Privacy Policy

1. Who we are

Crewcut is operated by Victory Lucky, an individual based in Nigeria (“Crewcut”, “we”, “us”). For the personal data described in this policy we are the data controller: we decide why and how it is processed.

Contact for anything in this policy, including requests to use your rights: support@getcrewcut.site.

2. What this policy covers

This policy applies to:

• the public website at getcrewcut.site, including the template gallery and pages for videos shared with a link;
• the Crewcut app you use after signing in, including the AI crew, the editor and its mini-apps;
• emails and messages you send us.

It does not cover services you connect to Crewcut, such as Google or your AI model provider. They handle your data under their own policies. Crewcut’s source code is open source; if someone else runs their own copy of it, that operator, not us, is responsible for the data it holds.

3. The data we collect

Data you give us

• Account details: your name, email address and password. We store the password only as a one-way hash, never in readable form. If you turn on two-step sign-in, we also store its secret and your backup codes.
• Your content: projects, video briefs, scripts, edits, captions, templates you save and the text the crew writes for you. It also includes the files you upload (video, audio, images and recordings) and anything those files show or contain, such as people’s faces and voices.
• Research sources: web addresses you ask the crew to read, the text it fetches from them, and notes or documents you paste. Before we store this text, we automatically remove things that look like passwords and API keys.
• Conversations with the AI crew: your chat messages and the crew’s replies, the notes the crew saves to remember your preferences (“learnings”), and your approvals, overrides and comments on each stage of a video.
• Keys you save: if you add your own API key (for example for an AI model or for ElevenLabs), we store it encrypted with AES-256-GCM. We use it only to make the requests you ask for.
• Teams and sharing: the email addresses of people you invite to a team or share an item with.
• Messages to us: what you write when you contact support or make a privacy request, and our replies.

To create an account you must give a name, an email address and a password. Everything else is up to you, but some features need it: the crew can’t write a script without a brief, for example, and publishing needs a connected YouTube channel.

Data we collect automatically

• Sign-in records: for each signed-in session we store its start and expiry times, your IP address and your browser’s user agent (a short text that names your browser and operating system). We use these to keep you signed in and to spot suspicious sign-ins.
• Server and security logs: when your browser loads a page or file, our hosting provider records technical details such as your IP address, the address requested, the time and your user agent. We use these to run the service, fix faults and block abuse.
• AI crew usage records: for each crew run we record which tools ran, whether they succeeded, how long they took, how many tokens they used, an estimated cost, short error summaries, and any thumbs-up or thumbs-down you give. These records do not include the text of your prompts or of the crew’s answers. Those are kept in your chat history instead.
• Cookies and browser storage: see section 12 and our Cookie Policy.
• Where you came from: if you allow it (see the Cookie Policy), we save how you first reached Crewcut to your account when you sign up: campaign tags in the link (“UTM” parameters), ad-click identifiers and the name of the website that referred you, but not the full address of the page you were on.

Data from services you connect

• YouTube: if you connect a YouTube channel, we receive the data described in section 6.
• Your AI model provider: the replies its models send back to the crew.
• ElevenLabs: the voice-over and music audio it generates for your videos.
• Pexels: the stock photos and clips you choose, with the photographer’s name and the licence details.

Data about other people

If your videos, sources or uploads include other people, for example their image, voice or words, you are responsible for having the right to use that material. Our Terms and Acceptable Use Policy say more about this.

4. How we use your data, and our legal bases

Data protection laws, including the GDPR, the UK GDPR and Nigeria’s Data Protection Act 2023, require a lawful basis for each use. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 11). Where we rely on consent, you can withdraw it at any time. Withdrawing consent doesn’t affect what we did before.

What we don’t do: we don’t sell or rent your personal data. We don’t share it for targeted advertising, we don’t show ads, and we don’t use your content to train AI models. We don’t make decisions about you that have legal or similarly significant effects by automated means alone.

We send email about your account or the service only when it is needed, and no marketing email unless you have agreed to it.

5. The AI crew and your content

Crewcut’s crew is made of AI agents that research, write, edit, voice and check your videos. To do that, the crew sends the material for a task to an AI model provider. This includes your instructions, the chat, your brief and script, source text, project details, and descriptions of your timeline and media.

