Privacy Policy

1. Introduction

1.1. Who We Are. Prune Media Corp is a corporation incorporated under the laws of British Columbia, Canada, and is the organisation accountable for the personal information described in this Policy under Canada's Personal Information Protection and Electronic Documents Act and British Columbia's Personal Information Protection Act. Our privacy officer may be reached at comphero@dashmedia.so, which is the address for every request, question or complaint arising under this Policy.

1.2. Scope. This Policy applies to the CompHero desktop application, the website trycomphero.com and the application programming interface that the application communicates with. It does not apply to any Third-Party Service, including YouTube, Google, Stripe or any Destination to which you publish an Output, each of which handles information under its own terms and policies.

1.3. Relationship to the Terms. This Policy is incorporated into the Terms of Service by reference and forms part of them. The disclaimers and limitations of liability in sections 14 and 15 of the Terms of Service apply to this Policy and to any claim relating to our handling of personal information, to the fullest extent permitted by law. Nothing in this paragraph limits any right you have under privacy legislation that cannot lawfully be waived.

1.4. Your Agreement. By creating an account, installing the Service or using the Service, you agree to the collection, use and disclosure of personal information as described in this Policy. Where the law requires consent for a particular purpose, we will ask for it separately. Section 15 describes the legal bases on which we rely for users in the European Economic Area and the United Kingdom.

2. What Remains on Your Equipment

CompHero is software that runs on your own computer, and that is the most important fact about how it handles information. The following are created, stored and processed on your equipment, and are not transmitted to us, in whole or in part:

• Your video content. Retrieved footage, imported files and finished compilations exist only on your own storage. We do not host, upload, copy, stream, receive or retain them.
• Your file paths. Where a compilation is recorded, a file from your own storage is identified by its filename alone, such as my clip. The directory containing it is not transmitted.
• Your YouTube or Google password. Authentication with Google occurs in a browser on your own computer. There is nowhere in CompHero to enter that password and we do not receive it.
• Your YouTube session. Described in section 4. It is encrypted on your own equipment and is not transmitted to us.
• Your payment card details. Payment is completed on Stripe's own pages. We do not receive, hold or store a card number.
• Your projects and timelines. The clips you have selected, and how you have trimmed and arranged them, are files on your computer.

Because that material is held on your equipment, its security, integrity and backup are your responsibility, as set out in section 14 of the Terms of Service.

3. Information We Collect

3.1. Account Information. When you create an account we collect and hold:

• your email address, and the date on which you confirmed it. This is the only piece of information we ask you to provide. We do not ask for your name, postal address, telephone number, date of birth or channel;
• your password, stored as an argon2id digest. We cannot read it, and a copy of our database does not permit anyone to authenticate as you;
• your sign-in sessions. For each session: a hash of the session token, the times at which it was created, last used and expires, and the internet protocol address and the browser or application version from which it was created. This is what allows a session to be revoked and a device list to be shown;
• the channels and groups on your Research screen, if you add any while signed in: each channel's name, handle, picture and subscriber count as YouTube shows them, and the names you give your groups, so that the list is the same on every computer you sign in on. They are deleted with your account;
• email link tokens, stored as hashes, used to confirm your address and to reset your password; and
• the version of the Terms of Service and of this Policy you agreed to, and the time at which you agreed, so that a record of your agreement identifies the wording you were shown rather than the wording in force today.

3.2. Device and Licence Information. Each installation of the Service holds an identifier for the computer it is running on, generated at random and not derived from your hardware, so that it is not a fingerprint of the machine and deleting it simply produces another. Alongside it we hold the name your operating system reports for that computer, its platform and the application version. The name is collected so that a computer is identified legibly rather than by identifier alone, both in the device list on your account and to us; we are aware that the name a computer reports is often a person's own name. Where a subscription is activated on a computer we also hold the time at which it last verified its licence, and that computer appears in the device list on your account.

