CapCut Privacy Policy

Last Updated: 15 April 2026

Introduction
Welcome to CapCut. This Privacy Policy explains how we collect, use, share, and otherwise process the personal information in connection with the CapCut mobile software application (“CapCut APP”), CapCut desktop software applications (“CapCut Desktop version”), and the official CapCut website (“CapCut Web”), and any other website, app, or platform that links to this Privacy Policy (collectively, the “Services”). The Services are provided and controlled by Bytedance Pte. Ltd. with its registered address at 1 Raffles Quay, #26-10, South Tower, Singapore 048583 (“we” “us” or “our”) unless otherwise indicated in the Supplemental Terms - Jurisdiction Specific section to your region.

1. Information We Collect
We may collect your information in three ways: Information You Provide, Automatically Collected Information, and Information From Other Sources. More detail is provided below.

Information You Provide
Account Information. Such information may include, for example, your date of birth, login credentials, your phone number, and other information you choose to disclose in your user profile.
User Content. We may collect the content you create, import, upload, or generate through the Services, including associated metadata (such as when, and by whom the content was created). User Content may include the photographs, images, audio recordings, and videos you upload; video templates you generate or view; prompts, files, and other types of information that you submit to our AI-powered interfaces, as well as the final AI-generated responses we make available to you; and other actions you take on the Services, such as your comments and likes. We may collect User Content through pre-uploading at the time of creation, import, or upload, regardless of whether you choose to save or publish that User Content, for example, to recommend audio options, generate captions, and provide other personalised recommendations. Additionally, we access clipboard content, such as text and images, through your device’s clipboard when you choose to use certain functions, such as initiating information sharing with third-party services, or copying and pasting clipboard content onto our Services.
Purchase Information. If you use features that involve payment, including rewards programs, or the CapCut Cloud Space Services as described in our Terms of Service, we or our service providers may collect information such as what you purchased, and your payment details.
Marketing and Research Information. We collect information you choose to provide, such as your gender, age, and preferences, if you choose to participate in a survey, research, promotion, contest, marketing campaign, or event conducted or sponsored by us.
Communication Information. When you contact or otherwise communicate with us, we collect the information you send us, such as proof of identity or age, your data subject requests, and feedback or inquiries about your use of the Services.

Automatically Collected Information
Technical Information. We automatically collect certain device, browser, and network information when you use the Services. Such information includes your IP address, unique device identifiers, advertising identifiers, network type and connections, device model, device manufacturer, country calling codes, application version, app and file names and types, operating system, device resolution, system language and region, and battery information. We also collect service-related, diagnostic, and performance information, including crash reports and performance logs. Where you log in from multiple devices, we will be able to use your account information to identify your activity across devices.
Location Information. We collect information about your approximate location, including information based on your SIM card region and IP address.
Usage Information. We collect information about how you interact with the Services, including information about the content you view, the duration and frequency of your use, and your engagement with other users, such as information about your followers. This information may also include viewing history, users you follow, and the stickers and filters you use.
Content Characteristics and Features. We may collect information about the videos, images and audio that are a part of your User Content, for example by identifying objects and scenery; the existence and location of a face and other body parts; the nature of the audio; and the text of the words spoken in your User Content (for example, if you use the auto caption function). We may collect this information to enable special image and video effects, to recommend and moderate content, to serve you personalised ads where permitted, and to improve the Services. We do not use any face or body information to identify you in your User Content. Once an effect that uses face or body information has been applied to your User Content, that information is deleted and not retained.
Cookies. We and our service providers and business partners use cookies and similar tracking technologies to operate and provide the Services, including functions such as: remembering your language preferences; measuring website traffic and functionality; for security purposes and marketing purposes. We will obtain your consent to our use of cookies where required by law. You have the option to change your browser’s cookie settings, usually through your browser’s “options” or “preferences” menu. However, please note that if you choose to refuse, disable, or delete cookies, some of the functionality of the Services may no longer be available to you.

