Privacy Policy

Effective date: 2026-10-24

This notice explains how ShortsMate (shortsmate.co.kr) handles personal data. It covers the English and Japanese pages and everyone who uses the Service from outside Korea; the Korean 개인정보처리방침 describes the same practices for the Korean site.

1. Who is responsible (controller)

Peak Company (피크컴퍼니), a sole proprietorship (개인사업자) registered in the Republic of Korea, represented by Bae Soyun, business registration no. 214-19-20761, Gyeonggi-do Suwon-si Gwonseon-gu Geumgok-ro 140beon-gil 73, 910-dong 1801-ho, 16387, Republic of Korea, is the controller of the personal data described here.

Privacy officer: Bae Soyun · Email: shortsmate88@gmail.com · Phone: +82 10-6541-9723

For orders paid in USD or JPY, Paddle.com acts as our reseller and Merchant of Record and is an independent controller of the data it collects at checkout (for example your name, email, country, billing details and payment method); see the Paddle Privacy Notice.

2. What we collect, why, and on what legal basis

Account data — the email address, name or nickname and sign-in method that Google or Kakao give us when you sign in. Used to create your account, sign you in and contact you about it. Basis: performing our contract with you.
Your content — the YouTube links and video files you submit, and the shorts, titles, captions, translations and narration made from them. Used to make and deliver your shorts. Basis: contract.
Usage and minutes — your jobs, minutes used and remaining, and passes. Used to run the Service and keep your balance. Basis: contract.
Payment records — product, amount, currency, and payment and refund dates. Used for payments, refunds, referral rewards and the records Korean e-commerce law requires. We never receive or store full card numbers. Basis: contract and legal obligation.
Fraud prevention — at sign-up we keep your IP address only as an irreversible hash (never the IP itself), and we set a device marker cookie (sm_dev) whose value our server also only hashes. Used to stop repeat free-trial and referral abuse. Basis: our legitimate interest in preventing fraud.
Referral data — which referral link you came from. Used to give referral rewards. Basis: contract.
Connected YouTube or TikTok account (only if you connect one) — see section 6. Basis: your consent, given on Google’s or TikTok’s consent screen.
Messages and access logs — what you send us when you contact support, and server access logs. Used to answer you, keep the Service secure and meet legal record-keeping duties. Basis: legitimate interest and legal obligation.
Visit statistics — aggregated page-view statistics (Vercel Web Analytics, which uses no cookies, and our own counter, which stores the page address, the referring site’s domain, utm tags and a one-way hash of your connection details (IP address and browser) made with a secret that changes every day; the IP address and browser details themselves are never stored). To count a returning visitor once, our counter also sets a statistics cookie (sm_vid) holding a random visitor number, and stores only a one-way keyed hash of it; it is never linked to your account. Visitors from the EEA, the UK and Switzerland do not get this cookie. The counter’s rows are deleted after 400 days. Basis: legitimate interest in understanding how the site is used.

We do not sell personal data.

3. Who processes data for us (recipients)

Supabase — sign-in and database.
Cloudflare (R2) — storage of video files.
Vercel — website hosting and visit statistics.
OpenAI — speech recognition and AI analysis of the videos you submit: choosing scenes and writing titles, captions, translations and narration lines (and the narration voice when ElevenLabs is not used).
ElevenLabs — turns narration lines into speech, only when you use AI narration (Pro and Biz). It receives the narration text, not your video.
Google and Kakao — sign-in with your Google or Kakao account.
Google (YouTube) and TikTok — only if you connect your channel or account to upload shorts.
Toss Payments — payment processing for KRW orders on the Korean site.
Paddle.com — reseller and Merchant of Record for USD and JPY orders: checkout, payment, tax, invoices and refunds.

Video processing itself runs on work servers operated by Peak Company. We may also disclose data where the law requires it, for example to a court or a public authority.

4. International transfers

Peak Company is based in the Republic of Korea. Several of the providers above (Supabase, Cloudflare, Vercel, OpenAI, ElevenLabs, Google, Paddle) are based outside Korea, mainly in the United States and Europe, and their servers may be in other countries. Your data is therefore transferred to and stored in those countries. We use providers that protect data under their contractual terms, and all transfers are encrypted (HTTPS/TLS).

