Privacy

Privacy Policy

Last updated: 2026-05-23 · Effective immediately

This Privacy Policy explains how Sagar Patel ("JustShoot", "we", "us") collects, uses, shares and protects information when you use justshoot.in and the JustShoot platform at app.justshoot.in (together, the "Service").

Plain-English summary. We collect what we need to run the 9-agent pipeline — your account info, the YouTube channel data you provide, and the transcripts/scripts/thumbnails you generate. We do not sell your data. We share what is technically necessary with our infrastructure providers (Anthropic, Cloudflare, our payment processor and email provider). We delete your content 90 days after you cancel. You have full DPDP Act rights — access, correction, deletion, grievance — exercisable from your dashboard or by emailing support@justshoot.in.

1. Who we are

JustShoot is a service operated by Sagar Patel, registered in India at Ahmedabad, Gujarat, India. For purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary in respect of your Personal Data.

2. Information we collect

2.1 Account & profile data

Name, email address, and password hash (we never store your plain password — scrypt-hashed at rest).
YouTube channel handle, niche, sub-niches, target audience, tone preferences.
URLs of up to five reference videos you submit for Tone Fingerprint analysis.

2.2 Generated content

Transcripts auto-extracted from reference videos via yt-to-text or Azure Speech.
All agent outputs you generate — research briefs, scripts, fact-check reports, storyboards, thumbnail prompts, SEO packages, shorts scripts, distribution plans.
Your edits, regenerations, and project metadata (status, timestamps, agent IDs).

2.3 Usage & technical data

Token counts and cost per Claude CLI call (for usage analytics and billing).
IP address, user agent, session timestamps (for security and abuse prevention).
Pages viewed, buttons clicked, time on page (Google Analytics 4, anonymised by default).

2.4 Payment data

We use Razorpay to process subscription payments. We do not store your full card number, CVV, or UPI VPA on our servers. Our payment processor stores those values under their own PCI-DSS-compliant infrastructure. We only receive a subscription token, last-4 of card, brand, and billing status.

3. How we use your information

Run the 9-agent pipeline. Your inputs are passed to Anthropic's Claude API to generate the outputs you requested.
Build your Tone Fingerprint. Reference video transcripts are analysed once to produce a structured fingerprint stored against your account; the raw transcripts are retained so you can rebuild it later.
Bill your subscription and prevent abuse (e.g. shared credentials, scraping).
Send transactional email — verification, password reset, billing receipts — via Resend.
Improve the platform. We measure aggregate, anonymised usage (success rates per agent, average latency, drop-off points). We do not use your private content to train any third-party model.

4. Sharing & sub-processors

We share Personal Data only with the following categories of processors, each strictly for the purpose listed:

Anthropic (PBC, USA) — runs the Claude models that power the 9 agents. Per Anthropic's API terms, content sent through their API is not used to train their models.
Cloudflare (USA) — DNS, CDN, WAF, TLS termination. Sees IP and request metadata; does not see request bodies.
Microsoft Azure (Mumbai / Hyderabad regions) — hosts the production application server. Azure Speech is used only as a transcript fallback.
Resend (USA) — transactional email delivery. Receives recipient email and email body.
Google Analytics 4 (USA) — anonymised website analytics. IP truncation enabled by default.
Payment processor — Razorpay — processes subscriptions and invoices.

We will never sell your Personal Data. We do not run ad-targeting or share data with advertisers.

5. Cross-border data transfers

The Service uses providers located outside India (USA, EU). By using JustShoot you consent to your Personal Data being processed in those jurisdictions, subject to contractual safeguards equivalent to those required by the DPDP Act. The Government of India may restrict transfers to specific countries under Section 16 of the DPDP Act; we comply with any such restriction within the timelines notified.

6. Data retention

Active account: kept while your account is active.
After cancellation: projects, transcripts and generated content are retained for 90 days, then permanently deleted unless you ask for earlier deletion.
Payment records & invoices: retained for 7 years to meet Indian tax law (Income Tax Act, GST law).
Usage logs: aggregated and anonymised after 180 days.

7. Your rights (DPDP Act, Sections 11–15)

Right to information about the data we hold about you and who we share it with.
Right to correction and erasure — you can edit your profile and delete your account from the dashboard.
Right to grievance redressal — see the Grievance Officer details in Section 11.
Right to nominate another individual to exercise these rights in case of your death or incapacity. Contact us to register a nomination.
Right to withdraw consent for any non-essential processing at any time; this will not affect lawful processing already carried out.

To exercise any right, email privacy@justshoot.in. We respond within 7 days.

8. Cookies & similar technologies

Essential cookies: gstudio_user and gstudio_admin (HMAC-signed session cookies, HTTP-only, 7-day TTL). Required to keep you logged in.
Analytics: Google Analytics 4 (_ga, _ga_*). Anonymised, no PII.
Local storage: theme preference and UI state (no PII).

You can clear all cookies and local storage from your browser settings. Logging out via the dashboard clears your session cookies on our side.

9. Children

JustShoot is not intended for individuals under 18. If you are under 18, do not use the Service. If we learn we have collected data from a child without verifiable parental consent, we will delete it immediately.

10. Security

TLS 1.2+ for all traffic (Cloudflare-terminated).
Passwords stored as scrypt hashes (never plain text).
Admin actions HMAC-signed and logged.
Principle of least privilege for internal access.
Regular dependency audits and security reviews.

No system is perfectly secure. If you suspect a breach, email security@justshoot.in.

11. Grievance Officer

Per Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules, 2011 and Section 8(9) of the DPDP Act, 2023:

Grievance Officer: Sagar Patel
Email: grievance@justshoot.in
Response time: within 7 working days

12. Changes to this policy

We will email all active account holders at least 14 days before any material change. The "Last updated" date at the top of this page reflects the current version. Historical versions are kept on request.

13. Contact

Questions: privacy@justshoot.in · General: hello@justshoot.in