Information From Other Sources
Third-Party Platforms. We receive information from third party platforms to provide you with certain integrations and features. For example, we may receive your username, email address, and profile picture, as well as certain technical information, if you sign up or log in to the Services using a third-party platform.
Our Corporate Group. We may obtain information about you from affiliates controlled by, or under common control with, us.
Advertising, Analytics, and Other Partners. Advertisers, analytics, and other partners share information with us about you and the actions you have taken outside of the Services, such as your activities on other websites and apps.
Payment Service Providers. Depending on the features you use, we may receive information about you from payment service providers, such as payment confirmation and purchase details.
Others. We may also collect or receive information about you from others, including government authorities and publicly-available sources, as well as other users, such as where you are mentioned in User Content or in a complaint, request, or feedback submitted by a user or third party.

2. How We Use Your Information

We will use your information in order to:

• operate, customise, and administer the Services, such as enabling you to create, modify, share, and consume User Content; and to interact with other users, their content, and the Services’ interactive features;

• provide services to you through related products that are connected in functionality and use a unified account system;

• review, support, improve, and develop the Services, and train, test, and improve technology, such as machine learning models and algorithms, including by analysing how people are using the Services; conducting research; developing new features; monitoring your activity and usage across the devices you use to access the Services;

• communicate with you about service-related matters and updates, and respond to your requests and feedback;

• verify your age and identity;

• provide you with tailored or personalised information or content that may be of interest to you;

• promote the Services, including through marketing communications, contests, or campaigns and through third-party advertising platforms;

• provide advertising services, including personalised ads, where permitted;

• enforce our Terms of Service, Community Guidelines, and other terms, conditions and policies that apply to you, and to protect the safety of our community and integrity of the Services;

• maintain and enhance the safety, security, and stability of the Services by identifying and addressing technical or security issues or problems (such as technical bugs and spam accounts), and detecting abuse, fraud, and illegal activity;

• comply with our legal obligations and defend our legal rights and commercial interests, and those of our affiliates, users, and the public; and

• aggregate or de-identify Information We Collect.

3. How We Share Your Information
This section sets out how we may share Information You Provide, Automatically Collected Information, and Information From Other Sources. Please note that information shared with certain third parties may be processed in accordance with their privacy policies.

Service Providers and Business Partners
We share the categories of personal information listed above with our service providers and business partners as necessary to help us perform business operations and for business purposes, including providing, supporting, and developing the Services, cloud hosting, content generation, content delivery, customer and technical support, content moderation, marketing, analytics, and online payment. Examples of such service providers and business partners include:

• Third parties whose platforms or services are integrated with the Services, and who help us provide certain features and functionalities. For example, if you choose to log in to the Services using your third-party account credentials, or link your account to a third-party platform, we will share certain information to facilitate this, including Technical Information. And, some features of the Services are developed based on integration with YouTube’s API services (the “YouTube API Services”). If you choose to use the YouTube API Services, you agree to be bound by the YouTube Terms of Service. See Google’s security settings page to revoke your authorisation for access to your data by the YouTube API Services. For more information with respect to Google’s privacy practices, please visit this link.

• Payment service providers, who may receive Purchase Information and certain Technical Information when you make a payment on the Services.

• Advertising and measurement partners to help us promote the Services through advertising displayed on other platforms (some of which may be based on your activity across other websites, apps, and services). These partners may also help us measure the effectiveness of our advertising campaigns.

Our Corporate Group
We may share Information We Collect with affiliates controlled by, or under common control with, us as necessary for the purposes set forth within this Privacy Policy.

Legal Obligations and Rights
We may share the “Information We Collect” with certain competent law enforcement, regulatory or government agencies, courts, or other third parties if we have a good faith belief that it is necessary to:

• Comply with a legal obligation;

• Lawfully protect and defend the rights, property, safety, and security of the Services, our users, copyright holders, and others;

• Investigate potential violations of and enforce our Terms of Service, and other policies; or

• Detect, investigate, and prevent against fraud, technical issues, copyright infringement, or other misleading or illegal activities.

In Connection with a Sale, Merger, or Other Business Transfer
We may also share your information in connection with, or during negotiations of, a corporate transaction, such as a merger, consolidation, sale of assets or shares, reorganisation, financing, or acquisition of all or a part of our business, or in the unlikely event of bankruptcy.

