Privacy Policy

Last updated: October 22, 2026

This Privacy Policy explains what information ClipHaus (“we”, “us”) collects when you use our podcast clipping service and dashboards, where that information lives, how long we keep it, who processes it for us, and the choices and rights you have. It applies to creators (clients), editors, administrators, and visitors to our public pages.

By using the Service you accept the practices described here. Our handling of client episodes and finished clips is also governed by our Terms of Service.

1. What we collect

1.1 Account data

• Name, email address, and login credentials handled through our authentication provider.
• Account role (creator, editor, or administrator), account status (for example, pending or approved), and organisation membership.
• Contact and profile details you give us, such as your show name, payout or payment details where needed, and communication preferences.

1.2 Organisation and show data

• Organisation details, the shows under an organisation, and which accounts belong to which organisation and show.
• Package, quota, cycle, and entitlement information for each organisation.

1.3 Episode links and metadata

• Links to podcast episodes that clients submit, together with episode titles, numbers, descriptions, publication details, and other metadata supplied with the submission or read from the linked source.
• Briefs, notes, target moments, comments, and revision requests attached to an episode or a clip.

1.4 Uploaded finished clips

• Finished clip files that editors upload through the dashboard, in each version submitted, together with file names, file sizes, checksums, format and duration information, and technical verification results.
• Clip titles, captions, hook text, and status records (for example, in production, in quality control, delivered, or revised).

1.5 Comments and revisions

• Comments, quality-control notes, approval decisions, and revision requests made by creators, editors, and administrators, with the name of the account that made them and when they were made.

1.6 Billing records

• Invoices and their line items, package and rate snapshots, payments received, outstanding balances, and due dates.
• Editor payout records, including the per-clip payout lines, rates applied, and any adjustment entries and their reasons.
• Records of manual payments, such as the method used, the amount, and the date funds cleared. We do not collect or store full payment card numbers: in the current version of the Service, payment is made by manual methods confirmed on the invoice.

1.7 Audit logs and technical records

• Append-only status and audit history for accounts, episodes, jobs, clips, quota, invoices, and payouts, recording what changed, when, and which account made the change.
• Basic technical records generated when the platform is used, such as request timestamps, IP addresses, browser and device information, error reports, and email delivery records for messages we send through our email outbox.

1.8 Communications

• Messages you send us by email or through support, and our replies.

We do not ask for, and you should not send us, sensitive personal information such as health records, government identity numbers, or information about children, except where it happens to appear inside a podcast episode you submit for clipping. Podcast content is handled as client content under the Terms.

2. How we use information

• To create, approve, and operate accounts and to control who can see and do what in each dashboard.
• To receive episode submissions, assign clipping work, run quality control, handle revisions, and deliver finished clips.
• To track package quota, issue invoices, record payments, and calculate and record editor payouts.
• To send transactional email, such as account approval notices, delivery notifications, revision updates, invoice notices, and payout notices.
• To keep reliable audit records for security, dispute resolution, accounting, and rights protection.
• To protect the platform against abuse, unauthorised access, and fraud, and to enforce our Terms and Acceptable Use Policy.
• To respond to enquiries and support requests, and to meet our legal obligations.

We use information for the purposes above because it is necessary to provide the Service under our contract with you, because we have a legitimate interest in operating and securing the platform and keeping proper records, and, where the law requires it, because we have a legal obligation to do so.

3. Where information lives

3.1 Supabase

Our database and authentication run on Supabase. Account data, organisation and show data, episode links and metadata, comments and revisions, billing records, and audit logs are stored in a Postgres database managed by Supabase, and login and session handling is provided by Supabase Auth.

3.2 Backblaze B2

Finished clip files are stored as objects in Backblaze B2, in private buckets that are not publicly accessible. Backup copies of those files are also held in Backblaze B2 under the same private-access model. Files are reached only through the platform, using time-limited signed URLs issued to an authorised account for a specific file.

3.3 Source footage is link-first

Source podcast footage is link-first and is not ingested by default. Clients normally submit a link to an episode hosted on their own platform or host, and we store the link and its metadata, not a permanent copy of the source episode. Temporary working access needed to produce a clip does not become a stored archive of your catalogue. If you send us a source file directly, it is treated as client content under the Terms and is handled under the retention rules below.

