Privacy policy

Last updated 6 October 2026

How Shotz Pty Ltd handles your personal information. Each section starts with the short version, and the detail follows.

1. Who we are

In short: Shotz is run by Shotz Pty Ltd in Melbourne, and we follow the Australian Privacy Principles.

This policy explains how Shotz Pty Ltd (“Shotz”, “we”, “us”) collects, uses, shares and protects personal information when you use the Shotz website, app, API and MCP server.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where other privacy laws apply to you, such as the GDPR in Europe and the UK, we handle your information in line with those too.

For anything in this policy, contact us at privacy@shotz.video.

2. What we collect

In short: Your account details, what you upload and make, how you use Shotz, and billing details through Stripe.

Account details: your name, email address, profile photo, the sign-in method you use, your workspace name, and the people you invite.

Your content: footage, photos, audio, prompts, reference photos and Elements you upload or create, the shots and edits you make, comments, and what Shotz detects in your media so you can search it, such as transcripts, faces, objects and places. Your content may include personal information about you and other people who appear in it.

Billing details: your plan, invoices, and credit purchases. Card details are collected and stored by our payment provider, Stripe; we only see the card type, last four digits and expiry date.

Usage and device information: which features you use, generations you run and the credits they cost, pages you visit, your browser and device, your IP address and the approximate location it suggests, and error logs.

Messages: what you send us when you contact support or give feedback.

We don’t ask for sensitive information such as health, religious or political information. If your content contains it, we only process it to provide the service to you.

3. How we collect it

In short: Mostly from you. Some from the services you sign in with, and some automatically as you use Shotz.

We collect most information directly from you when you sign up, upload, generate, edit, share, buy credits or contact us.

If you sign in with Google, we receive your name, email address and profile photo from Google. If someone invites you to a workspace, we receive your email address from them.

We collect usage and device information automatically using cookies, local storage and server logs (see section 8).

4. How we use it

In short: To run Shotz for you, keep it safe, bill you, help you, and make it better.

We use personal information to: create and manage your account and workspace; store, process, generate and export your content; let you share and collaborate; charge for plans and credits; send you service messages, such as receipts, security alerts and notices that a generation is ready; answer support requests; prevent fraud, abuse and breaches of our terms; fix problems and improve Shotz; and meet our legal obligations.

We’ll only send you marketing emails, such as product news, if you’ve agreed or the law allows it, and every one has an unsubscribe link.

We don’t sell your personal information, and we don’t use it for third-party advertising.

5. AI models and your content

In short: Your prompts and references go to the model you pick, only to make your result. Nobody trains on them.

When you generate, Shotz sends your prompt and any frames, references or Elements you use to the AI model you chose, through our model provider fal.ai, which runs models made by companies such as Google, ByteDance, Kuaishou, Alibaba, OpenAI, xAI, Black Forest Labs, Recraft, ElevenLabs and Topaz. They process it only to return your result.

We don’t use your content to train AI models, and our agreements don’t allow our model providers to train on it.

Some Shotz features analyse your media automatically, for example to transcribe speech, find moments, detect faces for Elements and keep a face consistent across takes. This analysis is used only to provide those features to your workspace. We don’t use faces to identify people across different workspaces.

7. Where your information is stored

In short: Some of our providers store or process information outside Australia, mainly in the United States.

Our providers store and process information in the United States and other countries where they operate, which may include countries in Europe and Asia. When we send personal information overseas, we take reasonable steps to make sure it’s protected in a way that’s consistent with the Australian Privacy Principles, including through our contracts with those providers.

For people in the European Economic Area and the UK, we rely on approved transfer mechanisms, such as standard contractual clauses, where they’re needed.

8. Cookies and local storage

In short: We use them to keep you signed in and remember your settings. No advertising cookies.

We use cookies and similar browser storage that are needed to sign you in, keep your session secure and remember preferences such as your workspace and layout.

We may use privacy-friendly analytics to understand which features are used, measured in aggregate. We don’t use advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings, but Shotz won’t work properly without the ones needed for signing in.

9. How long we keep it

In short: While your account is open, then we delete it within 30 days, and from backups within 90.

We keep your account details and content while your account is open. When you delete a file, an edit or an Element, it’s removed from Shotz straight away and from our systems within 30 days.

When you delete your account or workspace, we delete the personal information and content in it within 30 days, and from backups within 90 days.

We keep some records for longer where the law requires it or for legitimate business reasons, such as invoices and payment records for tax purposes (generally seven years), and logs needed to investigate abuse or security incidents.

10. How we protect it

In short: Encryption, access controls, and only the access people need.

We encrypt information in transit and at rest, limit access within Shotz to people who need it to do their job, keep each workspace’s data separate with database access rules, and review the security practices of our providers.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

11. Your choices and rights

In short: You can see, fix, export or delete your information, and say no to marketing.

You can view and update your account details in Your account, export your content from Shotz, and delete files, workspaces or your whole account in Settings.

You can also ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing privacy@shotz.video. We’ll reply within 30 days. We may need to check who you are first, and there are some cases where the law lets or requires us to refuse, in which case we’ll tell you why.

If you’re in Europe or the UK, you also have the right to object to or restrict some processing, and to data portability. Where we rely on your consent, you can withdraw it at any time.

You can unsubscribe from marketing emails using the link in any of them. We’ll still send service messages you need, such as receipts and security alerts.

If you’re in someone else’s workspace, the workspace owner controls the content in it. Requests about that content may need to go through them.

12. Children

In short: Shotz is for people 18 and over.

Shotz isn’t meant for anyone under 18, and we don’t knowingly collect personal information from children. If you think a child has given us their information, contact privacy@shotz.video and we’ll delete it.

13. Questions and complaints

In short: Talk to us first. If you’re not happy with our answer, you can go to the OAIC.

If you have a question or a complaint about how we handle personal information, email privacy@shotz.video. We’ll acknowledge it within 7 days and aim to resolve it within 30.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you’re in Europe or the UK, you can contact your local data protection authority.

14. Changes to this policy

In short: If we change how we handle your information in a way that matters, we’ll tell you first.

We may update this policy as Shotz changes. The date at the top shows when it was last updated. For changes that matter, we’ll tell you by email or in the app before they take effect.