Others
We may also share certain information with related products and services which share account log-in features and other functionalities.

With Your Consent
We may share information with third parties with your consent or at your direction.

4. Your Rights and Choices
Your in-app settings may enable you to access and modify certain of your account information, as well as manage the third-party services that are linked to your account.
You can also refuse, disable, or delete cookies and similar tracking technologies that collect your information through your device or browser settings, though by doing so, some of the Services’ features and functionalities may no longer be available to you. Each browser and device is different, so please consult the instructions provided by your browser or device (as applicable) to modify your cookie settings.
You can opt out of marketing emails by using the “unsubscribe” link or mechanism noted in each marketing email.

5. International Data Transfers

The personal information we collect from you may be stored on a server located outside of the country where you live. We store the information we collect in secure servers located in Malaysia, Singapore and the United States. Where we transfer any personal information out of the country where you live, including for one or more of the purposes as set out in this Policy, we will do so in accordance with the requirements of applicable data protection laws. Entities with whom we may share your data as described herein may be located outside of your country of residence.

6. Data Security
We maintain technical, administrative, and organisational measures designed to protect your information from unauthorised access, theft, disclosure, modification, or loss, and to provide a level of security appropriate to the processing risk. The Services may contain links, functionality, and content maintained by third parties we do not control, and any information shared with such third parties will be subject to their privacy and security practices and terms of use. We are not responsible for, and make no representations regarding, such third party practices and policies.

7. Data Retention

We retain information for as long as necessary to provide the Services and for the other purposes set out in this Privacy Policy. We also retain information when necessary to comply with contractual and legal obligations; when we have a legitimate business interest to do so (such as improving and developing the Services, and enhancing their safety, security, and stability); and for the exercise or defense of legal claims.

The retention periods differ depending on the type of information and the purposes for which we use the information. For example, if you use the Cloud Space Service, we will delete the information you have actively uploaded and stored therein at your request or as otherwise permitted by applicable law.

8. Information Relating to Children

CapCut is not directed at and is not intended for children under the age of 13. If you believe that we have collected personal information from a child under the minimum age, please contact us using the contact information found in the “Contact Us” section below.

9. Privacy Policy Updates

We may amend or update this Privacy Policy from time to time. We will notify you of any material changes by updating the “Last Updated” date at the top of the new Privacy Policy, or providing other notice as required by applicable law. We recommend that you review this Privacy Policy regularly to stay informed of our privacy practices.

10. Contact Us

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to:

- Contact us: Online or capcut.support@bytedance.com.

• Mailing Address:

CapCut, Bytedance Pte. Ltd.

1 Raffles Quay, #26-10, South Tower, Singapore 048583

SUPPLEMENTAL TERMS – JURISDICTION SPECIFIC

In the event of a conflict between the provisions of the Supplemental Terms – Jurisdiction Specific that are relevant to your jurisdiction from which you access or use the Services, and the rest of the Policy, the relevant jurisdiction’s Supplemental Terms – Jurisdiction Specific will supersede and control.

Argentina

If you are using our services in Argentina, the following additional terms apply. In the event of any conflict between the following additional terms and the provisions of the main body of this Policy, the following terms shall prevail.

Your rights and options. According to Law No. 25,326, Regulatory Decree No. 1558/2001 and the provisions and/or binding resolutions issued by the Agency for Access to Public Information (“AAIP”), you have the following rights with respect to your personal data: access, rectification and deletion regarding data protection. If you have questions about your rights or how to exercise them, please contact us using the information in the “Contact Us” section. If you have any questions about the processing of your personal data, we would like to clarify them.

We encourage you to contact us if you are not satisfied with how we have responded to any of your rights requests. You also have the right to lodge a complaint with the AAIP. You can contact AAIP through the site: https://www.argentina.gob.ar/aaip/datospersonales/derechos.

Australia

Certain entities in our corporate group, located outside of Australia, are given limited remote access to your information so that they can provide certain functions, as described in the section on “How we share your information.”

Brazil

If you are using our Services in Brazil, the following additional terms apply:

Exercise of data protection rights. Brazilian law provides certain rights to individuals with regard to their personal data. Thus, we seek to ensure transparency and access controls in order to allow users to benefit from the mentioned rights.

