Last updated on October 15, 2026

Privacy policy

At MakeShort, we take the protection of your data seriously. This page explains what data we collect, why, who we share it with, and how you stay in control, in accordance with the General Data Protection Regulation (GDPR).

Data controller

The data controller is ALSCALE GROUP, a French simplified joint-stock company (SASU) operating the MakeShort service, whose registered office is located at 61 rue de Lyon, 75012 Paris, France. For any question about your data, write to contact@makeshort.io.

Data we collect

Account data: email, name and profile picture, retrieved when you sign in with Google.
Content you import: videos and transcripts generated from those videos.
Usage data: clips generated and quota consumed.
Links pasted to import: when an import by link fails, we record the pasted link (a public address) or, if the text contains none, its first 30 characters at most, never more. Text that looks like a password or an email address is not recorded. This information is used to diagnose failed imports and help you import your video (legitimate interest).
Technical data: connection logs and IP address.
Approximate location at sign-up: approximate country, city and region, inferred from your connection when you create your account (never your address).
Payment data: processed by our payment provider, never stored in clear text by us.
Connected social media accounts: if you connect one, its profile, its posts and their statistics (see the dedicated section below).

Purposes and legal bases

Provide the clip-creation service (performance of the contract).
Manage your account and billing (performance of the contract); retain required accounting records (legal obligation).
Secure the service and prevent abuse (legitimate interest).
Send you transactional emails related to your account (performance of the contract).
Know where our users come from (audience statistics) and choose where to host our servers so they are fast where you are, using the country, city and region inferred from your connection at sign-up (legitimate interest).
Email you, only if you asked for it, when your clips are ready and when we ship something new (once a month at most for product updates) (consent).
Store the landing page, visit source and campaign parameters locally for the duration of your browsing session, then send them to the application if you proceed to it, to attribute the origin of your sign-up (legitimate interest). Measure aggregate site audience with our audience measurement tool, without cookies or identifiers stored in your browser, for visitors without accounts who have not accepted cookies: page views and page exit (legitimate interest). After a visitor without an account agrees, enable the cookie and record site browsing from that moment (consent). For signed-in account holders, measure and record browsing on the site and in the app automatically (consent given at sign-up for accounts created from October 13, 2026, legitimate interest for older accounts).
Display the statistics of your connected social media accounts and publish the clips you choose to them (performance of the contract).

You can connect your TikTok, YouTube, Instagram or Threads accounts to MakeShort, depending on the platforms offered in the app. Connecting is optional and goes through the platform's official authorization screen: we never see your password. The rules below apply when you connect an account, whatever the platform.

Data we read

Profile: account ID, username, display name and profile picture.
Account counters: number of followers, accounts followed, likes, videos and views, depending on what the platform makes available.
Your posts: title or caption, thumbnail, duration, link, publication date, and their statistics (views, likes, comments, shares, watch time).
YouTube audience statistics: breakdown of your audience by age group, gender and country, retention and traffic sources of your videos. YouTube provides them in aggregated, anonymous form; we display them on demand, without storing them.

We do not read your private messages, the content of comments, or your list of followers.

Permissions requested: for YouTube, reading your channel (youtube.readonly), reading YouTube Analytics statistics (yt-analytics.readonly) and uploading videos (youtube.upload); for TikTok, reading your profile and its statistics, reading your list of videos, uploading and publishing videos.

What we use them for

Display your statistics in MakeShort: data is collected when you connect, then once a day as long as your plan includes this feature, to track how your accounts and posts are doing.
Publish or schedule, on the accounts you choose, the clips you choose, with the caption, cover and options you enter. We never publish anything without your action. The clip and this information are then sent to the platform, which processes them under its own terms.
Nothing else: we do not sell this data, we do not use it for advertising, we do not share it with any third party other than the technical processors listed below, and we do not use it to train artificial intelligence models.

Legal basis: performance of the contract, for the feature you turn on by connecting an account.

Protection and retention

Access tokens provided by the platform are encrypted (AES-256-GCM) before being stored, never kept in clear text, and are only used for the data collection, the posts you request and managing the connection (renewal, revocation).
Collected statistics and your post history are kept for as long as the account stays connected. They are deleted as soon as you disconnect the account or delete your MakeShort account.
If access expires or is removed from the platform, data collection stops and MakeShort offers to reconnect the account. History already collected remains visible until you disconnect the account in MakeShort.