3.3. Compilations You Export. Each time the Service finishes writing a compilation, it transmits a record of that export to us. This happens whether or not you have an account, whether or not you subscribe, and there is no setting that disables it. It is how we know how the Service is actually used: how long an export takes on real equipment, where that time goes, how large the files are, and how many clips people put in a compilation. A successfully completed export transmits:

• the name you gave the compilation, the time of export, the duration of the finished file, how long the export took, the size of the file it produced, and the format it was written in: the video coding, the frame size and the frame rate;
• the identifier of the installation described in section 3.2, and your account where you were signed in at the time;
• the shape of the compilation: how many clips it held, where they were joined and with which kind of join, which of them you had trimmed, how many had to be rendered again in order to fit together, whether your graphics card or your processor did that work, and the names of the encoders that did it;
• for each YouTube clip: the video identifier, title, channel name, duration, view count and publication date, each of which is public information concerning a public video;
• for each clip taken from your own storage: a fingerprint computed from the contents of the file, and the filename alone, never the path. The fingerprint is what allows the same file, imported twice, to be counted as one video rather than two;
• for each position in the compilation, whichever kind of clip stood in it: the format it arrived in, being the video coding, frame size and frame rate; its full length and how much of it you used; whether it had to be rendered again; which encoder did that and how long it took; and how long that clip had taken to download; and
• how long each step of the export took and in what order, and which clip a step concerned where it concerned one.

The last two are why the record exists at all. One number for a whole export tells us it was slow and cannot tell us why: an hour spent on a single clip is a different problem from an hour spread across all of them, and the same compilation can take a minute or an hour depending on work that had already been done before you pressed the button. The download figure is measured when the clip is downloaded rather than at export, counts only the time bytes were actually moving, and is reported here because this is the record that says what each clip cost.

Nothing is transmitted until an export has completed successfully. A compilation you abandoned was never recorded, and nothing about the file itself is transmitted: we receive the description above and never any part of the video, its audio or its images. Nothing in this record is used to decide anything about you.

3.3a. Compilation History. Subscribers can see a history of the videos they have already used, so that a clip is not repeated across compilations. That history is a selection of the record described in section 3.3, made by you: each compilation carries a box on the finished panel, and the application's settings choose whether that box starts ticked. Adding a compilation to your history, or removing one from it, adds or removes it from what the Service shows you, and does not add to or remove anything from the record described in section 3.3. Section 9.3 states how long that record is kept and section 10.3 describes how to ask us to delete it.

3.4. Diagnostic Reports. Where something in the Service fails, for example a download, an export, a channel listing or an update, or where the application closes unexpectedly, stops responding or shows you an error message, the Service transmits a short report so that we can identify and fix what is failing. Each report contains the category of failure, a short description of the error, how many times it happened, the install identifier, the application and downloader versions, your platform, such as win32-x64, and, where you are signed in, your account, so that when you contact us about a problem we can see what went wrong. Before a description is transmitted, video identifiers, web addresses, email addresses, file paths and the titles of videos and files are removed from it, and it is shortened to its first line and to 300 characters. Reports of the same failure are counted together rather than sent one by one. A report that cannot be sent straight away, because you are offline or the application closed, is kept on your computer and sent the next time it can be. Reports contain nothing identifying the videos you were working with. There is currently no setting that disables diagnostic reports. They are how software that depends on a third party platform is maintained at all, and they constitute Usage Data as that term is defined in section 5.4 of the Terms of Service.

3.4a. Checking for Notices. The application asks us whether there is a notice it should show you, when it starts and once an hour while it is running, and section 3.11 describes those notices. That request carries the install identifier described in section 3.2, your platform and the application version, and it is made whether or not you have an account. We record, for each installation, the first and most recent time we heard from it, along with that platform and version, and the internet protocol address the most recent of those requests reached us from. Only the latest address is kept, replaced each time we hear from that installation, and never a trail of them. This is how we know how many copies of the Service are in use and which versions they are running, which we cannot otherwise know, because the Service can be used without an account. It is a count and not a history: we do not record the individual requests, what you were doing, or anything about your compilations, and nothing in this record is used to decide anything about you. It is also what allows a notice to be sent to one installation, which is how we can tell a single person that something is broken without messaging everybody. Section 9.3 states how long this is kept, and an installation we have not heard from for a year is deleted.

