Legal

Privacy Policy

Last updated: 31 August 2026

Shotloom is operated by SMF Vision Labs Private Limited, a company incorporated in India, GSTIN 36ABUCS1748K1ZL ("we", "our", "us"). We are the Data Fiduciary for the personal data described below. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using Shotloom, you agree to the practices described in this policy.

Customer care: support@shotloom.ai
Privacy and grievances: grievance@shotloom.ai

1. Information We Collect

We collect the following categories of information:

Account information: Your name, email address, and profile photo, provided via Google Sign-In when you create an account.
Profile information: When you complete your profile, we collect your full name, phone number, email address, billing address (street, area, city, state, PIN code and country), and your answer to how you heard about us. We ask for each of these for a specific reason. The billing address is required to raise a GST invoice. The phone number is verified by a one-time SMS code, which is how we stop the same person claiming free credits and referral rewards repeatedly. The attribution answer tells us where people are finding Shotloom. You may also optionally tell us what kind of creator you are.
Generation data: The prompts you submit, the outputs generated, and metadata such as generation type, quality, and timestamp.
Credit and transaction data: Your credit balance, credit usage history, and purchase records.
Usage data: Information about how you interact with the platform, including pages visited, features used, and session duration.
Device and technical data: IP address, browser type, operating system, and device identifiers collected automatically when you use the Service.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve the Shotloom platform.
Process your credit purchases and maintain your account balance.
Send transactional emails: account creation confirmation, low credit alerts, payment receipts, and dormancy warnings.
Send marketing communications about new features, promotions, and platform updates. You may opt out at any time.
Analyse usage patterns to improve generation quality and user experience.
Detect and prevent fraud, abuse, and violations of our Terms of Service.
Comply with applicable legal obligations.

3. Data We Do Not Collect

Shotloom does not:

Store your payment card details. All payment processing is handled by our payment provider (Razorpay) and governed by their privacy policy.
Sell your personal data to third parties for advertising purposes.
Use your generated content to train AI models without your explicit consent.

4. How We Share Your Information

We share your information only in the following circumstances:

Service providers: We share data with trusted third-party providers who assist us in operating the platform, including Google (Firebase, Vertex AI, Google Cloud Storage, and Google Analytics), Microsoft (Clarity), Sentry (error monitoring and session replay), Upstash (Redis queue), and Razorpay (payments). These providers are contractually obligated to protect your data.
Session replay: If, and only if, you switch on the Session replay category in your cookie choices, Microsoft Clarity and Sentry record what you do on screen. That means your pointer movement, clicks, taps, scrolling and the content of the pages you were on, replayed back to us as a video-like session so we can see where the interface confuses people. It is off unless you turn it on, and you can turn it off again at any time from the Cookies link in the footer. See our Cookie Policy.
Legal requirements: We may disclose your information if required by law, court order, or government authority.
Business transfers: If Shotloom is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you beforehand.
PIN code lookup: When you type a PIN code into your billing address, we send that six-digit code on its own to India Post's public postal API at api.postalpincode.in to look up the matching city, state and nearby areas. Your name, email, phone number and street address are never sent with it, and the request carries nothing that identifies you. The lookup is a convenience only: if it fails or you would rather not use it, you can type your city, state and area yourself and still complete the form.

5. Data Retention

We retain your account data for as long as your account is active. If you close your account, we will delete your personal profile data within 30 days. Generation outputs stored in our cloud storage may be retained for up to 30 days after account closure before permanent deletion.

AI-generated outputs are permanently deleted 365 days after they are created. From 180 days they are moved to lower-cost archival storage, which can make the first load of an older file slower but does not change what you can do with it. At 365 days they are erased. This is enforced automatically by a storage lifecycle rule, not by hand. Please download anything you want to keep.

Source files you upload for image-to-video and similar tools are deleted within 24 hours of upload. They exist only long enough to run the generation you asked for.

Transaction and credit records may be retained for up to 7 years for financial and legal compliance purposes, even after account closure.

6. Cookies and Tracking

Shotloom uses cookies and similar technologies in three groups. Essential storage keeps you signed in, remembers your cookie choice, and carries a referral code from a link you clicked. Analytics is Google Analytics 4 and our own first-party counters. Session replay is Microsoft Clarity and Sentry, which record and replay what you do on screen.

