Privacy Policy

Effective Date: July 9, 2026

Shotro inc. (“Shotro,” “we,” “us,” or “our”) provides the website at shotro.ai, a waitlist, and an AI-assisted creative production platform for private projects and invited collaboration (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Service or communicate with us.

This Policy covers both our current website and waitlist and the paid product described below. Features and vendors identified as planned will apply only when they are activated. We may provide a shorter notice at a specific collection point when useful.

This is an operational privacy notice and not a certification that every planned product or vendor is live. Our current and planned subprocessors are listed on our Subprocessors page.

Index

1. Information We Collect

2. How We Use Information

3. AI Content and Model Training

4. How We Disclose Information

5. Retention

6. Your Choices and Rights

7. California Privacy Disclosures

8. European and UK Disclosures

9. Security and International Transfers

10. Age Requirement

11. Changes to This Policy

12. Contact Us

1. Information We Collect

1.1 Information You Provide

Waitlist information. When you join the waitlist, we collect your email address and the consent record associated with your submission, including the date and time, notice version, and relevant preference. If offered, promotional marketing consent is optional and separate from the request to join the waitlist.

Account and contact information. When the product launches, we may collect your name, email address, login credentials or authentication identifiers, organization, role, account preferences, and information you provide when inviting a collaborator.

Billing information. We may collect subscription, credit, invoice, billing address, payment status, and transaction information. Stripe processes payment-card details on our behalf; Shotro does not intend to store complete payment-card numbers.

Private project content. We may process prompts, scripts, images, video, audio, references, brand assets, production notes, comments, edits, generated outputs, project metadata, and other materials you submit or generate. Projects are private by default and are disclosed only as necessary to provide the Service or as you direct, including to invited collaborators.

Communications. We collect support requests, feedback, survey answers, legal requests, and other messages you send us.

Do not submit sensitive personal information, government identifiers, health or financial records, biometric templates, confidential information belonging to others, or any material you lack authority to use unless a specific Shotro feature requests it and explains the processing.

1.2 Information Collected Automatically

Our systems may collect IP address, browser and device type, operating system, language, approximate location derived from IP address, referring page, pages viewed, timestamps, error and security logs, feature interactions, and similar technical data. We use cookies, local storage, logs, and related technologies as described in our Cookie Notice.

Google Analytics 4 (“GA4”) may collect website usage data only after you affirmatively allow analytics cookies through our consent controls. GA4 does not load before that consent. We also retain the consent preference itself so the site can honor your selection.

1.3 Information from Other Sources

We may receive limited information from authentication or connected services you choose to use, payment processors, invited collaborators, service providers, and public sources. The information depends on your settings and authorization with the third party.

2. How We Use Information

We use personal information to:

1. operate the website, maintain the waitlist, provide the product, and manage accounts;

2. store and process private projects, generate requested outputs, and support invited collaboration;

3. process subscriptions, credits, payments, refunds, and related records;

4. send waitlist, service, security, billing, support, legal, and - when separately permitted - promotional messages;

5. remember privacy choices and, with consent where required, measure website use;

6. secure the Service, detect fraud or abuse, debug errors, and enforce our agreements;

7. respond to requests, provide support, and improve usability and reliability using feedback and operational data; and

8. comply with law, protect rights and safety, and establish or defend legal claims.

We may create information that is aggregated or de-identified so it cannot reasonably be linked to a person. We may use that information for lawful analytics, research, security, and product-planning purposes and will not attempt to re-identify it except to test our de-identification methods or as permitted by law.

3. AI Content and Model Training

Shotro processes private project content to perform the actions you request, such as storing a project, generating or editing content, enabling invited collaboration, providing support you request, and protecting the Service. This operational processing is not permission to train models on your private content.

Shotro will not use private customer prompts, uploads, or outputs to train or fine-tune Shotro or third-party generative models unless the customer gives separate, specific, affirmative opt-in consent. Refusing or later withdrawing that optional consent will not remove access to the core Service. Any training program will have its own notice describing the content involved, purpose, recipients, retention, and withdrawal process.