3.4b. While the Application is Running. Every sixty (60) seconds while the application is open, and again when you move between its screens or sign in or out, it tells us that it is running. That message carries the identifier and computer name described in section 3.2, your platform, the application version, whether anyone is signed in, and which of the application's screens is in front of you, which is one of a short fixed list: the projects list, choosing clips, trimming, exporting, the compilation history, or research. Of the message itself we keep only the most recent, never a history of them: what we hold is the last time we heard from an installation and what it was doing then, which is replaced each time it speaks to us. It is how we can see how many people are using the Service at a given moment and which parts of it they spend their time in, which is what tells us where to make it better. Separately, and from the same message, we count for each installation which minutes of which hours it was open, and keep that count for ninety (90) days, so that we can see how much the Service is actually used rather than only when it was last started. That count holds no screen, no computer name and no address: it records that a copy was running in a given minute, and nothing about what it was doing. The same message also says how far the application has been used, as a short fixed list: whether a project has been created, a video added to one, a clip downloaded, the trimming and export screens opened, and an export started and finished, and whether the research screen has been used or a YouTube account connected, each with the date it first happened. It also says how many downloads and exports have finished, failed or been cancelled. We keep the date each step was first reached for as long as we keep the installation's record, and the counts only as the latest figures. It is how we find out where people run into trouble on the way to their first compilation. Neither the message nor the count records anything about the content of your compilations, your videos, your files or anything you type, nothing in either is used to decide anything about you, and there is no setting that disables them.

3.5. Billing Information. We collect and hold your Stripe customer identifier, and the status, price, current period end and cancellation state of your subscription. That record is a mirror of what Stripe reports to us, held so that your subscription continues to function if Stripe is briefly unreachable. We also hold the identifiers of the Stripe events we have processed, so that a payment is not counted twice. Everything else concerning your payment, including your card, your billing address and your invoices, is held by Stripe. We provide Stripe with your email address so that it can issue receipts and so that your subscription can be matched to your account.

3.6. Website Information. When you select a download button on trycomphero.com we record the platform selected, the installer file, the user agent string reported by your browser, and a referral tag where the link carried one. We do not store your internet protocol address for that record. Our web server retains ordinary access logs, which include internet protocol addresses, as any web server does, and those logs are used for security and for diagnosing faults.

3.6a. Visits to the Website. We count visits to trycomphero.com ourselves, on our own server. For each page you open we record which page it was, when, how long the page was in front of you, whether you selected one of a small number of marked items such as a download button or the price, the general kind of device and family of browser you are using, the website that linked you to us where there was one, any campaign or referral tag in the address, the country you are in, and the identifier of the cookie described in section 6.1a where you have one. We also record the internet protocol address the request reached us from, and we keep it. We use it for two things and nothing else: to tell whether a burst of traffic is one machine or many different people, and to recognise, where somebody writes to us about their account, that they are the person who has been reading a page. The country is worked out from that address by a list held on our own server, so no part of that involves anybody else, and the country remains the finest location we hold: never a region, a city or a coordinate. Section 3.6b describes how to refuse, and a browser that refuses is given no cookie, is recorded as no visitor, and has no address stored against anything it did. We do not record what you type, we do not record your mouse movements or scrolling, and no third party receives any of it. There is no advertising, no tracking pixel, no session recording and no fingerprinting, the website loads no third party resources, and nothing here is sold or shared. Section 6.1a describes the cookie and how to refuse it, section 9.3 states how long this is kept, and section 3.6b describes what happens if you refuse.

3.6b. If You Refuse to Be Counted. Where your browser sends a Global Privacy Control signal, we honour it as a refusal. You are then given no cookie, nothing is stored on your device by us, no record of you as a visitor is created, and no internet protocol address is stored against anything you did. The page view itself is still counted, with nothing attached to it and no way for us to connect it to any other, so we can still see how many people read a page without holding anything about you. That signal is the one we act on: blocking or deleting cookies stops us recognising you as a returning visitor, and does not by itself stop the address of a request being recorded.

3.7. Correspondence and Administrative Records. Where you contact us, we hold your message and our reply, together with the address you sent it from and anything you choose to include in it. Where we act on an account ourselves, for example to issue a refund, adjust a device limit or delete an account on request, we record what was done, to which account, at what time, and from which internet protocol address, so that there is a reliable record of any change made by a person.