We will respond and/or fulfil your requests for the exercise of your rights below, according to the applicable law and when applicable, to the Brazilian General Data Protection Law - LGPD:

• confirmation of whether your data are being processed;

• access to your data;

• correction of incomplete, inaccurate or outdated data;

• anonymisation, blocking or erasure of data;

• portability of personal data to a third party;

• object to the processing of personal data;

• information of public and private entities with which we shared data;

information about the possibility to refuse providing personal data and the respective

• withdraw consequences, when applicable;

• withdrawal of your consent;

• request an analysis of decisions taken exclusively based on the automated processing of personal data that affect your interests, including decisions taken to define your personal, professional, consumer or credit profile, or aspects of your personality.

Verifying your identity. For your safety and to allow us to make sure that we do not disclose any of your personal data to unauthorised third parties, in order to verify your identity and guarantee the adequate exercise of your rights, we may request specific information and/or documents from you before we can properly respond to a request received concerning your data. All data and documents received from you in the process of responding to your requests will be used for the strict purposes of analysing your request, authenticating your identity, and finally responding to your request.

Limitations to your rights. In certain situations, we may have legitimate reasons not to comply with some of your requests. For instance, we may choose not to disclose certain information to you when a disclosure could adversely impact our business whenever there is a risk of violation to our trade secrets or intellectual property rights. In addition, we may refrain from complying with a request for erasure when the maintenance of your data is required for complying with legal or regulatory obligations or when such maintenance is required to protect our rights and interests in case a dispute arises. Whenever this is the case and we are unable to comply with a request you make, we will let you know the reasons why we cannot fulfil your request.

In case of doubt about your privacy, your rights or how to exercise them, please contact us using the information in the “Contact Us” section. If you have any questions about the processing of your personal data, we would like to clarify them.

International Transfer of Data. We share your personal data globally with companies within our business group to carry out the activities specified in this Policy. We may also subcontract the processing of data involved in the Services or share your personal data with third parties located in other countries. Your personal data may therefore be subject to privacy laws other than those applicable in your country.

Whenever we transfer your personal data to third parties located in other countries, we will ensure that these companies comply with applicable data protection laws and we will take all measures that are reasonably necessary to ensure the existence of adequate safeguards to protect your personal data and to ensure that it is processed safely.

Language. The Policy may have been prepared in the English language and in the Portuguese language. If you are a user located in Brazil, you shall refer to the Portuguese version, which shall prevail.

DPO. If you wish to contact the Data Protection Officer, please contact us: dpobrasil@bytedance.com

Canada

If you are using the Services in Canada, the following additional terms apply.

Information Relating to Minors. Please note that if you are a resident of the Province of Quebec, you are only permitted to use the Services if you are at least 14 years old.

Your Rights. Subject to limited exceptions under applicable law, you have the right to access, update, rectify and correct inaccuracies in your personal information in our custody and control and to withdraw your consent to our collection, use and disclosure of your personal information. To exercise these rights, you may contact us using the contact information set out below. We may require certain personal information for the purpose of verifying the identity of the individual making the request.

Your Choices. You can unsubscribe from our marketing emails at any time by clicking the “unsubscribe” link included at the bottom of each email we send. You can also adjust your preferences regarding certain types of personalised advertising by using the Ads tools in your Settings, and specifically by navigating to “Your Privacy Choices” in your in-app settings and switching off the applicable toggle.

Internal Policies and Access Controls. We implement and maintain internal policies and technical measures to restrict access to your personal information within our organisation. Access to personal information within our organisation is limited to employees who need the information to perform their job functions. For example, our customer support team may have access to certain types of information during our interactions with you, such as responding to complaints and inquiries. Similarly, our content moderators may access certain information in order to enforce our Terms of Service, Community Guidelines, and other conditions and policies.

Data Retention Practices. We have procedures in place to limit the retention periods as set out in the “Data Retention” section above. When personal information is no longer needed for these purposes or is no longer required to be retained by law, we take appropriate steps to dispose of it securely in accordance with our internal procedures.

