Privacy policy

1. Who we are

In short: Shotz is run by Shotz Pty Ltd in Melbourne, and we follow the Australian Privacy Principles.

This policy explains how Shotz Pty Ltd (“Shotz”, “we”, “us”) collects, uses, shares and protects personal information when you use the Shotz website, app, API and MCP server.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where other privacy laws apply to you, such as the GDPR in Europe and the UK, we handle your information in line with those too.

For anything in this policy, contact us at privacy@shotz.co.

2. What we collect

In short: Your account details, what you upload and make, how you use Shotz, and billing details through Stripe.

Account details: your name, email address, profile photo, the sign-in method you use, your workspace name, and the people you invite.

Your content: footage, photos, audio, prompts, reference photos and Elements you upload or create, the shots and edits you make, comments, and what Shotz detects in your media so you can search it, such as transcripts, descriptions, tags, moments, objects and places. Your content may include personal information about you and other people who appear in it.

Face data: on paid plans, X-Ray finds the faces in your workspace’s photos and videos and keeps a numerical template of each one so it can tell when the same person appears in another file, along with where the face is in the picture and any name someone in the workspace gives that person. See section 5.

Billing details: your plan, invoices, and credit purchases. Card details are collected and stored by our payment provider, Stripe; we only see the card type, last four digits and expiry date.

Usage and device information: which features you use, generations you run and the credits they cost, pages you visit, your browser and device, your IP address and the approximate location it suggests, and error logs.

Messages: what you send us when you contact support or give feedback.

We don’t ask for sensitive information such as health, religious or political information. If your content contains it, we only process it to provide the service to you.

3. How we collect it

In short: Mostly from you. Some from the services you sign in with, and some automatically as you use Shotz.

We collect most information directly from you when you sign up, upload, generate, edit, share, buy credits or contact us.

If you sign in with Google, we receive your name, email address and profile photo from Google. If someone invites you to a workspace, we receive your email address from them.

We collect usage and device information automatically using cookies, local storage and server logs (see section 8).

4. How we use it

In short: To run Shotz for you, keep it safe, bill you, help you, and make it better.

We use personal information to: create and manage your account and workspace; store, process, generate and export your content; let you share and collaborate; charge for plans and credits; send you service messages, such as receipts, security alerts and notices that a generation is ready; answer support requests; prevent fraud, abuse and breaches of our terms; fix problems and improve Shotz; and meet our legal obligations.

We’ll only send you marketing emails, such as product news, if you’ve agreed or the law allows it, and every one has an unsubscribe link.

We don’t sell your personal information, and we don’t use it for third-party advertising.

5. AI models and your content

In short: Your prompts and references go to the model you pick, only to make your result. Nobody trains on them.

When you generate, Shotz sends your prompt and any frames, references or Elements you use to the AI model you chose, through our model provider fal.ai, which runs models made by companies such as Google, ByteDance, Kuaishou, Alibaba, OpenAI, xAI, Black Forest Labs, Recraft, ElevenLabs and Topaz. They process it only to return your result.

We don’t use your content to train AI models, and our agreements don’t allow our model providers to train on it.

Some Shotz features analyse your media automatically, for example to transcribe speech, find moments and keep a face consistent across takes. This analysis is used only to provide those features to your workspace.

X-Ray, on paid plans, reads each photo and video added to a workspace. It writes a description, tags and timecoded moments (using Google’s Gemini models through OpenRouter for photos, and TwelveLabs for video), makes the files searchable by what’s in them (TwelveLabs), and finds faces (Amazon Rekognition). Speech is transcribed by Deepgram on every plan.

Face recognition works only inside one workspace: each workspace has its own separate collection of face templates, and we never match faces across workspaces or use them to identify who someone is. A template is a set of numbers describing a face, not a photo of it. People in the workspace can name a person, merge two people, or remove someone, which deletes their face templates.

Face templates can be biometric information under some laws. The owner of a workspace is responsible for having the right to upload footage of the people in it, and for any consent those laws require. An owner can turn face recognition off in Settings → Workspace at any time, which deletes every face template in that workspace straight away. If you appear in someone’s footage and want your face data removed, ask the workspace owner, or contact us and we’ll help.

6. Who we share it with

In short: The people you choose, and the companies that help us run Shotz. Nobody else, unless the law requires it.

People you choose: members of your workspace, and anyone you share an edit or review link with.