Remove access at any time

In MakeShort, open “Manage accounts” and choose “Disconnect” on the account. You can also remove access from the platform's settings; for a Google or YouTube account, from the permissions page of your Google Account. To erase the data, see Delete your data below.

Google and YouTube

MakeShort uses YouTube API Services. By connecting a YouTube channel, you agree to the YouTube Terms of Service, and the Google Privacy Policy applies.

MakeShort's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Processors and recipients

To operate the service, we rely on providers who process certain data on our behalf. Except for the internal messaging tool and proxy download, the technical providers in this list are processors within the meaning of the GDPR, covered by their publishers' data processing agreements and subject to confidentiality obligations. For these two categories, we do not currently claim any contractual safeguard.

Stripe: payment and billing (European Union and United States).
database (European Union).
API hosting (European Union).
file storage and site delivery (possibly the United States, see “Transfers outside the European Union”).
automatic transcription of your videos' audio (European Union). As a last resort only, if that provider is unavailable, the audio may be handed to a second transcription provider in the United States.
sending transactional emails and, if you asked for them, follow-up emails (clips ready) and product updates (United States, see “Transfers outside the European Union”).
aggregate cookieless audience measurement for visitors without accounts who have not accepted cookies; cookie-based attribution and replay after agreement for visitors without accounts; automatic audience measurement and replay for signed-in account holders on the site and in the app (European Union).
technical error tracking (European Union, Germany).
running video processing jobs in the background (execution in the European Union, Germany; storage of the related data in the United States, see “Transfers outside the European Union”).
messaging tool for the team's internal notifications (United Arab Emirates, publisher established outside the European Union), see “Transfers outside the European Union”.
video rendering (European Union).
proxy download of pasted links: to import videos from YouTube and Kick, the requested addresses go through a proxy provider (company established in the United Arab Emirates, see “Transfers outside the European Union”), which only receives the video addresses, neither your account nor your email.

Transfers outside the European Union

Some categories of recipients may process data outside the European Union:

Payment (Stripe): United States. Stripe participates in the Data Privacy Framework (European Commission adequacy decision) and its standard contractual clauses complement it.
File storage and site delivery: United States. The provider participates in the Data Privacy Framework and its European Commission standard contractual clauses complement it.
Video rendering: the United States is possible for infrastructure operations. The provider offers European Commission standard contractual clauses in its data processing agreement.
Email sending: United States, covered by the European Commission's standard contractual clauses.
Automatic transcription, as a last resort only: United States, covered by the European Commission's standard contractual clauses.
Internal team notifications (messaging tool): United Arab Emirates, publisher established outside the European Union. The team receives messages about service activity, with personal data, to follow usage, provide support and spot incidents and abuse (legitimate interest). We currently have no transfer safeguard to show you for this processing (neither standard contractual clauses nor an adequacy decision). To object to these messages, write to us. Events and data concerned:
- Sign-up: email, name, approximate country, city and region, device type, source of the sign-up; for a probable duplicate, the associated account's address and the number of accounts created from the same IP address.
- Signed up 30 minutes ago with no import: the same data as the sign-up, with a link to the session recording (replay).
- Welcome questionnaire, completed or abandoned: email, name, approximate location, device, source and your answers (role, sources, platforms, audience, how you heard of us, emails).
- Videos: email, title, source link, source type, duration and remaining credits at launch; email and title when the video is ready; on failure, in addition: name, approximate location, device, technical error message, step concerned, action in progress (including the number of imports in progress), replay link and error-tracking link.
- Links refused at import: email, pasted link (or masked text if it looks like a password or an email address), screen concerned and reason for refusal; depending on the case, in addition: name, approximate location, device, action in progress, replay link and error-tracking link.
- Exports: email, video title, format, render time; on failure, in addition: approximate location, device, technical error message, step concerned, clip exported, replay link and error-tracking link.
- Subscription change: email, previous and new plan, type of change (upgrade, downgrade, cancellation) and billing period.
- YouTube videos: email, name, title, duration and link of the opened video, then number of clips created.
- Incidents: email of the account affected by an error or technical incident, emails of up to five affected accounts, and of the three most active accounts during an import spike; depending on the incident, also the technical error message, the step concerned, the action in progress and the replay and error-tracking links.
- Daily, weekly and monthly summaries: aggregate figures (audience, costs).
Background jobs: executed in the European Union (Germany), with storage of the related data in the United States, covered by the European Commission standard contractual clauses included in the provider's data processing agreement.
Proxy download: company established in the United Arab Emirates, exit in France for YouTube and in a variable country for Kick. Only the addresses of the requested videos go through this provider, with no account data. We do not currently have a transfer safeguard to present to you for this processing.

