Privacy Policy

MaestroCut (maestrocut.com) is operated by Mehmet Seyrimez, who is the controller of the personal data described in this policy (the “data controller” under GDPR and the “veri sorumlusu” under Türkiye’s KVKK). Questions and requests: info@maestrocut.com.

This policy covers the website maestrocut.com, the studio (/app) and the e-mails about your account.

• Account: your e-mail address; the name you enter (optional) or, if you sign in with Google, the name on your Google profile; whether and when your address was confirmed; the sign-in methods you use (e-mail and password, Google); your role, credit balance, and when you signed up, last signed in and were last active. Your password is checked by our sign-in provider, Supabase Auth, which stores only a hash of it; passwords are never stored in plain text.
• Where you came from: the page, campaign tag (UTM) and referring website that brought you, and the page where you clicked sign up. Also a keyed hash (HMAC) of the network you signed up from; the IP address itself is not stored, and the hash is deleted after 180 days.
• Your content: briefs (what you write about your brand or product), text read from a website you ask us to read, project settings, scripts and scene texts, the images and logos you upload, music and photos you add from the library (with their licence details), and the videos and covers you export.
• Credits: every change to your balance (gifts, codes, plan credits, purchases, exports, refunds, admin corrections) with its time and reason, and the promo codes you redeem.
• Plan and payments: your plan, your subscription’s status and period dates, your Paddle customer and subscription IDs, the amount and currency of your payments, and the transaction notifications Paddle sends us. Your card details, billing address and payment method stay with Paddle and never reach us.
• Usage events: a small set of first-party events (sign-up, export queued, free tool used, sign-up button clicked, demo played, a visit arriving from an AI assistant) with the page, language and source. These records hold no IP address, browser details or tracking ID; when you are signed in, an event is linked to your account.
• AI usage records: for each AI call, the step and model, whether it worked, how long it took and the token counts, linked to your account and project. We keep them for usage limits and quality.
• Security data: session records (a hash of the session token, its expiry and your browser’s user-agent string), short-lived attempt counters keyed by network address (and by e-mail for failed sign-ins), and our hosting provider’s standard request logs. When an admin changes something on your account (a credit correction, for example), the change is logged with its reason.

• To provide the service (account, studio, previews, video exports, credits): performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Security and abuse prevention (attempt limits, the sign-up network hash, session records, stopping the welcome gift from being collected over and over): our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Improving the service (seeing which pages work and where sign-ups come from): our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Legal obligations where they apply: GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç).

We do not sell your data, we show no ads, and we use no advertising or third-party analytics cookies.

To write scripts and copy, the text of your brief (and text from a website you ask us to read) is processed by AI language model providers: the model generates the text and returns it to us. If no model answers, our rule-based writer produces the copy instead.

The images and logos you upload are not sent to AI models; they are processed by our own code and used only in your videos.

We process your data with these providers, working on our behalf, only as far as the service needs:

• Supabase: sign-in (accounts and password checks), the database and file storage, on servers in the EU (Frankfurt, Germany).
• Paddle (Paddle.com): our payment processor and the Merchant of Record for our orders. When you buy a plan or a credit pack, Paddle collects and processes your name, e-mail address, billing address and payment details under its own privacy policy, and handles invoices, tax, refunds and payment support. We store only your plan and subscription IDs, their status and the payment amounts. The checkout window on our pages is loaded from Paddle.
• Vercel: hosting and delivering the website.
• GitHub (GitHub, Inc. / Microsoft): storing encrypted backups (see “Security” below).
• Hostinger: sending account e-mails (confirmation and password reset links) from info@maestrocut.com.
• Google: only if you choose “Continue with Google”, Google confirms who you are and gives us your e-mail address and name. The Google button on the sign-in pages is loaded from Google and governed by Google’s own policies.
• AI model providers: generate scripts and copy from the text of your brief (see above).
• Openverse, Jamendo, Wikimedia and Pexels: when you search the music or stock photo library, your search terms go to these services, and previews and thumbnails load in your browser straight from their servers.
• Google Fonts: the video preview loads the fonts of the style you pick from Google Fonts, so your browser connects to Google’s servers.
• The render servers that turn your videos into MP4 files are operated by us.

Some of these providers (for example Vercel, Google and AI model providers) may process data outside Türkiye and the EU, for example in the United States. Such transfers rely on the safeguards the law provides for, such as the providers’ contractual safeguards.

We only use cookies the site needs to work and to remember your choices:

Your browser’s local storage holds only an unfinished video brief (cleared when you sign out) and, during sign-in, the sign-in provider’s temporary session (removed as soon as sign-in completes). We use no advertising or third-party analytics cookies.

Under the GDPR and Article 11 of the KVKK you can ask whether we process your data, get access to it and a copy, have it corrected, deleted or its processing restricted, object to processing based on legitimate interest, and ask for your data in a portable format.

You can download a copy of your data as a JSON file and delete your account in the studio under Account → Privacy & data. For anything else, write to info@maestrocut.com from your account’s e-mail address; we answer within 30 days. You can also complain to Türkiye’s Personal Data Protection Board (KVKK) or, if you live in the EU, to your local data protection authority.

Connections are encrypted with HTTPS; your session token sits in a cookie JavaScript cannot read, and only its hash is stored in the database. Account e-mails confirm that an address is yours; password reset links work once and only for a limited time.

We keep encrypted backups of the service data (the database, including account details and credit history, and stored files) for up to 30 days. Backups are encrypted with AES-256 before they leave our database and are stored in a private GitHub repository (GitHub, Inc. / Microsoft) that only the operator can access.

MaestroCut is made for businesses and creators and is not directed at children. To open an account you must be old enough to enter into a contract under the law of your country (18 in Türkiye).

When we change this policy we update the date above; if a change materially affects how we use your data, we tell account holders by e-mail. For the rules of using MaestroCut, see the Terms of Use. Contact: info@maestrocut.com.