Privacy policy.

• Account details: your name, email address, profile photo and sign-in method, including Google or Apple sign-in if you choose one.
• Workspace details: workspace names, members, invitations and roles.
• Your content: the videos and images you upload, links you import, the briefs, reference images and reference videos (uploads or YouTube links) you use to create looks, captions and edits you make, intro and outro videos, and feedback you send about a clip. Your content often includes information about other people, such as their faces, voices and names and what they say.
• Public profile: if you publish a look to the community, the creator profile you set up: name, handle, photo, bio and website or social links, shown with when you joined.
• Support messages: what you send to OneShot support by email or through the in-app support chat, including any files you attach.

• Processing results: transcripts, chosen moments, captions, explainers (the graphics designed for your clips, and the photos, maps and AI-generated images and video in them), B-roll, sound effects and music, look versions and rendered clips made from your content.
• Face and speaker analysis: to frame clips, OneShot finds the faces in your video, follows each person through it and estimates who is speaking. To keep track of the same person within a video, it computes numerical descriptions of their faces (face embeddings). It holds these in memory only while it processes that video, doesn’t store them, and doesn’t use them to recognize who someone is or to match people across videos. OneShot also works out speakers’ names from what is said, for example from introductions.
• Billing records: your plan, credit balance and usage, and purchase history. Purchases on the website are made through Polar, which sells OneShot plans to you as merchant of record and takes card payments through Stripe; in-app purchases, when the iOS app offers them, are processed by Apple. OneShot does not receive or store full card numbers.
• Support chat details: when the support chat starts, OneShot gives the chat service your account ID, name, email address and profile photo, your workspace’s name and ID, and your plan and its status (in the iOS app, also the app version), so support knows who is writing. On the website this happens a few seconds after you open your dashboard or the help page while signed in, so the chat is ready when you need it, even if you never open it. The chat service also records your messages and files, when you sent them, the page you started the chat from, and your browser, device and operating system.
• Service and device data: IP address, browser or device type, app version, timestamps and request records, kept to run, secure and troubleshoot the service.
• Error and performance reports: diagnostic details when something fails, sent to error monitoring and performance tools.
• Push notification token: on iOS, a device token if you turn notifications on.
• Website measurement: the website counts page views and sign-up steps with first-party events that carry no cookie or persistent identifier. Where optional product analytics is enabled, you can also choose to let OneShot use PostHog to connect visits, signups, video creation and purchases using a pseudonymous identifier. This optional tracking starts only after you allow it, and skips collection when your browser sends Do Not Track or Global Privacy Control. It does not include your video content, transcripts or prompts, and does not record your screen. OneShot uses no advertising trackers.

• To provide OneShot: turning your videos into clips, generating and previewing looks, rendering, keeping your library, and sharing what you choose to share.
• To run accounts, workspaces, plans and credits, including returning credits for failed work where the product offers it.
• To send service messages, such as sign-in codes, invitations, receipts and the notifications you turn on.
• To send occasional product update emails, which you can turn off at any time.
• To add explainers and B-roll to your clips, when they are on: OneShot picks out the people, places, organizations and things your video talks about, looks up photos, maps and footage of them, and has AI generate illustrations and short video clips.
• To answer your support requests, by email or chat.
• To keep OneShot secure and reliable: preventing abuse, investigating problems and measuring performance, including review by authorized Tessact staff as described in “When information is shared”.
• To meet legal obligations and enforce the terms of use.

Tessact does not sell your personal information or your content, and does not use them for advertising.

OneShot relies on the companies below. Each receives only the information its part of the service needs. Service providers process it for Tessact under their agreements with Tessact; the public services OneShot looks things up in (Wikimedia and YouTube) handle those requests under their own terms and privacy policies.