Analytics and session replay are off until you switch them on. Their scripts are not downloaded and set nothing while a category is off, so declining is not a preference we record and then ignore. If you switch a category off after having switched it on, we clear that provider's cookies and reload the page so the script is no longer present. You can change your choices at any time from the Cookies link in the footer of any page.

Error and crash reporting through Sentry is separate from session replay and is not covered by those toggles. It captures a stack trace when the product fails so we can repair it, is configured to carry no personal data, and is described in our Cookie Policy. You can also block or delete cookies in your browser settings, though some features will not work without the essential ones.

7. Data Security

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS), Firebase Authentication token verification on all API requests, and access controls on our cloud infrastructure. However, no system is completely secure. We cannot guarantee absolute security of your data.

If we become aware of a data breach that affects your personal information, we will notify you via email within 72 hours of discovery.

8. Your Rights

You have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete data.
Deletion: Request deletion of your account and associated personal data.
Opt-out: Unsubscribe from marketing emails at any time using the unsubscribe link in any email we send.
Data portability: Request your generation history and account data in a portable format.

To exercise any of these rights, email us at support@shotloom.ai. We will respond within 30 days.

9. Children's Privacy

Shotloom is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will delete it immediately.

10. Third-Party Links

The platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice on the platform. The "Last updated" date at the top of this page reflects the most recent revision.

12. International Data Transfers

Your data is stored and processed on servers located in the United States (Google Cloud, us-central1 region). Where you switch on the analytics or session replay categories, data also reaches Google, Microsoft and Sentry, who operate their own processing locations outside India. By using Shotloom, you consent to the transfer of your personal data to the United States, which may have different data protection laws than your country. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy and applicable law, including the DPDP Act, 2023.

13. Cookies We Use

Every cookie and browser storage item we set is listed individually, with its purpose and lifetime, in our Cookie Policy. That page also shows your current choices and lets you change them. In summary:

Essential, always on: the Firebase session cookie (authentication, session duration), sl_consent (remembers your cookie choice), sl_ref_code (a referral code from a link you clicked), sl_install_dismissed (7 days) and sl_continue_draft (cleared on generation).
Analytics, off unless you switch it on: _ga, _ga_*, _gid, _gat from Google Analytics (2 years / 24 hours), and our first-party counters sl_visitor_id, sl_session_id, sl_first_seen, sl_visit_number, sl_last_visit, sl_attribution, sl_first_touch, sl_last_touch, sl_visit_count, sl_landing_page, sl_entry_timestamp, sl_pages_viewed, sl_page_load_time. None of these is created while the category is off.
Session replay, off unless you switch it on: _clck, _clsk, CLID, MUID, ANONCHK, SM from Microsoft Clarity (up to 1 year), and Sentry Session Replay. Neither script loads while the category is off.

14. Grievance Officer | DPDP Act 2023

In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it, a Grievance Officer has been designated:

Entity: SMF Vision Labs Private Limited (GSTIN 36ABUCS1748K1ZL)
Office: Office of the Grievance Officer, SMF Vision Labs Private Limited
Grievances and privacy: grievance@shotloom.ai
Customer care: support@shotloom.ai

Our response times. We acknowledge every complaint within 24 hours of receipt and resolve it within 15 days. Complaints concerning non-consensual intimate imagery or the impersonation of a real person are actioned within 24 hours. These are the shorter of the periods available to us under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020, and we apply the shorter one in every case.

You may raise a complaint regarding the handling of your personal data by writing to the Grievance Officer. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

15. Generation Data Retention

AI-generated outputs (videos and images) are stored for 365 days from the date of creation. At 180 days they are moved to lower-cost archival storage; at 365 days they are automatically and permanently deleted from our servers. Source files you upload to drive a generation are deleted within 24 hours. You are responsible for downloading and saving any outputs you wish to keep, and we do not currently send a reminder before deletion.

16. Contact

For any privacy-related questions or requests, contact us at:
support@shotloom.ai
For data-related complaints: grievance@shotloom.ai

17. Third-Party Data and Attribution

To fill in your city and state from a PIN code, Shotloom ships a copy of the India postal code dataset published by GeoNames, used under the Creative Commons Attribution 4.0 International licence. The dataset contains postal codes, districts and state names only. It contains no personal data and is not modified beyond being reformatted for use in the app.

PIN codes not present in that bundled copy are looked up against India Post's public postal API, as described in section 4.