Transfer Outside Your Jurisdiction. We and our service providers (including members, subsidiaries, or affiliates of our corporate group) may access, store and otherwise process personal information outside of Canada (and, for residents of Quebec, outside of Quebec), including in the United States, Malaysia, and Singapore, and other foreign jurisdictions where we or our service providers are located. For information about the manner in which we or our service providers (including service providers outside Canada) process personal data, please contact us using the contact information set out below. We and our service providers may disclose your personal information if we are required or permitted by applicable law or legal process, which may include lawful access by foreign courts, law enforcement or other government authorities in the jurisdictions in which we or our service providers operate.

Contact. If you are a resident of Canada, you can contact our Privacy Office using the contact information provided in the “Contact Us” section.

European Economic Area (“EEA”), Switzerland, and UK

If you are using the Services in the EEA, Switzerland or the UK (the “European Region”), the following additional terms apply:

Legal bases for processing. We use your personal information only as permitted by law. Our legal bases for processing your personal data described in this Policy are described in the table below.

International data transfers. If you normally reside in the European Region, the personal data that we collect about you may be further transferred to, and stored at, a destination outside of the European Region (for instance, to our service providers and partners). For example, we may store the information that we collect in secure servers located in the United States, Malaysia, and Singapore.

When we transfer your information outside of the European Region, we ensure it benefits from an adequate level of data protection by relying on:

Adequacy decisions. These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognise that a country offers an adequate level of data protection. Standard contractual clauses. The European Commission has approved contractual clauses under Article 46 of the GDPR that allow companies in the EEA to transfer data outside the EEA. These (and their approved equivalent for the UK and Switzerland) are called standard contractual clauses. We rely on standard contractual clauses to transfer your information to certain entities in our corporate group and third parties in countries without an adequacy decision.

If you wish to enquire further about these safeguards, please contact us through Data Subject Request Webform.

Your rights. You have the following rights:

The right to request free of charge (i) confirmation of whether we process your personal data and (ii) access to a copy of the personal data retained;

The right to request proper rectification or erasure of your personal data;

Where processing of your personal data is either based on your consent or necessary for the performance of a contract with you and processing is carried out by automated means, the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to have your personal data transmitted directly to another company, where technically feasible (data portability);

Where the processing of your personal data is based on your consent, the right to withdraw your consent at any time (withdrawal will not impact the lawfulness of data processing activities that have taken place before such withdrawal);

The right not to be subject to any automatic individual decisions, including profiling, which produces legal effects on you or similarly significantly affects you unless we have your consent, this is authorised by European Union or Member State law or this is necessary for the performance of a contract;

The right to object to processing if we are processing your personal data on the basis of our legitimate interest unless we can demonstrate compelling legitimate grounds which may override your right. If you object to such processing, we ask you to state the grounds of your objection in order for us to examine the processing of your personal data and to balance our legitimate interest in processing and your objection to this processing;

You have the right to request the restriction of the processing of your information where (a) you are challenging the accuracy of the information, (b) the information has been unlawfully processed, but you are opposing the deletion of that information, (c) where you need the information to be retained for the pursuit or defence of a legal claim, or (d) you have objected to processing and you are awaiting the outcome of that objection request.

The right to object to processing your personal data for direct marketing purposes; and The right to lodge complaints before your local data protection authority.

Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details.

Please contact us if you would like to exercise any of your rights through Data Subject Request Webform.

GDPR Representatives

If you are based in the United Kingdom, our designated GDPR representative is:

Cosmo Technology Private Limited

Kaleidoscope

4 Lindsey Street

London

United Kingdom

EC1A 9HP

If you are based in the EEA or Switzerland, our designated GDPR representative is:

Mikros Information Technology Ireland Limited

6th Floor

South Bank House

Barrow Street

Dublin 4

D04 TR29

Ireland

Cookies

We will, unless exempt, obtain your consent to the use of cookies. For more information about cookies, please visit our Cookies Policy.

Egypt

If you are using our Services in Egypt, the following additional terms apply:

You declare that you are over the age of 18. If you are under the age of 18, please have your parent or legal guardian read this with you. If you are reviewing these terms as the parent/legal guardian of a user who is under the age of 18, you hereby declare that such user is above the age of 13 and that you have read and acknowledged this Privacy Policy and Terms of Use and agree to the use by your child of the Services and registration for an account.

