Privacy policy

ClipStation is run by Chaos Created Limited, a company registered in England and Wales with company number 08335221, whose registered office is at 51 Newfoundland Way, Portishead, Bristol, North Somerset, BS20 7FP. We are registered with the Information Commissioner's Office under number [ICO registration number, awaiting confirmation]. You can reach us about anything on this page through our support page.

This policy covers three groups, and our role is different for each.

• Account holders: the businesses and organisations that open an account and send recording links. For your details we are the controller: we decide what is collected and why. Section 3.
• Recorders: the people who record a video through a link. The business that sent you the link is the controller of your video and we are its processor: we store the video on its behalf and on its instructions. Section 4.
• Visitors: anyone who reads our public pages or tries the demo. Section 5.

What we collect. The name of your business or organisation and your email address, which you give us when you sign up. There is no password: you sign in by following a link we email you, and we keep a one-way hash of each link so that it can be used once and then no more. While you are signed in, a cookie identifies your session; the cookies page lists every cookie we set.

When you sign up or ask for a sign-in link, we keep a hash of your network address for a short time, to stop the forms being used to flood an inbox or create accounts in bulk. It is a one-way hash, shortened: we cannot turn it back into your address, and the counter it belongs to is removed once its hour has passed.

What you do. The links you create (what each asks for, its time limit, its end date and the video shape you chose), the videos that arrive through them, and how many you have received in the current month, so that we can apply the limits of your plan and tell you when you are close to them. We also note, against your account, when you signed up, when you went to checkout, and when your subscription started, changed, was set to cancel or ended, so that we can see how people become and stay customers.

Billing. Your subscription is sold to you by Stripe, which takes your payment and issues your invoices. Stripe collects your billing address and card details and handles them as a controller in its own right, under its own privacy policy. We never see your card details. What we keep is the reference Stripe gives us for you and for your subscription, your plan, whether it is monthly or yearly, when the current period ends, and whether it is set to cancel.

Emails we send. Sign-in links; a notice when a video arrives; a warning when you are close to your monthly allowance and another when you reach it; and notices about your plan and payments. We do not send marketing email.

Why we may do this. To provide the service you have asked for and keep our side of the terms (performance of a contract); to keep the service secure, enforce its limits and prevent abuse (our legitimate interests, which we have weighed against yours); and to keep the records the law requires us to keep (legal obligation).

Before your camera is switched on, the recording page shows you what is being asked for, who will receive it, how long it will be kept, and a statement you must agree to. Nothing is sent until you have watched your recording back and approved it. You can record again as often as you like.

What we store. The video itself and a still from it; your name and email address, only if the link asked for them and you gave them; the moment you agreed to the statement; the name and version of your browser, which helps us fix faults with particular devices; and a shortened one-way hash of your network address, kept to stop one person flooding a link. The business that sent you the link sees the video, your name and email address if you gave them, and when it arrived. It does not see the hash.

How the page is used. While you use a recording page, it tells us which steps you reached: that you opened it, allowed the camera, finished a take, sent it, and, if something went wrong, a short code saying what. Each step is stored with a random number made for that one visit and forgotten when you leave the page, the kind of device and browser you used (for example “phone, Safari on iPhone”), and your country if our hosting provider tells us it. Nothing is stored on your device, no cookie is used, and none of it says who you are. We use it to find the places where recording goes wrong and fix them, which is in our legitimate interests and in yours. This is ours, not the business's, and the business does not see it.

Who is responsible. The business that sent you the link decided to ask for your video and decides what to do with it. It is the controller, and its own privacy notice applies to what happens next. We hold the video for that business, on its instructions, as its processor. If you want to see, correct or delete your video, ask the business that sent you the link. If you cannot reach it, contact us through our support page and we will help.

How long. Each video is deleted automatically a set number of days after it arrives, and you are told that number before you record: 30 days on our Starter plan, 90 days on Pro, and up to 365 days on Business. The business may delete it sooner, or download it to keep a copy of its own. Once deleted it disappears from the dashboard at once and the file is removed from storage within 7 days. The record of the video can remain in a backup of our database for up to 7 days after that; the file itself is not backed up.

Who can watch it. The business you sent it to. We do not watch videos. One of our administrators may open a particular video only to investigate a report of misuse, a legal request or a fault the business has asked us to look into, and every time this happens the administrator, the video and the reason are written to a log.

Reporting a link. Every recording page has a way to report misuse. A report records the category you chose, anything you wrote, an email address if you chose to give one so that we can reply, and a shortened hash of your network address.

Our hosting provider keeps the usual web server logs, which include the address a request came from, for a short time, for security and fault-finding. We use Google Analytics on the public pages only (the home page, pricing, the demo, sign-up and the legal pages), to see how people find the site and use it. It runs unless you turn it off, which takes one click on the cookies page and lasts. It never runs on a recording page, on the sign-in page or in the dashboard, so a recording link is never shared with Google and neither is anything about a recording.

The demo records in your browser and keeps the recording in the page's memory for you to play back. Nothing from the demo is uploaded. Like a recording page, it tells us which steps you reached, in the same anonymous way described in section 4.

We use these companies to run ClipStation. Each handles only what its job needs.

Where one of these companies holds personal data outside the United Kingdom, we rely on the safeguards UK data protection law allows for, such as the UK's adequacy regulations or the International Data Transfer Agreement. [Confirm where each provider stores data and which safeguard applies.] We will tell account holders by email before we add or replace a company in this list.

• Videos are stored privately. They are never at a public address. A video is played back or downloaded through an address that works for a few minutes and then stops.
• There are no passwords to steal. Sign-in links work once and expire after 24 hours.
• Every time one of our administrators opens a video, a log records who, which video and why.
• Everything travels over encrypted connections.
• We keep only what the service needs. Network addresses are hashed before they are stored, and the raw address is never written down.

Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, object to our using it, and ask for it in a form you can take elsewhere. You can turn Google Analytics off at any time on the cookies page. Contact us through our support page and we will reply within a month.

If you recorded a video, the business that sent you the link is the controller of it, so these requests go to that business first. Section 4 says how we help.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, so that we can put it right.

We will change this page when the service changes or the law does. The date at the top shows when it last changed. If a change affects account holders in a way that matters, we will email them before it takes effect.

Use our support page, or write to 51 Newfoundland Way, Portishead, Bristol, North Somerset, BS20 7FP.