Privacy Policy

1. Controller and scope

广州码蚁科技有限公司, a company established in 中国 with its principal business address at 广州市天河区菁晖街12号, is the controller of personal information collected through https://cuesift.com and the CueSift application ("CueSift", "we", "us", or "our"). Privacy requests can be sent to support@cuesift.com. We have not appointed a Data Protection Officer because our current processing does not require one.

Waffo Pancake acts as Merchant of Record and handles payment and billing information under its own privacy notice. Source video platforms and other linked third parties are also responsible for information they collect directly. This Policy applies only to CueSift's processing.

2. Information we collect

Information you provide

• Account information: email address, display name, password hash and security records, or Google account identifier and basic profile information when you choose Google sign-in.
• Service content: submitted video URLs, public video metadata, selected language and processing mode, task settings and status, subtitle text, timestamps, edits, and export preferences.
• Support communications: messages, attachments, feedback, and information you provide when asking for help, refunds, or privacy assistance.

Information generated or collected automatically

• Usage and transaction records: available, reserved, and consumed minutes; order and subscription identifiers; product, amount, currency, payment or refund status; and related service events. CueSift does not receive or store full payment-card numbers or card security codes.
• Device, network, and log data: IP address or security hashes derived from it, browser and device information, user-agent or derived security hash, timestamps, request and error logs, authentication events, and abuse-prevention signals.
• Website analytics: pages viewed, approximate location, referrer, device and browser category, and interaction events when Google Analytics is enabled.

Please submit only public video links and content you are authorized to process. Do not place passwords, payment-card details, confidential tokens, or unnecessary sensitive personal information in a URL, subtitle, or support message.

3. Purposes and legal bases

• Contract: create and secure accounts; inspect links; extract, edit, save, and export subtitles; maintain usage balances; deliver subscriptions; process support and requested refunds.
• Legitimate interests: diagnose errors, improve reliability and usability, measure product performance, prevent abuse and fraud, protect users and systems, and establish or defend legal claims. We balance these interests against your rights.
• Legal obligation: maintain tax, accounting, transaction, sanctions, fraud-prevention, and compliance records, and respond to valid legal requests.
• Consent: use optional analytics or other optional processing where consent is required. You may withdraw consent without affecting earlier lawful processing.

We may create aggregated or de-identified statistics that no longer identify an individual. We do not use private subtitle content to train general-purpose AI models without explicit consent.

4. Cookies and analytics

• Strictly necessary storage maintains authenticated sessions, security, language, and core settings. Disabling it may prevent the Service from working.
• Functional storage remembers interface preferences and can generally be cleared through browser controls.
• Google Analytics may use cookies or similar identifiers to help us understand website traffic and interactions. You can limit these through browser controls or Google's opt-out tools. CueSift does not currently use third-party advertising pixels for targeted advertising.

Read the Google Privacy Policy and Google Analytics opt-out tool.

5. Sharing and service providers

We do not sell personal information for money and do not share private subtitle content for cross-context behavioral advertising. We disclose only the information reasonably needed for the following roles:

• Cloudflare: website and API hosting, database, queue, object storage, content delivery, security, and abuse prevention.
• Google: optional Google sign-in and Google Analytics.
• Alibaba Cloud Model Studio: automated speech recognition when source captions are unavailable.
• Resend: account-verification and service email delivery where configured.
• Waffo Pancake: hosted checkout, Merchant-of-Record payment processing, tax, billing, invoices, subscription management, and refunds. Waffo Pancake processes full card data under PCI-DSS controls; full card data does not pass through or remain on CueSift servers.
• Supported source video platforms: receive the submitted public URL or public identifiers when needed to retrieve public metadata, media, or captions, subject to each platform's privacy notice.

We may also disclose information when required by valid law or legal process, to protect rights and safety, during a merger or acquisition subject to continued protections and notice where required, or with your direction or consent.

6. Security and incident response

We use HTTPS/TLS in transit, salted password hashing, HttpOnly and Secure session cookies, hashed server-side session tokens, access controls, short-lived signed media access, request validation, rate limiting, and restricted secret handling. No online service can guarantee absolute security.

If a personal-data breach occurs, we will investigate, mitigate harm, document the event, notify the competent authority within 72 hours where GDPR requires it, and notify affected people without undue delay where the risk and applicable law require notice.

7. Retention and deletion

• Account, task, subtitle, and usage data: retained while the account is active. After a verified account-deletion request is approved, production copies are deleted or de-identified within 30 days and residual backups within 90 days, except for records we must retain by law or for a live dispute, fraud investigation, or security need.
• Payment, refund, tax, and accounting records: 7 years after the transaction, or a different period when mandatory law requires it; then deleted, archived with restricted access, or de-identified.
• Support communications: 24 months after the request is closed, unless linked to a longer legal or transaction retention duty.
• Security, authentication, and abuse-prevention logs: up to 12 months, unless needed longer for an active incident or legal claim.
• Temporary media and processing artifacts: signed access normally expires within 5 minutes; artifacts are removed after processing and no later than 7 days, except when temporarily isolated for failure recovery or security investigation.

Provider-controlled copies, including payment and analytics records, may follow the provider's independently disclosed retention period. We instruct processors to delete or return CueSift data when their role ends, subject to legal exceptions.

8. Your privacy rights

Depending on your location, you may request information about processing; access or a portable copy; correction; deletion; restriction; objection to legitimate-interest or direct-marketing processing; withdrawal of consent; and review of certain automated decisions. You may also complain to your local data-protection or consumer authority. We do not discriminate for exercising a privacy right.

Send a request from your account email with the subject “Privacy request.” We may verify identity and authority before acting. We aim to respond within 30 calendar days, or within a different statutory period; if law permits an extension, we will explain the reason and timing. support@cuesift.com.

9. Service and marketing communications

We send necessary account, verification, security, billing, subscription, policy, and support communications. These are not promotional messages and may continue while needed to provide the Service or meet legal obligations. CueSift does not currently send third-party advertising or sell mailing lists. If optional marketing is introduced, it will use consent where required and every marketing email will provide a working unsubscribe method.

10. International transfers

CueSift and its providers may process information in countries including the United States, China, Singapore, and other locations where providers operate. When personal information is transferred from a jurisdiction that restricts international transfers, we use an applicable lawful mechanism, such as an adequacy decision, contractual data-protection terms including Standard Contractual Clauses where required, or another recognized safeguard, and apply technical and organizational protections appropriate to the risk.

11. Children

CueSift is intended only for people aged 18 or older. We do not knowingly collect personal information from a child. If you believe a person under 18 has provided personal information, contact us so we can investigate and delete it where required.

12. Third-party links and platforms

The Service may link to or retrieve public information from third-party video platforms. Their privacy practices and content are outside CueSift's control. Review the relevant platform's policy before using it, and do not submit a link you are not authorized to process.

13. Changes to this Policy

We may update this Policy to reflect service, provider, legal, or security changes. The review date at the top will be updated. Material changes will be announced through the website, in-product notice, or registered email at least 15 days before taking effect where practicable, unless an urgent legal or security change requires earlier effect.

14. Contact

Privacy and support email: support@cuesift.com. Website: https://cuesift.com. Controller: 广州码蚁科技有限公司. Business address: 广州市天河区菁晖街12号, 中国. Support is monitored on business days in the Asia/Shanghai time zone. This Policy describes our practices but is not legal advice.