Indonesia

If you are using our Services in Indonesia, the following additional terms apply. In the event of any conflict between the following additional terms and the provisions of the main body of this Policy, the following terms shall prevail.

Age, Parental and Guardian Consent. By accessing and/or using our Services, you represent that you are at least 21 years of age or married or not under guardianship.

If you are below 21 years old and you are not married, or under guardianship: you must obtain approval from your parent(s) or legal guardian(s); and your parent(s) or legal guardian(s) are responsible for: (i) all your actions in connection with your access to and use of the Services; (ii) your compliance with this policy; and (iii) ensuring that any of your participation in the Services will not, in any event, result in any violation of applicable laws and regulations relating to child protection.

If you do not have consent from your parent(s) or legal guardian(s) and your parent(s) or guardian(s) is not willing to open the account under their name, you must cease accessing and/or using the Services.

Your Choices. You may withdraw your consent to our disclosure of personal data to third parties. Upon your request, we will display, publish, transmit, disseminate, and/or open the access to your personal data to third parties. Please note that by withdrawing your consent to the disclosure and/or collection of your personal data, we may not be able to fulfil your requests and you may not be able to use some of Capcut’s features and functionality.

You may request that we: (i) disclose the history of personal data that we have collected; and/or (ii) erase and dispose of your personal data that we have collected on our server. Please note that by requesting us to erase and dispose of your personal data, you may not be able to use some of Capcut’s features and functionality.

To exercise any of your rights, contact us through Data Subject Request Webform or capcut.support@bytedance.com.

Notification. In the event of any breach of personal data, we will notify you and provide you with information regarding such breach of personal data.

Data retention. We retain your information for as long as it is necessary to provide you with the service. Where we do not need your information in order to provide the service to you, we retain it only for so long as we have a legitimate business purpose in keeping such data. However, there are occasions where we are likely to keep this data for five (5) years (or longer if required) in accordance with our legal obligations or where it is necessary for the establishment, exercise or defence of legal claims.

After you have terminated your use of our Services and the five (5) years retention period has lapsed, we store your information in an aggregated and anonymised format. Non-personally identifiable information may be retained indefinitely for analytics.

Israel

If you are using our services in Israel, these additional terms apply. You declare that you are over the age of 18. If you are under the age of 18, please have your parent or legal guardian read this with you. If you are reviewing these terms as the parent/legal guardian of a user who is under the age of 18, you hereby declare that such user is above the age of 13 and that you have read and acknowledged CapCut Privacy Policy and Terms of Use and agree to the use by your child of the Services and registration for an account.

Mexico

If you use our services in Mexico, the following additional terms apply. In the event of a conflict between the following additional terms and the provisions of the main body of this policy, the following terms shall prevail.

Data Controller: Bytedance Pte. Ltd.1 Raffles Quay, #26-10, South Tower, Singapore 048583

How we use your personal data. Almost all of the purposes of the processing data indicated above in the main section of this Privacy Policy are necessary purposes. However, the following are secondary purposes:

To provide you with personalised advertising and surveys.

The above purposes are not necessary to provide the Services, but allow us to provide you with a better experience. We offer you the ability to make choices about how we use and disclose your personal data. You can always limit the secondary purposes of personaliaed advertising by using the tools in the Settings that allow you to limit certain features.

We use both human and automated means to process your data.

How we share your personal data. We may share your personal data with a third party for purposes other than processing on our behalf. We will obtain your consent to such disclosure as required by applicable laws.

By providing us with your personal data and using our Services, you agree to transfers that require your consent. You can always revoke your consent and exercise your rights as outlined below.

Language. The Policy may have been prepared in the English language and in the Spanish language. If you are a user located in Mexico, you shall refer to the Spanish version, which shall prevail.

Your Rights. You have the following rights with respect to your personal data: access, rectification, cancellation, objection, consent withdrawal, limitation of use and disclosure of your data. You may exercise your rights by submitting your request through Data Subject Request Webform or capcut.support@bytedance.com. To learn about the applicable requirements and the procedure for exercising your rights, please contact us through these methods. If you are under 18 years of age, you may exercise your rights through a parent or guardian. Requests to exercise for your rights will be resolved as soon as possible according to the applicable data protection law and the nature of your request.