• Google Cloud and Firebase (Google): hosting, databases, storage, video processing and delivery, error reports, and push notifications, which Firebase passes to Apple. Google’s Vertex AI also runs the AI models that read your transcripts, video frames, briefs, reference images and reference videos to choose moments, plan and design clips and explainers, name speakers, write captions and create looks: Google’s Gemini models, and Anthropic’s Claude models, which Google runs. Gemini also transcribes speech when ElevenLabs is unavailable, and can draw an image for a look when you ask for one. Google’s terms say it doesn’t use this content to train AI models.
• ElevenLabs: transcribes the speech in your videos, from the audio track. When music is on, it also composes the music bed from a short description of the clip’s mood that OneShot writes, which can include the clip’s title.
• BytePlus: generates the illustrations and short video clips in explainers and B-roll, from descriptions OneShot writes about what your video talks about. The descriptions can name people and places; BytePlus doesn’t receive your video.
• Wikimedia Foundation: OneShot searches Wikidata, Wikimedia Commons and Wikipedia for photos and maps of what your video talks about.
• Chatwoot: runs the in-app support chat.
• PostHog: where enabled and with your consent, helps us understand product usage and conversion using pseudonymous events.
• Clerk: sign-in and account management.
• Polar: sells plans on the website as merchant of record; card payments go through its payment processor, Stripe. Apple: Sign in with Apple, push notifications on iOS, and in-app purchases once the iOS app offers them.
• Resend: sends OneShot’s emails.
• YouTube retrieval: when you import a YouTube link, or use one as a look’s reference, OneShot fetches the video through third-party retrieval services (Tunelio or VidKraken) and checks its length with the YouTube Data API.

What explainers and B-roll send. With either on, OneShot sends the names of people, places, organizations and things your video talks about (for example, a city, a product or a public figure) to the search services above, and sends the image and video generator short scene descriptions. These services don’t receive your video or its audio. OneShot also searches Google Search (through Vertex AI), Bing and YouTube for pictures and footage, and downloads the chosen ones from the sites that host them.

YouTube. OneShot uses YouTube API Services to read a linked video’s length and to search YouTube for explainer and B-roll footage. It sends YouTube video IDs and search terms, and doesn’t access your YouTube account. YouTube’s Terms of Service (https://www.youtube.com/t/terms) apply, and Google’s Privacy Policy (http://www.google.com/policies/privacy) explains how Google handles that information.

In the iOS app, you are asked for permission before your content is first sent to the AI services named above, and you can turn that permission off at any time in You › Privacy.

OneShot uses cookies and similar storage to run the service and, if you allow it, for optional product analytics. It does not use them for advertising or to follow you across other sites.

• Sign-in: Clerk, OneShot’s sign-in provider, sets cookies that keep you signed in (such as __session and __client_uat on oneshot.tessact.ai, and __client on clerk.oneshot.tessact.ai).
• Support chat: when you’re signed in to the website, the chat widget, which loads from Chatwoot, sets cookies that remember your conversation and who you are (cw_conversation and cw_user_…, kept for up to a year) and, briefly, whether to pause chat prompts; signing out clears the first two. The iOS app keeps a token for your conversation in its private storage until you sign out.
• Preferences: the website and app remember choices such as your theme and composer options on your device.
• Measurement: first-party page-view counting uses no cookies or stored identifiers. Optional product analytics stores your choice and a random browser identifier for up to 90 days. After sign-in, it links that browser's journey to a pseudonymous account identifier. You can withdraw through Analytics preferences on this privacy page or in Settings → Profile; this stops future optional collection but does not delete previously collected events. Contact support to request deletion of those events.
• YouTube previews: when you paste a YouTube link on the website, your browser asks YouTube for the video’s title and thumbnail, so YouTube receives your IP address and the video link.

• With your workspace: members of a workspace can see the videos, clips and looks in it.
• When you make something public: a share link lets anyone with the link watch and download the clips you include, until you turn the link off or the clips are deleted. A link to a whole video also shows clips and tweaks you add to it later. Looks you publish to the community are visible, with your creator profile, to other OneShot users and visitors, and OneShot may feature them, for example in its own collection, with credit to you.
• With Tessact staff: authorized Tessact staff can see account, workspace and billing records, the titles, status and errors of runs, clip feedback and AI looks, and, when their role allows, play and download clips and see your name, email address and photo. Staff in admin roles can also suspend accounts, change plans and credits, cancel runs and moderate community looks. Engineers who run OneShot’s cloud systems can reach stored files when they need to fix a problem. Staff use this access to give support, fix problems, prevent abuse and manage billing. Access depends on each person’s role, can be set to expire, and staff opening customer media is logged.
• For legal reasons: when the law requires it, or to protect the rights, safety and property of OneShot users, Tessact or others.
• In a business transfer: if Tessact is part of a merger, acquisition or sale of assets, information may transfer with it, still protected by this policy.

OneShot keeps videos for a limited time after you last work on them. A video’s clock starts when its last run finishes (making clips, More clips or a tweak), and new work on the video restarts it.