3.7a. Refund Records. Where a payment is refunded, or reversed by your bank, we record that it happened, the amount, the date and the account concerned. Alongside it we record a small number of identifiers by which the same person could be recognised on a later account: the email address the refund was issued to, an identifier Stripe provides for the payment card used (which is not a card number and cannot be used to make a payment), the installation identifiers of the copies of the application signed in to the account, and the browser identifier described in section 3.6. This record is kept even where the account is afterwards deleted, and it is the only category of information we retain after deletion. We keep it because the refund described in section 4.5 of the Terms of Service is available once per person and is issued automatically, and without it that limit could be avoided by deleting an account and creating another. It is used for that purpose and for handling payment disputes, and for nothing else: it is never used to advertise to you, and it is not combined with your compilation records. Section 8 describes how to ask what we hold about you.

3.8. Rights Acknowledgements. The Service asks you to confirm, when you first run it and when you create an account, that you own the content you use or hold the rights to it, and it displays notices reminding you of that while you work. The confirmation you give with your agreement to these documents is recorded as part of that agreement, as described in section 3.1. The reminders shown elsewhere in the application are reminders only: nothing is recorded when one is displayed or passed, and we do not record which video, file or channel any of them concerned. Section 1.11 of the Terms of Service describes the effect of proceeding past such a notice.

3.9. Other Categories. We do not currently collect categories of personal information other than those described in this section 3. Where we begin to collect a new category, we will update this Policy to describe it, and where the law requires consent for that collection we will obtain that consent. Section 14 describes how changes to this Policy are notified.

3.10. Information You Should Not Send Us. Please do not send us personal information that we have not asked for. In particular, do not send us information about other people, government identification, financial account details, health information or any other sensitive information. Where we receive information we do not require, we may delete it, and we are not responsible for information you disclose to us without being asked.

3.11. Notices Shown in the Service. The Service displays notices from us, and some of them ask you to agree to something, for example a changed version of these documents. Where you are shown one, we record which notice it was, the exact wording you were shown, the identifier of your installation, your account if you were signed in at the time, the version of the Service, the internet protocol address the answer reached us from, and whether and when you agreed. The same is recorded when you agree to these documents on creating an account, and when you agree to them the first time you run the Service. We record this because an agreement is only meaningful if the wording it was given to can be identified afterwards, which is also why the wording is never edited in place, and why the address is recorded: it is knowable only at the moment you answer. It is never used to decide anything about you and is not used to work out where you are. We do not record anything about what you were doing when a notice was shown, and this is separate from the reminders described in section 3.8, which are not recorded at all. Section 9.3 states how long these records are kept.

4. Your YouTube Sign-In

4.1. How It Works. Authenticating with YouTube is what prevents YouTube from throttling downloads, so the Service offers it, and it is optional. You sign in to Google yourself, in a browser window on your own computer, and you sign in to Google rather than to us: your password is never given to the Service and we never see it. The Service does not read the cookies, saved passwords, browsing history or other data of any browser you use yourself. What the Service keeps is the resulting YouTube session cookies, held encrypted on your own equipment using the facilities of your operating system (Keychain on macOS, the Data Protection API on Windows). It also stores locally the display name, email address and avatar of the Google account, so that the application can indicate which account is connected.

4.2. None of It Is Transmitted to Us. The cookies, the email address, the name and the avatar are not sent to us and we do not hold them. They exist only on your computer. A readable copy of the cookies is written to your own storage for the duration of a single download and is deleted immediately afterwards, because the downloader is a separate program that requires a file to read. You may disconnect the account within the application at any time, which deletes all of it from your machine.

4.3. Your Traffic Goes to YouTube Directly. When you use the Service, your computer communicates with YouTube directly. YouTube observes that traffic and applies Google's own privacy policy to it. We are not an intermediary in that communication, we cannot observe it, and we are not responsible for it. Your use of a YouTube account with the Service is subject to YouTube's terms, and sections 6.4 and 6.5 of the Terms of Service address that relationship, including what we are and are not responsible for if YouTube acts against an account you connect.