Service providers who process information for us under contract, only to provide their service:

• Supabase, for our database, file storage and sign-in;

• Cloudflare, for hosting, content delivery and security, including Turnstile, which checks that you’re a person and not a bot (see section 8);

• fal.ai and the AI model makers it runs, and BytePlus, for generating video, images and sound;

• OpenRouter and the model makers it routes to, including Google, for describing photos, the Agent and writing help;

• TwelveLabs, for describing videos and searching them by what’s in them;

• Amazon Web Services (Rekognition), for finding and matching faces in X-Ray;

• Deepgram, for transcribing speech;

• Transloadit, for converting files and taking frames from videos;

• Stripe, for payments and invoices;

• Inngest, for running background jobs such as generations and exports;

• our email provider, for sending service and account emails.

We may also share information with professional advisers, with a business that buys or takes over Shotz (who must protect it in the same way), or where the law requires it or it’s needed to protect someone’s safety or our rights.

7. Where your information is stored

In short: Some of our providers store or process information outside Australia, mainly in the United States.

Our providers store and process information in the United States and other countries where they operate, which may include countries in Europe and Asia. When we send personal information overseas, we take reasonable steps to make sure it’s protected in a way that’s consistent with the Australian Privacy Principles, including through our contracts with those providers.

For people in the European Economic Area and the UK, we rely on approved transfer mechanisms, such as standard contractual clauses, where they’re needed.

8. Cookies and local storage

In short: We use them to keep you signed in and remember your settings. No advertising cookies.

We use cookies and similar browser storage that are needed to sign you in, keep your session secure and remember preferences such as your workspace and layout.

On sign-in, password reset and our free tools, we use Cloudflare Turnstile to check that you’re a person and not a bot. To do this, Cloudflare collects signals from your browser and connection, such as your IP address, browser details and the page you’re on. Cloudflare uses them to protect Shotz on our behalf, and also, as its own controller, to improve its bot detection. They’re strictly necessary for that check. See Cloudflare’s Turnstile privacy addendum and privacy policy.

We may use privacy-friendly analytics to understand which features are used, measured in aggregate. We don’t use advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings, but Shotz won’t work properly without the ones needed for signing in.

9. How long we keep it

In short: While your account is open, then we delete it within 30 days, and from backups within 90.

We keep your account details and content while your account is open. When you delete a file, an edit or an Element, it’s removed from Shotz straight away and from our systems within 30 days.

Face templates are deleted when the file they came from is deleted, when someone removes that person from People, when an owner turns face recognition off, or when the workspace is deleted. What X-Ray wrote about a file (its description, tags, moments and search index) is deleted with the file.

When you delete your account or workspace, we delete the personal information and content in it within 30 days, and from backups within 90 days.

We keep some records for longer where the law requires it or for legitimate business reasons, such as invoices and payment records for tax purposes (generally seven years), and logs needed to investigate abuse or security incidents.

10. How we protect it

In short: Encryption, access controls, and only the access people need.

We encrypt information in transit and at rest, limit access within Shotz to people who need it to do their job, keep each workspace’s data separate with database access rules, and review the security practices of our providers.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

11. Your choices and rights

In short: You can see, fix, export or delete your information, and say no to marketing.

You can view and update your account details in Your account, export your content from Shotz, and delete files, workspaces or your whole account in Settings.

You can also ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing privacy@shotz.co. We’ll reply within 30 days. We may need to check who you are first, and there are some cases where the law lets or requires us to refuse, in which case we’ll tell you why.

If you’re in Europe or the UK, you also have the right to object to or restrict some processing, and to data portability. Where we rely on your consent, you can withdraw it at any time.

You can unsubscribe from marketing emails using the link in any of them. We’ll still send service messages you need, such as receipts and security alerts.

If you’re in someone else’s workspace, the workspace owner controls the content in it. Requests about that content may need to go through them.

12. Children

In short: Shotz is for people 18 and over.

Shotz isn’t meant for anyone under 18, and we don’t knowingly collect personal information from children. If you think a child has given us their information, contact privacy@shotz.co and we’ll delete it.

13. Questions and complaints

In short: Talk to us first. If you’re not happy with our answer, you can go to the OAIC.

If you have a question or a complaint about how we handle personal information, email privacy@shotz.co. We’ll acknowledge it within 7 days and aim to resolve it within 30.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you’re in Europe or the UK, you can contact your local data protection authority.

14. Changes to this policy

In short: If we change how we handle your information in a way that matters, we’ll tell you first.

We may update this policy as Shotz changes. The date at the top shows when it was last updated. For changes that matter, we’ll tell you by email or in the app before they take effect.