• Free plan: a video, its clips and all of its files are deleted 7 days after the video’s last run.
• Paid plans: 30 days after a video’s last run, its footage, transcripts and working files are deleted. Its finished clips stay until you delete them, but they can no longer be tweaked and the video can’t make more clips.
• If your paid plan ends, the paid-plan rules apply for 30 days after your last paid period. After that the free-plan rules apply, except to clips already kept under the paid-plan rules, which stay. Upgrading moves videos still inside the free plan’s 7 days onto the paid-plan rules.
• Unpublished AI look drafts are deleted 30 days after their last edit. Published looks stay until you remove them.
• Videos you delete leave your library at once. Their files are deleted on your plan’s schedule above, counted from the video’s last run.
• Deleted files can remain in storage for up to 7 more days before they are erased, and are never restored into your library. Database backups are kept for 14 days.
• Records about your videos and clips (such as titles, settings, credits used and feedback) stay in OneShot’s database after the files are deleted, for as long as your account is active.
• Intro and outro videos and images you upload for looks are kept until you remove them or your account is deleted.
• Account and workspace information is kept while your account is active. Shared workspace content may remain available to other members after an individual account is deleted.
• Support conversations are kept in the chat service until you ask for them to be deleted, or until the chat service’s retention limit for Tessact’s plan removes them.
• Diagnostic, security, billing and audit records, including records of staff access, may be retained separately to operate the service, investigate problems and meet legal obligations.

• Access and correct: update your name, email and photo in your account settings.
• Delete: delete a video, with its clips, at any time. In the iOS app, Account & security → Delete account requests permanent deletion of your account and associated personal data, including your personal content, public contributions and support conversations. No separate support request is required. We manually fulfill account deletion within 30 days and send confirmation to your verified email. Your account remains available until fulfillment starts. Content belonging to other members of shared workspaces and records we must retain for legal or billing obligations may remain. Backups expire under their retention policies and are not restored into active use. You can also request deletion by emailing OneShot support.
• Notifications: manage email and push notifications in settings. Turn off product update emails in the website’s settings or from the unsubscribe link in any of them.
• Photos, camera and microphone: the iOS app asks for permission to add the clips you save to your photo library, and, only if you attach a photo or video in support chat, to use the camera and microphone. Videos you pick are shared with OneShot one at a time.
• Explainers, B-roll and music: turn them off when you make clips. With explainers and B-roll off, OneShot doesn’t search for or generate photos, maps, images or video for that run.
• Support chat: it’s optional; you can always email OneShot support instead.
• Keep copies: download clips you want to keep before the dates in “How long information is kept”.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how it is processed, and to complain to a data protection authority. To make a request, email oneshot@tessact.com; identity verification may be needed.

OneShot is not meant for anyone under 18, and Tessact does not knowingly collect information from children. If you believe a child has used OneShot, email oneshot@tessact.com so the account can be removed.

OneShot’s database, APIs and stored files are on Google Cloud in India (Mumbai). Rendering runs on Google Cloud in Singapore. Other video processing, such as transcoding, face tracking and cut-outs, runs in Singapore too, or in the Netherlands when Singapore can’t take a job or Tessact moves that work there; temporary working copies stay there for up to 7 days. Videos and images are delivered through Google’s content delivery network, which keeps temporary copies close to viewers around the world, and service logs are kept in Google Cloud’s global logging location.

OneShot reaches the AI models on Google’s Vertex AI through Google’s global endpoint, so that processing can take place in any country where Google runs Vertex AI. ElevenLabs, Clerk, Chatwoot, Polar, Resend and the Wikimedia Foundation keep information in the United States, and Polar’s payment processor Stripe in the United States or Ireland. BytePlus processes in Malaysia, Indonesia or the European Union. The YouTube retrieval services don’t publish where they process information.

Where information crosses borders, it remains protected by the providers’ contractual commitments and the safeguards in this policy.

Information is encrypted in transit, access to production systems is limited and logged, and media is served through short-lived links. Staff access to customer content depends on each person’s role, can be set to expire, and is logged when staff open customer media. On iOS, uploads waiting to be sent use the device’s data protection and are excluded from backups. No system is perfectly secure, so keep your sign-in methods safe and report any suspected misuse to OneShot support.

When this policy changes, the date at the top is updated. Significant changes are announced in the product or by email before they take effect.

Questions or requests about privacy: oneshot@tessact.com. OneShot is operated by Tessact Pvt Ltd.