5. Purposes

5.1. Purposes. We collect, use and disclose personal information for the following purposes and no others:

• to provide the Service, including an account to authenticate against, a licence verification so that the application knows it is paid for, and the compilation history described in section 3.3a;
• to take payment through Stripe and to determine whether a subscription is current;
• to enforce the device limit that accompanies a subscription, which is why install identifiers are recorded;
• to secure accounts, and to detect, investigate and prevent abuse, fraud, unauthorised access and breaches of the Terms of Service, which is why sessions, installations and visits to the website record an internet protocol address and why failed authentication is rate limited;
• to administer refunds and payment disputes, and to apply the once-per-person limit on the refund described in section 4.5 of the Terms of Service, through the records described in section 3.7a;
• to maintain, diagnose, correct and improve the Service, through diagnostic reports, server logs, the record of exports described in section 3.3, the messages described in section 3.4b and other Usage Data;
• to understand how the website is used and how people arrive at it, through the visit records described in section 3.6a, so that the pages can be written better and so that a referral or promotional link applies the discount it offered;
• to keep a record of the acknowledgements described in section 3.8;
• to correspond with you, and to send the transactional messages the account itself requires;
• to establish, exercise or defend legal claims, and to comply with our legal, regulatory and tax obligations.

5.2. Consent and Necessity. In Canada we rely on your consent, given when you agree to this Policy and when you use the Service, together with the necessity of the information for the Service you have requested. You may withdraw your consent as described in section 10, subject to legal and contractual restrictions and to reasonable notice, and you acknowledge that withdrawing consent to information necessary to provide the Service means we can no longer provide it to you. Section 15 sets out the position for users in the European Economic Area and the United Kingdom.

5.3. What We Do Not Do. We do not sell your personal information. We do not rent or trade it, we do not disclose it for the advertising purposes of any other party, we do not use it to build an advertising profile of you, and we do not send marketing email. The only messages we send are those described in section 7.

5.4. De-Identified and Aggregated Information. We may create de-identified or aggregated information from the information described in this Policy, and may retain and use that information without restriction, including to operate, analyse and improve the Service, provided that it does not identify you and we do not attempt to re-identify you from it.

6. Cookies and Local Storage

6.1. Cookies. The website uses three cookies. Two keep you signed in and are strictly necessary for a service you have requested. The third is described in section 6.1a. There are no advertising cookies and no third party cookies of any kind:

• comphero_web holds your session. It is httpOnly, so that no script can read it, is transmitted only over HTTPS, is restricted to trycomphero.com, and expires ninety days after its last use.
• comphero_signed_in holds the single character 1, so that the website's navigation can offer "Account" rather than "Sign in". It is not a secret and contains nothing about you.
• comphero_v holds a random identifier and nothing else, described in section 6.1a.

6.1a. The Visitor Cookie. comphero_v is a first party cookie set by our own server. It contains a random identifier and nothing else: no address, no account, nothing derived from your device. It is httpOnly, so no page and no script can read it, is transmitted only over HTTPS, is restricted to trycomphero.com, is never sent to anybody else, and expires twelve months after it is set. It does two things. It lets us tell a returning visitor from a new one, so the visit counts described in section 3.6a mean what they say. And where you arrived through a referral or promotional link, it is what remembers that link, so the discount it offered is still applied when you come back and subscribe. The second of those is functional, in the way a coupon held in a basket is functional. The first is analytics, and we do not claim otherwise. We do not show a consent banner. Instead we honour Global Privacy Control as a refusal, as described in section 3.6b, and we honour it completely: a browser that sends it is given no cookie, is recorded as no visitor, and has no address kept against it. The counting continues to work without you, and refusing costs you nothing except an automatically applied discount, which you can still enter by hand at checkout.

6.2. Local Storage. Your account page records, in your browser's local storage, the width to which you dragged the divider between the two panes. That is a number, it remains in your browser, and it is not transmitted.

6.3. Your Controls. You may block or delete cookies through your browser. Blocking the session cookie will prevent you from signing in to your account on the website. Blocking or deleting comphero_v stops us recognising you as a returning visitor and stops any referral discount being applied for you automatically. Turning on Global Privacy Control does all of that and more: as section 3.6b describes, no visitor record is created and no internet protocol address is kept. Nothing else about the website changes.