• You choose the provider. You connect a model in Settings, using your own account with that provider or a connection we offer there. The providers that can be connected include Anthropic, OpenAI, Google (Gemini), OpenRouter, Groq, Mistral, Cohere, Builder.io and Ollama servers you run yourself. The provider handles the content under its terms and privacy policy and under your agreement with it.
• If we ever supply the model for you, we will name that provider on this page before it receives any of your data.
• Not for training by us. We don’t use your content to train or fine-tune AI models. What a provider may do with what it receives is set by its terms and, for your own provider account, by your settings there. Check them if this matters to you.
• Mistakes are possible. AI output can be wrong even when it cites a source. Review it before you publish.

6. YouTube and Google data

Crewcut uses YouTube API Services to publish your videos to YouTube and to show how they perform. This is optional. It only happens if you connect a YouTube channel on the Connections page (Connect in the sidebar) and approve access on Google’s consent screen. By connecting, you also agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy.

What we access

We ask Google for three permissions:

• Upload videos (youtube.upload): to upload a video to your channel. We do this only when you approve a publish, with the title, description and privacy setting you confirm.
• View your YouTube account (youtube.readonly): to show which channel is connected, and to read the details of videos you published through Crewcut.
• View YouTube Analytics reports (yt-analytics.readonly): to read performance figures, such as views, watch time and audience retention, for videos you published through Crewcut.

What we store and how we use it

• The access and refresh tokens Google gives us. We store them encrypted (AES-256-GCM), use them only for the actions above, and never show them to anyone, including you.
• Your channel’s name and ID, and the permissions you granted.
• For each video you publish, its YouTube ID and link, and the title, description and privacy setting we sent.
• Snapshots of the performance figures for those videos, and the summaries the crew writes from them. You can see these in Crewcut.

We use this data only to provide the publishing and performance features you see in Crewcut. When you ask the crew to explain how a video performed, the figures go to the AI model provider you connected (see section 5), only to answer your request. We don’t sell YouTube data, use it for advertising, or use it to train AI models. We don’t share it with anyone else, except our hosting providers, who store it for us (section 7).

Disconnecting and deletion

• In Crewcut: disconnect the channel on the Connections page. We revoke our access with Google and straight away delete the tokens, the channel details, the stored performance figures, the summaries the crew wrote from them and the learnings it saved from those summaries. Figures the crew quoted in a chat stay in that chat until you delete it. The record that a video was published, with its YouTube link, stays in that video’s history until you delete the video. Email us if you want either removed sooner, and we will do it within 7 days.
• In your Google Account: you can also remove Crewcut’s access at any time on Google’s security settings page. We then lose access at once. We check every connection with Google regularly, and when we find that access was revoked we delete the tokens and the YouTube data listed above, in any case within 30 days of the revocation.
• While you stay connected, we confirm with Google at least every 30 days that you still authorise Crewcut, and we keep stored YouTube data only as long as the YouTube API Services policies allow.
• Videos already on your channel stay there. Manage or delete them in YouTube.

Questions or complaints about how we handle YouTube data: support@getcrewcut.site.

7. Who we share data with

Service providers

These companies process data on our behalf, under contracts that require them to protect it and to use it only to provide their service to us:

Services you choose to connect

When you connect your AI model provider, ElevenLabs with your own key, or YouTube, we send them what is needed to do what you ask, as described in sections 5 and 6. Their own terms and privacy policies apply.

Mini-apps

Mini-apps that run inside the editor load code from jsDelivr and fonts from Google Fonts, so your browser sends your IP address to those services when a mini-app opens.

People you share with

• Items you share with a team or with specific people become visible to them.
• If you set a video to “Anyone with the link”, anyone who has the link can watch its latest export and see its title, without signing in. Your name and email aren’t shown. Make the video private again to remove access.

Other cases

• Legal reasons: when the law requires it, for example a valid court order, or when needed to protect someone’s safety or to defend our rights. Where the law allows, we will tell you first.
• A change of ownership: if Crewcut is sold, merged or transferred, your data may pass to the new operator. That operator must honour this policy, or tell you and give you the chance to delete your data first.
• With your consent: in any other case, only if you ask us to or agree to it.

