Privacy Policy

Effective 2026-10-28

eBrain, Inc. ("we") runs Cuditing ("the service") and processes only the personal data the service needs. This policy applies from 2026-10-28.

1. What we process

Email sign-up: your email address and password. The password is stored only as a one-way hash.
Email confirmation: until you open the link we mail, we keep your address, the hashed password and a hash of the link’s token. Opening the link creates the account; otherwise all of it is deleted after 24 hours.
Google sign-in: only the email address and account identifier Google provides. We do not receive your name, photo or contacts.
Without an account: a random identifier in a cookie that tells your browser apart. No name or email.
Using the service: the video and audio you upload, the transcripts, speaker labels and edits made from them, and usage records such as processing time. Recordings may contain other people’s faces and voices; we process them only to make your edit.
Payments (once they open): plan, amount, date and order number. Card details go to our payment provider, never to us.
Automatically: the sign-in cookie, IP address, access time and browser details. Allowances for visitors without an account use an irreversible transform of the IP address.
The service is not for children under 14.

To identify you and confirm your sign-up, sign you in, transcribe and edit your recordings, deliver the files, email you about sign-up and finished jobs, take payments and refunds, answer you, and prevent abuse.
Never for advertising, marketing or profiling. We do not train AI models on your recordings or transcripts.

Account data: until you delete your account, then without delay.
Projects: on Free and without an account, projects unopened for 7 days are deleted; on paid plans they are kept while you are subscribed.
Pending sign-ups: 24 hours. Sign-up mail log (a hash of the address): 2 days. Job and upload records: 30 days. Sign-in sessions: 30 days.
Records the law requires: contracts and payments 5 years, complaints and disputes 3 years, access logs 3 months.

We do not share personal data with third parties unless you agree or the law requires it.

These providers process data for us, outside Korea, each receiving only what its task needs, encrypted in transit, at the time it is needed:
Cloudflare, Inc. (USA, privacyquestions@cloudflare.com): hosting, database and file storage, email delivery. All the data in section 1, whenever you use the service.
Soniox, Inc. (USA, support@soniox.com): speech recognition, audio extracted from your upload, when an auto-edit runs.
OpenRouter, Inc. (USA) and TypeSafe (USA): sentence-level judgments, transcript text, when an auto-edit runs. OpenRouter passes the request to TypeSafe’s model.
Google LLC (USA): sign-in, if you choose it. Paddle.com Market Ltd (UK): payments and tax, once payments open.
If you object to a transfer you can stop using the service and delete your account; without these providers we cannot transcribe, edit or deliver files.

You can access, correct, delete or restrict your data, or withdraw consent, at any time: from your account page or by writing to us. We answer within 10 days. Records the law requires us to keep are kept for that period.

Two necessary cookies only: cud_auth keeps you signed in (up to 30 days); cud_sid identifies work done without an account (up to a year, removed when you sign in). No advertising, tracking or third-party analytics.

HTTPS with HSTS, scrypt password hashing, only hashes of session and link tokens stored, owner checks on every playback and download, per-job access limits for processing servers, separately held secrets, and limits on sign-in and sign-up attempts.

Cut suggestions are generated automatically, but they decide nothing about your rights; you can review and undo every cut.

Privacy officer: Cuditing service lead, support@cuditing.com. Write for any privacy question or request.

We announce changes here and in the service 7 days before they apply, or 30 days before for changes against your interest.