Information relating to minors. You may review our parental consent section in the Terms of Service.

Philippines

If you are using our Services in Philippines, the following additional terms shall apply pursuant to the relevant laws, rules and regulations and issuances by the Philippines National Privacy Commission (“NPC”) on data privacy.

Your Rights. To the extent that the relevant laws, rules and regulations on data privacy recogniae your rights and freedoms as data subjects, you shall have the right to information, object, access, rectification, erasure or blocking, lodge complaints before the NPC, damages and data portability.

Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details.

Russia

Legal grounds for data processing. When we process your personal data, we rely on your consent, performance of a contract, our legitimate interest, and obligations to process personal data, when required by law.

By signing up and using the Services, you consent to the processing of personal data in accordance with this Privacy Policy.

Where we store your personal data. Your personal data may be transferred from Russia to Malaysia and Singapore and stored in that location, outside of the country where you live.

Public profiles. We rely on your consent to public distribution of personal data, when your account settings are ‘Public Profile’. You can change your profile to private by changing your settings to ‘Private Account’ in “Manage my account” settings.

South Africa

If you are using our Services in South Africa, the following additional terms apply:

You declare that you are over the age of 18. If you are under the age of 18, please have your parent or legal guardian read this with you. If you are reviewing these terms as the parent/legal guardian of a user who is under the age of 18, you hereby declare that such user is above the age of 13 and that you have read and acknowledged this Privacy Policy and Terms of Use and agree to the use by your child of the Services and registration for an account.

South Korea

If you are using our Services in South Korea, the following additional terms apply:

How we share your information. In addition to the main text of this policy, in the event we use information such as User Content and video content on our Services as part of our advertising and marketing campaigns to promote the Services, your personal information contained in such information may be disclosed to the recipients of such advertising or marketing content.

Personalised Ads. We may from time to time provide personalised ads on our Services to provide you our Services for free.

Data retention. We destroy personal data whose purpose of collection as consented to by you have been achieved, or whose periods of and use to which you consented to or which were provided in the Policy have expired; provided, however, we will continue to store your personal data for the following statutorily-prescribed periods, where applicable, including, but not limited to: Act on Consumer Protection in Electronic Commerce:

• Records on your cancellation of an order, your payment on a purchased item, and our supply of a good/service: 5 years

• Records on the handling of consumer complaints or disputes: 3 years

• Records on advertisements and labels: 6 months

• Protection of Communications Secrets Act

• Records on your visits to our website: 3 months

Destruction of Personal data. We destroy your personal data in a manner that renders it unrestorable by the relevant department.

Your Rights.

Data Rights. You have the right to access personal data we hold about you, to rectify any personal data held about you that is inaccurate, to request the deletion of personal data held about you, and the right to request the suspension of the processing of your personal data. You can exercise your rights by contacting us through Data Subject Request Webform or capcut.support@bytedance.com.

Data Security. We work hard to protect CapCut and our users from unauthorised access to or unauthorised alteration, disclosure or destruction of information we hold. To this end, we have in place technical, managerial and physical safeguards, including internal policy for data protection, limiting the access to personal data on a need-to-know basis and controlling access to the facilities where personal data is processed.

Information Relating to Minors. CapCut is not directed at minors under the age of 14.

Entrustment and/or Overseas Transfer of Personal Data. We entrust your data to our affiliates, cloud storage providers, IT service providers, and data centers, some of whom are located abroad, subject to your consents or notifications to you, if applicable. The entities receiving and processing your data are committed to using and storing personal data in compliance with domestic and international regulations and to taking all available physical and technical measures to protect personal data. You may opt-out of such transfer so long as the transfer is not necessary to provide you with the Services, by contacting us through Data Subject Request Webform or capcut.support@bytedance.com.

Türkiye

If you are using our Services in Türkiye, the following additional terms apply:

Data Controller Representative. You may contact our data controller representative in Türkiye by email to handle questions and complaints in connection with the processing of your personal data if you are in Türkiye.