Retention periods

Account data is kept for as long as your account is active.
Your videos and transcripts are deleted when your account is deleted.
The country, city and region inferred from your connection at sign-up are kept for as long as your account exists and deleted with it.
Deleting your account erases your data in the database and in our main storage. Exceptions are described in the “Delete your data” section: exports whose erasure fails are picked up by an automatic cleanup within 24 hours, face-tracking files (tracks/…) whose purge fails may remain until automatic reconciliation, usage measurement events are kept unless you ask for deletion, and browsing recordings (replay) are erased 30 days after capture.
Data subject to a legal or accounting obligation is kept for the period required by law.
When your account is deleted, we keep a pseudonymized fingerprint of your email address and the free-plan usage state, for 12 months, for fraud-prevention purposes, in addition to the exceptions listed above.
Data from a connected social media account is kept for as long as it stays connected, and deleted as soon as you disconnect it or delete your account.
Your choices about follow-up and product update emails, and their proof, are kept for as long as your account exists and deleted with it.

Preventing free-plan abuse

To prevent repeated use of the free quota after an account is deleted and recreated, we keep a pseudonymized fingerprint of your email, calculated using keyed hashing, and the free plan usage state for 12 months. This lets us recognize reuse of the same address: the fingerprint remains personal data. We rely on our legitimate interest in preventing abuse. You may object under the conditions provided by law by writing to contact@makeshort.io.

Follow-up emails and product updates

If you ask for it, we email you when your clips are ready and when we ship something new (once a month at most for product updates). A single consent, given at sign-up, turns these emails on; nothing is preselected and access to the service never depends on it: without your consent, you only receive emails about your account and your payments. Legal basis: your consent.

To be able to prove your choice, we record each of your answers (consent, refusal or withdrawal): the date, where you gave it (sign-up or Settings), the exact version of the text shown and your answer. This information is kept for as long as your account exists and deleted with it.

You can change your mind at any time, as easily as you gave your consent: in the app, under Settings, Notifications card, or through the unsubscribe link included in every follow-up or product update email. Withdrawal applies to all later sends.

These emails are sent by our email delivery provider, which receives your email address only to deliver them.

Cookies

MakeShort uses storage needed for authentication and your language and consent preferences. We use an audience measurement tool, hosted in the European Union, to measure site audience and analyse product usage.

On the public site, the landing page, visit source and campaign parameters are kept in your browser’s session storage without a cookie. These details are also sent with anonymous cookieless audience measurements to our measurement tool. They are added to links to the application if you proceed to it, to attribute the origin of your sign-up on the basis of our legitimate interest. If you do not have an account and have not accepted cookies, our audience measurement tool measures aggregate site audience without cookies or identifiers stored in your browser. If you agree, it sets a cookie and starts replay from that moment. Attribution data sent to your account is deleted with it. You can decline and still use MakeShort. If you are signed in, audience measurement, the cookie and replay run automatically on the site and in the app: see the “Usage analytics and session recording” section below.

On the public site, we ask visitors without accounts for consent before setting an attribution cookie and starting replay:

Cookie choice ms_consent: if you accept, a cookie records your agreement on the domain .makeshort.io (shared between the site and the app) for about 6 months. If you decline, no choice cookie is set; your refusal stays in session storage until you close the browser.
Attribution and replay cookie (audience measurement): set after your agreement if you do not have an account, or automatically if you are signed in. It links your site visit to your account and records browsing on the public site. Form field values are masked. Legal basis: your agreement through the banner before account creation; once signed in, the legal basis depends on when your account was created (see “Usage analytics and session recording”).