8. International transfers

We are based in Nigeria. Our providers run services in many countries, including the United States and the European Union, so your data may be processed outside your country.

When we transfer personal data across borders, we rely on legally recognised safeguards:

• adequacy decisions, where they exist;
• the European Commission’s Standard Contractual Clauses and the UK’s equivalent, offered in our providers’ data processing terms;
• for transfers out of Nigeria, the conditions in Part VIII of the Nigeria Data Protection Act 2023.

You can ask us for details of these safeguards.

9. How long we keep data

When you ask us to delete your account, we delete or anonymise your personal data within 30 days. Copies in backups are overwritten on a rolling schedule and are gone within 90 days. We may keep some data longer where the law requires it, or to settle a dispute or enforce our Terms, and only for that purpose.

10. Security

We take reasonable technical and organisational steps to protect your data, including:

• encryption in transit (HTTPS) for all traffic to getcrewcut.site;
• encryption of saved API keys and connected-account tokens with AES-256-GCM;
• one-way hashing of passwords;
• access controls, so your projects are visible only to you and the people you share them with;
• automatic removal of passwords and keys from research text before it is stored.

No system is perfectly secure. If a personal data breach puts your rights at risk, we will tell you and the relevant regulators when and as the law requires. Under the GDPR and the Nigeria Data Protection Act, regulators must normally be told within 72 hours.

11. Your rights

Wherever you live, you can ask us to:

• give you access to the personal data we hold about you, with a copy;
• correct data that is wrong or incomplete (you can change your name and email yourself in Settings → Account);
• delete your data or your whole account;
• give you your data in a portable format, or send it to another service where that’s technically possible;
• restrict or object to certain uses, including any use based on legitimate interests;
• withdraw consent you gave, for example for attribution cookies.

How to make a request

In the app, go to Settings → Account → Privacy & data → Manage and choose Request a copy or Request deletion. You can also email support@getcrewcut.site from the address on your account. Either way, a person handles the request: we confirm by email that we received it, and we may need to check it’s you before we act. Requests are free.

We answer within one month. For complex requests we may extend this by up to two more months, and if we do, we will tell you why. If we can’t do what you ask, for example because the law requires us to keep something, we will explain why.

If you are in the EU, the EEA or the UK

You have the rights above under the GDPR or the UK GDPR, and the right to complain to your local data protection authority. In the UK, that is the Information Commissioner’s Office. We would like the chance to help first, so please contact us.

If you are in Nigeria

The Nigeria Data Protection Act 2023 gives you these rights, including the right not to be subject to decisions based solely on automated processing. You can complain to the Nigeria Data Protection Commission.

If you are in the United States

Depending on your state (for example California, Colorado, Connecticut, Virginia or Texas), you may have the rights to know, access, correct and delete your personal data, and to opt out of its “sale”, its “sharing” for targeted advertising, and profiling. We don’t sell personal data or share it for targeted advertising, and we don’t use sensitive personal data to infer things about you. You can use the rights that apply to you as described above, or through an authorised agent, and we will not treat you differently for doing so. If we turn down your request, you can appeal by replying to our answer. We will respond to the appeal within the time your state’s law requires. Crewcut may be too small for these laws to apply to it, but we honour these rights for everyone.

12. Cookies and similar technologies

We use cookies and browser storage to keep you signed in, remember your settings and choices, and, where allowed, measure visits and see which links bring people to Crewcut. We don’t use advertising cookies from other companies. If you are in the EU or the EEA, we ask for your consent before setting cookies that aren’t essential. Elsewhere they are on by default. Wherever you are, you can change your choice at any time in Settings → Account → Privacy & data → Manage → Cookie settings.

The Cookie Policy lists each cookie, its purpose and how long it lasts.

13. Children

Crewcut is not for anyone under 16. We don’t knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact support@getcrewcut.site and we will delete it. If you are under 18, you may use Crewcut only with the consent of a parent or guardian where your local law requires it. In Nigeria, the Data Protection Act requires that consent for anyone under 18.

14. Changes to this policy

We will update this policy when our practices change, for example when we add a provider. The date at the top shows when it last changed. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect. Where the law requires your consent, we will ask for it.

15. Contact

Victory Lucky, operator of Crewcut, Nigeria. Email: support@getcrewcut.site.