Before a generative API provider receives production customer content, we will identify that provider and its purpose on our Subprocessors page, evaluate its relevant data terms, and configure available controls consistent with this Policy. We do not authorize a provider to use private project content for its independent model training unless you separately opt in to that use.

4. How We Disclose Information

4.1 Service Providers and Planned Product Vendors

We disclose information to vendors only as reasonably necessary for their services. Our current or planned providers include:

Google Analytics, for consent-based website measurement;

Google Cloud, for planned cloud hosting and infrastructure;

Supabase, for planned database, authentication, and storage functions;

Resend, for waitlist and planned transactional or permitted marketing email delivery;

Stripe, for planned payment, billing, fraud-prevention, and subscription processing; and

individually named generative API providers, when selected and listed before they receive production customer content.

A vendor listed as planned may not yet receive personal information. See the Subprocessors page for the current list, purposes, and available processing-location information.

4.2 Other Disclosures

We may disclose information to invited collaborators and integrations you direct us to use; professional advisers under appropriate duties; courts, regulators, law enforcement, or other parties when reasonably necessary to comply with law or protect rights and safety; and parties to a proposed or completed financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections where practicable.

Shotro does not currently offer a public project gallery or community. Private project content is not made public by default.

4.3 No Sale or Cross-Context Behavioral Advertising

We do not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising, and we do not use personal information to target advertisements based on activity across non-Shotro businesses, websites, or services. If our practices change, we will update this Policy and provide any notices and choices required by law before the new practice begins.

5. Retention

Waitlist. We keep waitlist records through launch so we can provide requested updates. If a waitlist member does not become a customer, we delete or anonymize the record no later than 12 months after the paid product launches, unless the person asks us to delete it sooner or law requires a different period. We may retain a minimal suppression record - such as an email address or irreversible representation of it and the opt-out date - to honor an unsubscribe request.

Accounts and projects. We retain account and private project information while the account is active and for a limited period afterward as needed to complete deletion, maintain backups, provide requested services, resolve disputes, prevent abuse, and meet legal obligations. Product-specific deletion periods will be presented in the Service when available.

Business records. We retain payment, tax, consent, security, support, and legal records for the period reasonably necessary for the relevant purpose and applicable limitation or recordkeeping period. When information is no longer needed, we delete or anonymize it, or securely isolate it until deletion from backups is practicable.

6. Your Choices and Rights

Cookie choices. You can accept or reject analytics through our consent banner and change your selection at any time through “Cookie Settings.” Rejecting analytics does not prevent access to the site. See our Cookie Notice.

Marketing. You may unsubscribe using the link in a marketing email or contact us. We may still send requested waitlist messages and necessary transactional, security, legal, or account messages. Promotional marketing consent is separate from waitlist enrollment where required.

Account and privacy requests. Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection, to withdraw consent, or to appeal a decision. Contact privacy@shotro.ai. We may take reasonable steps to verify your identity and authority. We will not discriminate against you for exercising a privacy right.

You may also request account deletion through available settings after launch. Some information may remain temporarily in backups or be retained where permitted for security, billing, tax, fraud prevention, dispute, or legal purposes.

7. California Privacy Disclosures

7.1 CalOPPA and Online Tracking

California residents may review this Policy to learn the categories of personal information we collect, the sources, purposes, parties to whom it is disclosed, and the process for requesting changes. We post the effective date above and will identify material updates as described in Section 11.

Some browsers send “Do Not Track” signals. Because there is no uniform technical standard for those signals, Shotro does not currently respond to them. We do, however, treat a recognized Global Privacy Control signal as a direction to reject nonessential analytics on that browser or device. You may also use our Cookie Settings at any time.

Shotro does not permit third parties to collect personal information on our site for cross-context behavioral advertising. With your consent, GA4 may measure your activity on Shotro as described above and in our Cookie Notice.

