Privacy Policy

Version: 1.0.0 Effective date: 2026-07-27 Controller / legal name: Mohamed Riyad Khomsi Trading name: ShortDash Privacy contact: contact@khomsi.com Support: contact@khomsi.com Address: Apt. 06, Résidence Touria, Bin Jradi, Taza, Morocco Governing jurisdiction: Kingdom of Morocco

1. Scope

This policy describes how ShortDash processes personal data when you use the Service at https://shortdash.khomsi.com and related APIs.

2. Data we process

Depending on how you use the Service, we may process:

• Account data: name, username, email, role, approval status, plan/usage metadata;
• Authentication session tokens stored in essential cookies;
• Project and media metadata you create (scripts, beats, captions, render paths, job status);
• Uploaded source material and generated media stored for your account;
• Connected YouTube channel identifiers and OAuth tokens needed to upload/schedule on your behalf;
• Notification preferences and delivery records for operational messages;
• Legal consent records (document type, version, acceptance time, minimized request metadata);
• Operational logs and security audit events needed to run and secure the Service;
• Minimized lifecycle audit/tombstone records after deletion.

We do not currently operate product marketing analytics cookies or advertising trackers in the dashboard.

3. Purposes

We process data to:

• create and authenticate accounts;
• provide generation, review, storage, and optional publishing features;
• enforce usage limits and ownership boundaries;
• send essential security and operational notifications;
• honor export and deletion requests;
• maintain security, abuse prevention, and auditability;
• comply with legal obligations where applicable.

Optional product/news/marketing email is not enabled merely because you accept Terms. Marketing email requires a separate opt-in when offered.

4. Legal bases

Processing is carried out under the laws of Kingdom of Morocco. Where applicable, we rely on:

• performance of a contract (providing the Service you request);
• legitimate interests in securing, operating, and improving the Service;
• consent where required (for example optional marketing email, or re-consent to material policy updates);
• legal obligation where we must retain minimized records.

5. Processors and subprocessors

Customer data may be processed by infrastructure and AI providers used to operate the Service, including (as configured in production):

• Supabase (authentication and database);
• Cloudflare (image generation when selected as the production image provider);
• Additional AI / TTS / media providers configured for scripting, audio, and rendering;
• YouTube / Google (only if you connect a channel);
• Email delivery providers when operational email dispatch is enabled (currently may remain disabled in production).

6. Cookies

Essential cookies are required for login and session security:

• shortdash_access_token
• shortdash_refresh_token

These are httpOnly session cookies. Because only essential cookies are used today, the Service does not present an accept/reject cookie banner for analytics or advertising. See the Cookie Policy for details.

7. Retention

Active account data is retained while the account remains open. After a deletion request:

• generation is locked immediately;
• a cooling-off period applies during which you may cancel;
• after processing, account content and media under Service control are deleted or anonymized according to the deletion workflow;
• minimized audit/tombstone records may be retained for security and compliance;
• YouTube videos already published on Google are not deleted by ShortDash.

Export archives expire automatically after a limited period.

8. Your choices

Subject to account status and applicable law, you may:

• access and update profile fields available in the product;
• export account metadata from Settings → Your data;
• request deletion from Settings → Your data;
• adjust operational notification preferences;
• separately opt in or out of marketing email if offered;
• disconnect YouTube connections from channel settings.

9. Children

The Service is not directed to children under 18. Do not register if you are under that age.

10. International transfers

Data may be processed in regions where our providers operate. By using the Service you acknowledge that processing may occur outside Kingdom of Morocco as needed to provide the Service through those providers.

11. Changes

Material privacy updates may require re-consent before continued use. Non-material clarifications may be published without forcing re-consent.

12. Contact

Privacy questions: contact@khomsi.com Support: contact@khomsi.com Postal address: Apt. 06, Résidence Touria, Bin Jradi, Taza, Morocco

---

This Privacy Policy describes ShortDash data practices. It is not a substitute for advice from a qualified lawyer.