5. How long we keep data

Source videos are deleted after the job is done.
Editable copies and finished shorts are deleted automatically 7 days after they are made for free-trial jobs and 30 days after for paid jobs. Editing does not extend this. Temporary files from failed jobs and uploads not linked to a job are cleaned up regularly.
When you delete your account, we delete your account data and the videos stored on the website without delay; leftover processing copies on our work servers are deleted automatically within 31 days.
Records the law requires us to keep (Korean Act on Consumer Protection in Electronic Commerce, Protection of Communications Secrets Act): contracts and cancellations, 5 years; payments and supply of services, 5 years; consumer complaints and disputes, 3 years; access logs, 3 months.
Database backups are deleted after 30 days.

6. Google user data and TikTok (connected accounts)

The YouTube upload feature uses YouTube API Services. By using it you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to information Google processes. When you connect a channel we access Google user data only within the scopes you approve (uploading YouTube videos and viewing your YouTube account). We store the channel ID, channel name, profile image URL and an encrypted refresh token, plus a record of videos uploaded through ShortsMate (title, visibility, scheduled time, YouTube video ID). We use this only to upload the shorts you choose to that channel and to show the channel on screen; we do not read your other videos, comments, subscribers or watch history, we do not share or sell Google user data, we do not use it for advertising, and we do not use it to train AI models or send it to AI providers. ShortsMate’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect TikTok, we access only the scopes you approve (basic profile, video upload and publish) and store the account identifier (open_id), display name, profile image URL, encrypted tokens and a record of what you posted.

You can disconnect at any time with “Disconnect” on the upload page, in your Google account settings, or in TikTok’s app settings. Disconnecting deletes the tokens immediately and asks Google or TikTok to revoke access; deleting your account deletes all of this data.

7. Cookies

Sign-in session cookies (Supabase) — keep you signed in. Strictly necessary.
sm_lang — remembers the language you picked (Korean, English or Japanese), for 1 year.
sm_ref — remembers the referral link you arrived from, for 30 days, so the referral can be credited.
sm_dev — a random device marker kept for 2 years to recognise repeat sign-ups from the same browser (fraud prevention). The server only stores a hash of it.
sm_vid — a random visitor number kept for 400 days so our own visit statistics count a returning visitor once. The server only stores a keyed hash of it, never linked to your account. Not set for visitors from the EEA, the UK or Switzerland.
sm_yt_state, sm_tt_state — security cookies that protect the YouTube and TikTok connection steps from forged requests, for 10 minutes.

Vercel Web Analytics uses no cookies; our own counter uses only sm_vid above. We use no advertising or cross-site tracking cookies. Paddle’s checkout, when you use it, is covered by Paddle’s own notice.

8. Your rights

You can delete your account and its data at any time from the account page. You can also ask us to access, correct, delete, export or stop processing your personal data, or object to processing based on our legitimate interests, and you can withdraw consent (for example by disconnecting YouTube or TikTok) at any time. Email the privacy officer at shortsmate88@gmail.com; we answer without delay after confirming it is you. You can also complain to the Personal Information Protection Commission of Korea or to the data protection authority where you live.

9. Security

All data in transit is encrypted with HTTPS/TLS.
YouTube and TikTok tokens are encrypted at rest with AES-256-GCM, using a key kept only in server configuration, separate from the database, and never sent to browsers. Our database (Supabase) and file storage (Cloudflare R2) also encrypt all data at rest.
Row Level Security limits each user to their own records. Service keys exist only on our servers, and administrative access is limited to the privacy officer.
Video files are private and reached only through signed links that expire within two hours.
Daily database backups are kept in private storage (tokens stay encrypted) and deleted after 30 days.
If a breach is suspected we cut off access, investigate, and notify affected users and the authorities as the law requires.

10. Changes

We will post any change to this notice here with a new effective date, and tell you on the site or by email when a change matters to you.

11. Contact

Peak Company (피크컴퍼니) · Gyeonggi-do Suwon-si Gwonseon-gu Geumgok-ro 140beon-gil 73, 910-dong 1801-ho, 16387, Republic of Korea
Privacy officer: Bae Soyun · shortsmate88@gmail.com · +82 10-6541-9723