7. Service Providers and Other Disclosures

7.1. Service Providers. We engage a small number of service providers, each of which receives the least information required to perform its function:

• Stripe processes payments and holds your billing details. It receives your email address and an identifier for your account.
• Resend transmits our transactional email. It receives your email address and the message. These messages are confirmation of your address when you sign up, a password reset where you request one, and a reminder before each subscription renewal.
• DigitalOcean provides the server on which our database is hosted.

7.2. Other Disclosures. Apart from those providers, we disclose personal information only: where required or permitted by applicable law; in response to a subpoena, warrant, court order or other lawful request, including where we are prohibited from notifying you of it; where necessary to establish, exercise or defend legal claims, to collect a debt, or to enforce the Terms of Service; where necessary to protect the rights, property or safety of any person; to our professional advisers under a duty of confidentiality; and in connection with a merger, financing, reorganisation, or sale of all or part of our business or assets, in which case the recipient will be bound by commitments no less protective than this Policy and we will give notice of the transfer. No person acquires, licenses or receives your personal information for their own marketing purposes.

8. Storage Outside Canada

8.1. Where Information Is Held. Our database is held on a single server that we operate, hosted by DigitalOcean. Stripe and Resend are United States companies and process information on infrastructure located there.

8.2. Consequences of Storage Abroad. Personal information about you may therefore be stored or processed outside Canada, including in the United States, and while it is there it may be accessible to the courts, law enforcement agencies and national security authorities of that jurisdiction under the laws of that jurisdiction, whether or not you are notified. We state this because British Columbia's privacy legislation requires that you be told, and by using the Service you consent to that storage and processing.

9. Retention

9.1. How Long We Keep It. We retain personal information for as long as is necessary to fulfil the purposes set out in section 5, and after that for as long as is necessary to establish, exercise or defend legal claims, to resolve a payment dispute, and to comply with our legal, accounting and tax obligations. In practice this means your account information, device list and compilation history are retained for as long as your account remains open, and for a reasonable period afterwards. The compilation history is deliberately long lived: a record of what you used two years ago is the purpose of the feature.

9.1a. The Record of Your Exports. The record described in section 3.3 is retained indefinitely, and is not deleted when an account is closed. It is how we understand how the Service is used over time: what a compilation looked like a year ago, and whether exports are getting faster or slower on the equipment people really run. Closing your account removes the compilation history described in section 3.3a, which is the part you can see, and leaves this record standing. Where you ask us to delete it, we will delete it, and section 10.3 is how to ask.

9.2. Fixed Periods. Sessions expire ninety days after their last use. A password reset link is valid for one hour and an address confirmation link for two days.

9.3. Records Not Tied to an Account. Diagnostic reports and server access logs are retained for no more than twelve (12) months and are then deleted. The record of an installation described in sections 3.4a and 3.4b, including the computer's name and the screen it was last on, is deleted where we have not heard from that installation for twelve (12) months, and the count of the minutes an installation was open, also described in section 3.4b, is retained for ninety (90) days. Download records from the website are retained for no more than twenty-four (24) months and are then deleted. The records of visits to the website described in section 3.6a, including the internet protocol address, are retained indefinitely, because their purpose is to show how interest in the Service changes over years rather than weeks. They hold no name, the country described in section 3.6a is the only location worked out from them, they are never sold or shared and no third party receives them, and nothing in them is used to decide anything about you. A browser sending Global Privacy Control has no such record and no address kept at all, as section 3.6b describes; where you would rather we did not hold what we already have, section 10.3 is how to ask us to delete it; and where such a record has become connected to an account, closing that account disconnects it. Administrative records of actions taken on an account by a person are retained for seven (7) years, because they are the record of what was done on an account and on what basis. The refund records described in section 3.7a are retained for seven (7) years for the same reason, and are retained for that period whether or not the account still exists, because a limit that applies once per person cannot be enforced by a record that disappears with the account. Of the records described in section 3.11, one showing that you closed a notice without agreeing to it is retained for no more than twelve (12) months, and one showing that you agreed to something is retained for seven (7) years, for the same reason as an administrative record. Diagnostic reports and download records are not associated with an account or an email address.