Legal bases for processing your personal data. We rely on the following legal bases while processing your personal data in accordance with Article 5 of the Law No. 6698 on Protection of Personal Data:

• processing is explicitly laid down or dictated by laws

• processing of your personal data is necessary provided that it is directly related to the conclusion or fulfillment of the contract between us

• processing is mandatory for us to be able to comply with our legal obligations

• the relevant data is made available to the public by yourself

• processing is mandatory for the establishment, exercise, or protection of a right

• processing is mandatory for our legitimate interests, provided that it does not violate your fundamental rights and freedoms

• your explicit consent (Please note that we rely on this legal basis only when we require your consent for the processing and we do not rely on this legal basis if and when we rely on one of the other legal grounds above)

Your rights. According to Article 11 of the Data Protection Law, you have the following rights with respect to your personal data:

• the right to learn whether we process your personal data,

• the right to request information with regard to such processing, if we process your personal data, the right to learn the purposes of the processing and whether they are used for such purpose or not;

• the right to know the third parties within or outside the country, to whom we transfer your personal data,

• the right to request correction of incomplete or inaccurate personal data,

• the right to request deletion or destruction of your personal data under the conditions set forth in Article 7 of the Data Protection Law,

• the right to request that we notify the third parties, to whom we transferred your personal data, about the correction, deletion and/or destruction of your personal data per your request within the scope of the foregoing two items,

• the right to object to the negative results about you that are due to the analysis of your personal data processed solely by automated means,

• the right to claim indemnification for damages incurred due to illegal processing of your personal data.

If you would like to exercise your rights, please contact us through Data Subject Request Webform or capcut.support@bytedance.com.

The requests found in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest free of charge. However, if your request incurs additional cost to our company, then you may be charged over the tariff fee determined by the Turkish Personal Data Protection Board.

Language. This policy is available in English and Turkish. If there is any inconsistency or different interpretation between the English and Turkish versions, the Turkish text shall prevail.

Cookies. We will, unless exempt, obtain your consent to the use of cookies. For more information about cookies, please visit our Cookies Policy.

United Arab Emirates

If you are using the Services in the United Arab Emirates (“UAE”), the following additional terms apply:

How we share your personal data. In addition to the main text of this policy, by using the Services in the UAE you agree to the terms of this Privacy Policy and consent to our sharing of your personal data in line with the main text of this Privacy Policy.

Governing law and dispute resolution. By using our Services in the UAE, this Privacy Policy will be governed by and interpreted in accordance with the laws of the UAE. In the event of a dispute arising between the parties in connection with this Privacy Policy: where the dispute relates to a claim for a sum within the limits specified by the DIFC Small Claims Tribunal from time to time, then the dispute shall be referred by either party to the said Tribunal; and for all other disputes, the parties shall seek settlement of that dispute by mediation in accordance with the Mediation Rules of the DIFC-LCIA Arbitration Centre, which Rules are deemed to be incorporated by reference to this clause. If the dispute is not settled by mediation within 30 days of the commencement of the mediation, or such further period as the parties shall agree in writing, the dispute shall be referred to and finally resolved by arbitration under the Arbitration Rules of the DIFC- LCIA Arbitration Centre, which Rules are deemed to be incorporated by reference to this clause. The language to be used in the mediation and in the arbitration, shall be English. In any arbitration commenced pursuant to this clause the number of arbitrators shall be one and the arbitration shall be conducted in Dubai.

Vietnam

If you are using our Services in Vietnam, the following additional terms apply:

Age, Parental and Guardian Consent. By accessing and/or using the Services, you represent that you are at least 16 years of age or not under guardianship. If you are below 16 years old or under guardianship: you must obtain approval from your parent(s) or legal guardian(s); and your parent(s) or legal guardian(s) are responsible for: (i) all your actions in connection with your access to and use of the Services; (ii) your compliance with this policy; and (iii) ensuring that any of your participation in the Services will not, in any event, result in any violation of applicable laws and regulations relating to child protections.

If you do not have consent from your parent(s) or legal guardian(s) and your parent(s) or legal guardian(s) is not willing to open the account under their name, you must cease accessing the Services.