Data Processing

Last updated: October 24, 2026

This page describes, in plain terms, how ClipHaus processes the material clients send us and the personal data the platform holds. It supports the Privacy Policy; if the two ever conflict, the Privacy Policy controls.

1. What we receive

• Client content: episode links and uploaded recordings, episode notes, and brand assets a client chooses to share.
• Account data: names, email addresses, roles, and workspace settings for admins, clippers, and client users.
• Operational records: jobs, versions, QC decisions, invoices, and ledger entries created by using the service.

2. Why we process it

Client content is processed only to produce the clips the client ordered: selecting moments, editing, captioning, review, and delivery. We do not use client footage to train models, we do not sell it, and we do not mine it for any other client's benefit.

3. Who processes it

• Supabase (Singapore region): account database, authentication, and platform records.
• Backblaze B2 (US West): video file storage, primary and backup buckets, both private.
• Cloudflare: hosting and delivery of the website and application.
• Assigned humans: the editor assigned to a job and the admin who reviews it. Nobody else in the studio can open a client's files.

Downloads of finished clips are issued as signed links that expire after 15 minutes.

4. Retention

During the free phase, delivered final clips are kept in primary storage for 30 days after delivery and in backup storage after that, so a lost file can be re-issued. Source recordings are retained while a show is active so later episodes can be cut to the same standard. Account and financial records are retained as the append-only ledger requires.

5. Deletion and export

A client may ask at any time, at contact@arafatarzu.me, for an export of their content or for its deletion. Deletion covers primary and backup storage and is confirmed by email when complete; financial ledger entries are retained in anonymised form where the law and basic accounting require a record of the transaction.

6. Security

Access is role-based and per-organization, storage buckets are private, admin accounts use two-factor authentication, and sensitive actions are written to an append-only audit log. Security reports go to security@arafatarzu.me.