4. Retention

• Finished clips in primary storage. During the free-launch phase, finished clips in primary storage are deleted 30 days after delivery. Download and keep your own copies promptly after delivery; after that period the file may no longer be available from the dashboard.
• Backups. Backup copies of clip files are retained until they are removed by our storage policy pruning. A file deleted from primary storage may therefore persist in backups for a further period before it is pruned, and backups are used only for recovery, not for day-to-day access.
• Account, organisation, and show data. Kept while the account is active and for a reasonable period afterwards to resolve queries, then deleted or anonymised unless another rule in this Section requires us to keep it.
• Invoices, payments, and payout records. Retained for accounting, tax, and dispute purposes for as long as our accounting and legal obligations require, even after an account closes.
• Audit logs. Retained for security, accounting, and dispute purposes. Audit history is append-only by design, so entries are not edited or quietly removed.
• Comments, revisions, and episode metadata. Kept with the related episode and clip records while the account is active, and afterwards where they form part of the job, invoice, or audit record for completed work.
• Support communications. Kept for as long as needed to handle the matter and to keep a record of what was agreed.

Where retention periods change materially (for example, when the free-launch phase ends), we will update this policy and notify active account holders before the new periods apply to their stored files where it is practical to do so.

5. Who processes information for us

We use the following subprocessors to run the Service. Each of them processes information only to provide its part of the Service to us:

• Supabase — hosted Postgres database and authentication (Supabase Auth) for accounts, platform data, and records.
• Backblaze — object storage (Backblaze B2) for finished clip files and their backups, in private buckets.
• Cloudflare — network, DNS, and security services in front of the platform, which process technical request data such as IP addresses as traffic passes through.
• Brevo — transactional email delivery, for messages such as approvals, delivery and revision notices, invoices, and payout notifications.

Finished clips are also handled by the editors assigned to the job and reviewed by the client organisation that submitted the episode, as described in the Terms. Editors are bound by confidentiality and no-reuse obligations over client content.

We may disclose information if required by law or a valid legal process, to protect the rights and safety of any person, to investigate fraud or abuse, or in connection with a reorganisation or sale of the business operating the Service, in which case we will notify account holders where the law allows.

6. We do not sell personal data

We do not sell personal data, and we do not rent or trade it to advertisers or data brokers. We do not use client episodes, finished clips, or account data for advertising, and we do not run advertising or cross-site tracking cookies (see our Cookie Policy).

7. Cookies

The platform uses essential cookies only in the current version, covering sign-in sessions and your cookie-consent preference. Details, including what each cookie does and how to control cookies in your browser, are in our Cookie Policy.

8. Security practices

We protect information with measures matched to a production platform handling unreleased client content, including:

• Private storage. Clip files sit in private Backblaze B2 buckets with no public listing or public file access.
• Signed URLs. File access is given through time-limited signed URLs, issued only for the specific file and the authorised account, so links expire and files cannot be browsed.
• Role-based access. Access is separated by role (administrator, editor, creator) and by organisation and show, so an account sees only the records and files its role and membership allow.
• Controlled uploads. Clip uploads go to exact, server-authorised paths with overwrites disabled, and a file version becomes available only after its identity and integrity have been verified.
• Authentication and audit. Sign-in is handled by Supabase Auth, and significant actions are written to append-only audit records so access and changes can be reviewed.
• Backups and recovery. Clip files are backed up separately from the database, with delivery dependent on the final version being backed up, so a storage failure does not silently lose delivered work.

No system is perfectly secure. If you believe you have found a security issue, please report it to security@arafatarzu.me rather than testing it against other users’ data. Our security contact is also published in our security.txt.

9. Your rights

Depending on the law that applies to you, you may have rights to:

• ask what personal information we hold about you and receive a copy of it;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your personal information, subject to the records we must keep for accounting, audit, and legal reasons described in Section 4;
• object to, or ask us to restrict, some uses of your information;
• receive the information you gave us in a portable format, where that right applies; and
• withdraw consent where we rely on consent, without affecting earlier processing.

To use any of these rights, contact us at legal@arafatarzu.me or contact@arafatarzu.me from the email address on your account so we can verify the request. We will respond within the time required by the law that applies to your request, and we will explain if a record must be kept and why. You also have the right to complain to your local data protection authority.

Creators are responsible for the personal information of hosts, guests, and others that appears in episodes they submit, and for having a proper basis to share it with us for clipping, as warranted in the Terms.

10. International processing

Our subprocessors may store and process information in countries other than your own. Where they do, the processing takes place under their standard contractual and security terms for hosted services. By using the Service you understand that your information will be handled in those locations for the purposes described in this policy.

11. Children

The Service is a business tool for podcast creators and the editors who work with them. It is not directed at children, and accounts are for adults running or working on a show. If you believe a child has created an account, contact contact@arafatarzu.me and we will close it.

12. Changes to this policy

We may update this policy when the Service, our subprocessors, or our retention periods change. We will update the date at the top of this page, and we will notify active account holders of material changes by email or through the dashboard.

13. Contact

Privacy questions and rights requests: legal@arafatarzu.me.
General enquiries: contact@arafatarzu.me.
Security reports: security@arafatarzu.me.