7.2 CCPA/CPRA Status and Rights

Based on our present operations, Shotro does not believe it is currently a “business” subject to the California Consumer Privacy Act (“CCPA”). We monitor the law’s applicability as our operations grow. If and when the CCPA applies, California residents will receive the required rights and notices, including applicable rights to know, correct, delete, limit or opt out, and use an authorized agent.

Regardless of that status, we currently honor reasonable access, correction, and deletion requests as described in Section 6, and we do not sell personal information or share it for cross-context behavioral advertising.

8. European and UK Disclosures

8.1 Controller and Legal Bases

For personal data covered by this Policy, Shotro inc., at the address in Section 12, is generally the controller. When Shotro processes personal data solely on a business customer’s documented instructions, the customer is the controller and Shotro is a processor under our Data Processing Addendum.

We rely on the following legal bases as applicable:

Contract, to take requested pre-contract steps, provide accounts and product functions, process payments, and deliver support;

Legitimate interests, to operate and secure the waitlist and Service, communicate requested updates, prevent fraud and abuse, diagnose errors, improve reliability, protect rights, and manage our business, after considering the impact on your rights;

Consent, for optional analytics cookies, promotional electronic marketing where required, and any optional use of private content for model training; and

Legal obligation, for tax, accounting, regulatory, court-order, and other required processing.

You may withdraw consent at any time without affecting processing completed before withdrawal. Providing information is generally voluntary, but we cannot enroll you on the waitlist or provide an account or requested feature without the information marked as necessary.

8.2 EEA, UK, and Swiss Rights

Subject to legal conditions and exceptions, you may request access to and a copy of your personal data; correction; deletion; restriction; portability; or an objection to processing based on legitimate interests or for direct marketing. You may withdraw consent and may complain to the supervisory authority where you live or work or where you believe an infringement occurred. UK users may complain to the Information Commissioner’s Office. Swiss users may contact the Federal Data Protection and Information Commissioner.

Shotro does not currently use personal data to make solely automated decisions that produce legal or similarly significant effects. Contact privacy@shotro.ai to exercise a right. We generally respond within one month, subject to lawful extensions.

8.3 EU and UK Representatives

During the limited, low-volume waitlist stage, Shotro relies on the exception to appointing an EU or UK representative for processing that is occasional, does not involve large-scale special-category or criminal-conviction data, and is unlikely to create a risk to individuals’ rights and freedoms. This exception is based on the nature of processing, not company size.

Before opening the paid Service to EEA or UK customers, Shotro will appoint representatives where Article 27 of the GDPR or UK GDPR requires them, or obtain written advice from qualified counsel confirming that an exception continues to apply. We will publish representative contact details here before the applicable paid launch.

9. Security and International Transfers

We use administrative, technical, and organizational safeguards designed for the nature of the information and our operations. No online service is completely secure, and we cannot guarantee absolute security. Customers should use strong credentials, control collaborator access, and avoid submitting information the Service is not designed to handle.

Shotro is established in the United States, and information may be processed in the United States and in countries where our providers operate. These countries may have different data-protection laws. For transfers from the EEA, UK, or Switzerland that require a safeguard, we will use a lawful mechanism appropriate to the transfer, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another legally recognized mechanism, and supplementary measures where required. We will verify the applicable mechanism with each relevant provider before covered production transfers begin rather than claiming an unverified certification.

10. Age Requirement

The Service is for adults age 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor submitted personal information, contact privacy@shotro.ai; we will investigate and delete it where required.

11. Changes to This Policy

We may update this Policy to reflect changes in the Service, vendors, law, or our practices. We will post the revised version and update the effective date. If a change is material, we will provide additional notice appropriate to the change, such as email or an in-product message, and request consent where required. Earlier versions may be requested at privacy@shotro.ai.

12. Contact Us

For privacy questions, rights requests, or complaints:

Shotro inc.
3101 Ocean Park Blvd Ste 200, #612
Santa Monica, CA 90405, United States
Email: privacy@shotro.ai

For legal notices, email legal@shotro.ai or write to the same address, Attn: Legal Department.