Privacy Policy

1. Who We Are

ClippingTool ("we", "our", "us") is a multi-tenant SaaS platform for live streaming, recording, and video clipping. We are the Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 (DPDP Act, India).

2. Personal Data We Collect

3. Third-Party Services

• Clerk — Authentication provider. Stores your email and identity tokens. Clerk Privacy Policy.
• Cloudflare R2 — Object storage for uploaded videos, clips, and recordings. Stored under your organization's namespace; not shared with other tenants.
• YouTube / Facebook — Only if you connect a destination and initiate a live stream. Your stream data is transmitted to their platforms per their own privacy policies.
• Hetzner Cloud — Infrastructure provider. Compute and managed database hosting. Data centres located in the EU.

4. Data Retention

• Account data: retained while your account is active; deleted within 30 days of erasure request
• Video assets / recordings: retained per your plan's DVR window; configurable in Settings
• Audit logs: retained for 2 years for legal/security compliance
• Consent records: retained permanently for regulatory audit trail (DPDP §6(7))
• Data rights requests: retained for 3 years

5. Your Rights (DPDP Act §12–§16)

As a data principal under the DPDP Act, 2023, you have the following rights:

• §12 Right to Access — Request a summary of personal data we hold about you.
• §13 Right to Correction & Erasure — Request correction of inaccurate data or complete erasure.
• §13 Right to Data Portability — Request your data in a machine-readable format.
• §14 Right to Grievance Redressal — File a complaint with our Grievance Officer. Response within 72 hours.
• §6(4) Right to Withdraw Consent — Withdraw any optional consent at any time via your Data Rights page.

To exercise any right, use the Data Rights Request form or email grievance@clippingtool.com.

6. Grievance Officer

7. Security

We implement technical and organisational measures including TLS 1.2+ in transit, AES-256 at rest, row-level security for tenant isolation, time-limited presigned URLs for media access, and structured audit logging. We maintain a breach notification runbook and will notify affected data principals and the Data Protection Board within 72 hours of a confirmed breach per DPDP Act obligations.

8. Changes to This Policy

Material changes will be communicated via email (if you have service notification consent) and a banner on next login. Continued use after 30 days of notice constitutes acceptance of updated terms.