On the public site, “Cookie settings” on makeshort.io lets you withdraw consent to the attribution cookie and site replay if you do not have an account. Withdrawal stops replay and removes the measurement tool's optional persistence; aggregate cookieless audience measurement continues. If you are signed in, audience measurement and replay run automatically on the site and in the app (see “Usage analytics and session recording”). You can also write to us at contact@makeshort.io.

Usage analytics and session recording

On the public site, the audience measurement tool loads at your first interaction (click, key press or scroll), or as soon as your account is recognised if you are signed in. If you do not have an account and have not accepted cookies, it only measures aggregate audience without cookies, stored browser identifiers or replay: page views and page exit (legitimate interest). After your agreement, the cookie shared with the app is enabled and site replay starts from that moment (consent). If you decline, measurement remains cookieless and replay does not start. If you are signed in, it identifies you with the same ID as the app; the cookie and replay run automatically on the site, regardless of any earlier banner choice, on the legal basis described below, depending on when your account was created. Replay masks sensitive fields and recordings are kept for 30 days. Local attribution described in the “Cookies” section remains active independently of the measurement tool.

Once you have an account, your navigation in the application is recorded (replay) and measured, to detect bugs and check that the app works as intended. Sensitive fields (passwords, emails, payment) are masked in recordings and payment takes place outside the application. Recordings are kept for 30 days, with our audience measurement provider, hosted in the European Union. Legal basis: for an account created from October 13, 2026, your consent, given at sign-up through the notice shown before your account is created: “By continuing, you agree to our terms of service and our privacy policy, including usage analytics and recording of your browsing (replay) to improve MakeShort.” For an older account, created before that notice, our legitimate interest in the quality and security of the service, which you can object to by email (address below). The app has no off switch: replay is part of using the account and, as long as you keep your account, an email does not stop it. To stop it, you must delete your account (Settings, “Danger zone”, “Delete my account”). By email, you can ask for the recordings and events already collected to be erased; recordings are in any case erased automatically 30 days after capture.

On the public site, if you do not have an account, you can withdraw your consent from the cookie preferences. Withdrawal stops future processing based on that consent and does not affect processing previously carried out. To exercise your rights over data linked to your account (objection, erasure of your recordings and measurement events), write to contact@makeshort.io.

Delete your data

Here is how to delete the data MakeShort holds about you, including data from a connected social media account (TikTok, YouTube, Instagram, Threads). Three options, your choice:

Disconnect a social media account: in MakeShort, open “Manage accounts” and choose “Disconnect” on the account. We ask the platform to revoke our access (if it does not respond, the disconnection goes ahead anyway), then delete the connected account, its access tokens, its collected statistics and its post history.
Delete your MakeShort account: in the app, open Settings, then “Danger zone” and “Delete my account”. The following are deleted in the same operation: your account, your videos, transcripts and exports (in the database and in our storage), your connected social media accounts with their tokens and statistics. Your paid subscription is cancelled before anything is deleted; if the cancellation fails, nothing is deleted and you can try again or write to us. If deletion from the main storage fails, the operation stops with an error message and you can run it again. When you delete your account, your videos and exports are erased immediately; if an erasure fails, a daily automatic cleanup picks it up again and it is completed no later than 24 hours after the deletion. Likewise, the face-tracking files of your videos (tracks/…) are deleted after your account; if that deletion fails, they remain until automatic reconciliation.
Write to us: at contact@makeshort.io, from the email address of your MakeShort account, stating which data or account is concerned. We handle your request within one month at most and confirm the deletion by email.

Remaining after account deletion: the accounting records the law requires us to keep, the pseudonymized anti-abuse fingerprint (12 months), any face-tracking files (tracks/…) whose deletion failed, described above, and some usage measurement data: browsing recordings (replay) are erased automatically 30 days after capture, but usage measurement events are not deleted with the account: we delete them on request by email. Videos already published on a platform stay there: to remove them, delete them from the platform. Removing access from the platform's settings stops our data collection; to erase history already collected, use one of the three options above.

Your rights

Under the conditions set out in the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability. You can withdraw consent at any time. Our data protection contact is contact@makeshort.io. You may file a complaint with the CNIL (www.cnil.fr) or any other competent supervisory authority.

This English privacy policy is intended to have the same meaning as the French version. It does not limit any mandatory consumer rights.