Data Processing Agreement

1. Definitions

• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, use, disclosure, or deletion.
• Data Controller: the entity that determines the purposes and means of Processing Personal Data.
• Data Processor: the entity that Processes Personal Data on behalf of the Data Controller.
• Data Subject: the individual to whom Personal Data relates.
• Applicable Data Protection Laws: all applicable data protection and privacy laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant regulations.

2. Scope and Roles

Clipses processes Personal Data on your behalf in connection with providing video transcription, clip creation, and highlight reel services. You are the Data Controller; Clipses is the Data Processor. Categories of Personal Data and Data Subjects are specified in Schedule 1.

3. Data Processing Obligations

Clipses shall:

• Process Personal Data only on documented instructions from you, unless required by applicable law
• Ensure that persons authorized to Process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational measures to ensure data security
• Not engage sub-processors without prior general or specific written authorization
• Assist you in responding to Data Subject requests to exercise their rights
• Delete or return all Personal Data upon termination of the Service, unless retention is required by applicable law
• Make available to you all information necessary to demonstrate compliance with this DPA

You shall:

• Ensure a lawful basis exists for the Processing and sharing of Personal Data with Clipses
• Provide clear and documented processing instructions
• Ensure the accuracy of Personal Data provided
• Comply with all Applicable Data Protection Laws

4. Security Measures

Clipses implements technical and organizational measures to protect Personal Data, including:

• Encryption: TLS/SSL encryption for data in transit; secure cookie policies (httpOnly, secure, sameSite)
• Authentication: Google OAuth 2.0 and email/password authentication with bcrypt hashing (12 rounds); NIST SP 800-63B password policy
• Access controls: Role-based access control (user, admin, super_admin); row-level security at the database layer; invite-gated registration
• Database security: Parameterized queries (SQL injection prevention); PostgreSQL-backed session storage; connection pool management
• API security: Rate limiting on authentication endpoints; webhook signature verification (HMAC-SHA256); replay attack prevention
• File security: Presigned URLs with 1-hour expiry; checksum validation; automated stale upload cleanup; path-based access control on storage buckets
• Input validation: Zod schema validation on API inputs; DOMPurify HTML sanitization
• Infrastructure: Secure HTTP headers (Helmet.js); CORS origin whitelisting; graceful shutdown procedures; centralized error handling with no stack trace leakage in production
• Monitoring: Email audit trails; webhook event tracking; activity logging

Additional details are provided in Schedule 2.

5. Sub-processors

You grant Clipses general authorization to engage the sub-processors listed in Schedule 3. Clipses shall:

• Notify you of any intended changes to sub-processors by updating the list in Schedule 3
• Ensure that all sub-processors are bound by data protection obligations no less protective than those in this DPA
• Remain liable for the acts and omissions of its sub-processors

You may object to a new sub-processor by contacting us at hello@clipses.ai within 14 days of notification.

6. International Transfers

Where Personal Data is transferred outside the European Economic Area (EEA) or the United Kingdom, Clipses shall ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Any other valid transfer mechanism under Applicable Data Protection Laws

7. Data Subject Rights

Clipses shall assist you in fulfilling your obligations to respond to Data Subject requests, including requests to:

• Access their Personal Data
• Rectify inaccurate data
• Erase their data ("right to be forgotten")
• Export their data in a machine-readable format (data portability)
• Restrict Processing
• Object to Processing

Clipses provides self-service tools for Data Subjects to exercise their rights directly:

• Data export: Available via Settings in the Clipses application (JSON format)
• Account deletion: Available via Settings, which cascades deletion through all associated data
• Email preferences: Granular opt-in/opt-out controls for marketing, product updates, and onboarding emails
• Cookie preferences: Granular consent management for essential, analytics, and marketing cookies

If Clipses receives a request directly from a Data Subject, it will promptly forward the request to you unless the request can be fulfilled through the self-service tools described above.

8. Data Breach Notification

Clipses shall notify you without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach. Notification shall include:

• The nature of the breach
• The categories and approximate number of affected Data Subjects
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

9. Data Retention

Clipses retains Personal Data in accordance with the following schedule:

Upon termination of the Service, Clipses shall delete all Personal Data within 30 days, unless retention is required by applicable law.

10. Duration and Termination

This DPA shall remain in effect for the duration of the Service agreement. Upon termination of the Service, Clipses shall:

• Delete all Personal Data in accordance with Section 9
• Provide confirmation of deletion upon request
• Retain only such data as required by applicable law, with continued protection under this DPA

11. Liability and Indemnification

Liability under this DPA is subject to the limitations set forth in the Terms of Service. Each party shall indemnify the other against losses arising from its breach of this DPA or Applicable Data Protection Laws.

12. California-Specific Terms (CCPA)

To the extent the California Consumer Privacy Act applies, Clipses certifies that it shall:

• Not sell Personal Data
• Not retain, use, or disclose Personal Data except as necessary to perform the Services
• Comply with all applicable CCPA obligations

13. Governing Law

This DPA shall be governed by the laws of the State of Oregon, consistent with the Terms of Service.

14. Contact

For questions or requests related to this DPA, contact us at:

Email: hello@clipses.ai

Company: The Good Ventures LLC dba Clipses

Schedule 1: Data Processing Details

Subject Matter: Processing of Personal Data in connection with video transcription, clip creation, and highlight reel services.

Duration: Duration of the Service agreement.

Nature and Purpose: Transcription of uploaded video/audio content, creation of video clips and highlight reels, user account management, and related platform operations.

Categories of Data Subjects:

• Registered users of the Clipses platform
• Individuals appearing in uploaded video/audio content
• Email recipients (marketing, onboarding, transactional)

Categories of Personal Data:

• Contact information (email address, name)
• Authentication data (hashed passwords, OAuth identifiers)
• Video and audio content uploaded by users
• Transcription text derived from uploaded content
• Usage data (upload counts, clip creation statistics, feature usage)
• Technical identifiers (IP addresses, session tokens, browser information)
• Payment information (processed by Stripe; Clipses does not store card details)
• Support ticket content (messages, screenshots, device information)
• Email engagement data (delivery status, open/click events)

Schedule 2: Technical and Organizational Measures

Clipses implements the following measures to protect Personal Data:

Access Controls

• Role-based access control with three-tier hierarchy (user, admin, super_admin)
• Row-level security policies at the database layer
• Invite-gated registration (no open signup)
• Session validation on every authenticated request

Encryption and Authentication

• TLS/SSL encryption for all data in transit
• bcrypt password hashing with 12 salt rounds
• Secure cookie configuration (httpOnly, secure, sameSite)
• OAuth 2.0 integration with Google for third-party authentication

Infrastructure Security

• Secure HTTP headers via Helmet.js (X-Frame-Options, HSTS, X-Content-Type-Options)
• CORS origin whitelisting with explicit allowlists
• Rate limiting on authentication endpoints
• Webhook signature verification with timing-safe comparison
• Parameterized database queries (SQL injection prevention)
• Input validation via Zod schemas and DOMPurify HTML sanitization

Data Management

• Automated purging of stale uploads (24-hour threshold)
• Automated purging of activity and email logs (12-month threshold)
• Presigned URLs with 1-hour expiry for file access
• Checksum validation on file uploads and downloads

Incident Response

• Documented breach notification procedure (detection, assessment, containment, notification within 72 hours)
• Graceful shutdown procedures for zero-downtime maintenance
• Centralized error handling with no stack trace exposure in production

Confidentiality

• All personnel with access to Personal Data are bound by confidentiality obligations
• Environment variables used for all secrets and credentials (never committed to source code)

Schedule 3: Authorized Sub-processors