless expressly agreed otherwise, users remain responsible for their own backups and external copies of their data.

We generally retain waiting list data until you unsubscribe, withdraw consent, or the purpose of contacting you no longer applies.

Subject to the applicable legal conditions, data subjects have the following rights:

Where processing is based on consent, you can withdraw it at any time with effect for the future.

Data subjects have the right to complain to a data protection supervisory authority about the processing of their personal data.

Where personal data are required to enter into a contract, create an account, or use the platform, providing those data is necessary.

Without those data, we may be unable to provide some or all of the relevant services.

Automated decision-making within the meaning of Article 22 GDPR does not take place unless expressly stated otherwise in an individual case.

We may update this privacy policy where required by legal, technical, or organizational changes.