9.4. After Your Account Closes. Where you ask us to delete your account, or where we terminate it, we delete or de-identify the account information, device list and compilation history associated with it within ninety (90) days, except for the record described in section 9.1a, except for the refund records described in section 3.7a where any payment to that account was refunded or reversed, and except where we are required to retain something for the purposes described in section 9.1, in which case we retain only what is required and for no longer than is required.

9.5. Deletion. Where information is no longer required for the purposes described in this Policy, we delete it or de-identify it. Where you ask us to delete it sooner, section 10 describes how. Deletion takes effect in our live systems when we act on it. We also keep nightly snapshots of our database so that it can be restored after a failure, each of which holds whatever the database held that night. The oldest snapshot is discarded once there are fourteen (14) of them, so information we have deleted survives in a snapshot for no more than fourteen days, is never returned to live use in the ordinary course, and would only reappear if we had to restore from a copy taken before we deleted it.

10. Your Rights and Choices

10.1. Your Rights. Under Canadian and British Columbia privacy legislation you have the right to ask what personal information we hold about you and how it has been used and disclosed, to ask that it be corrected, to withdraw your consent, and to ask that it be deleted, in each case subject to the exceptions those statutes provide. Section 15 sets out additional rights for users in the European Economic Area and the United Kingdom, and section 16 for residents of California.

10.2. Controls in the Product. Without contacting us at all, you may: choose in the application's settings whether a finished compilation is added to your history by default; add or remove any individual compilation from that history; sign a computer out from your account page, which also releases its licence slot; and change your password from your account page, which ends every other session.

10.3. Requests to Us. To request a copy of the personal information we hold about you, a correction to it, or its deletion, including deletion of your account and the information attached to it, email comphero@dashmedia.so from the address registered to the account. There is at present no self-service deletion control, so this is the route, and we will confirm when it has been carried out. We may require verification that you are the account holder before acting on a request. We will respond within thirty (30) days and will not charge you for a reasonable request. Where an exception in the applicable statute permits or requires us to withhold information, or where we must retain information for the purposes described in section 9, we will say so and identify the basis.

10.4. Complaints. If you are dissatisfied with how we have handled your personal information, please tell us first so that we have the opportunity to resolve it. You may also complain to the Office of the Information and Privacy Commissioner for British Columbia or to the Office of the Privacy Commissioner of Canada. If you are in the European Economic Area or the United Kingdom, you may complain to your local supervisory authority.

11. Security

11.1. Measures We Take. We maintain safeguards appropriate to the sensitivity of the information we hold:

• traffic between you and us travels over HTTPS, and our own services communicate over a private loopback interface rather than over the network;
• passwords are stored as argon2id digests, and session tokens and email link tokens are stored as SHA-256 hashes of the value you hold. Nothing reversible is stored, so a copy of our database does not permit anyone to authenticate as you;
• your YouTube session is encrypted on your own equipment using the facilities of your operating system, as described in section 4;
• authentication attempts are rate limited and sessions expire; and
• access to the server and to the database is restricted to those personnel who require it.

11.2. No Guarantee. No method of transmission or storage is completely secure, and we do not warrant or guarantee that personal information will not be accessed, disclosed, altered or destroyed by a breach of any of our safeguards. Section 14 of the Terms of Service applies to this Policy.

11.3. Your Responsibilities. You are responsible for keeping your password confidential, for the security of the equipment on which the Service is installed and on which your video content resides, and for notifying us promptly at comphero@dashmedia.so of any unauthorised use of your account. We are not responsible for unauthorised access resulting from your failure to do so.

11.4. Breach Notification. Where a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the relevant regulator as required by applicable law, and will keep the records of it that the law requires.

12. Children

The Service is intended for adults. As set out in section 2 of the Terms of Service, you must be at least 18 years of age, or the age of majority in your jurisdiction if that is higher, to use the Service or hold an account. We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, email comphero@dashmedia.so and we will delete it.

13. Third-Party Services and Links

The Service interoperates with, and this website links to, services that we do not control, including YouTube, Google, Stripe and any Destination to which you publish an Output. Their collection and use of information is governed by their own policies, not by this one. We make no representation or warranty concerning any Third-Party Service, and we are not responsible or liable for its practices, its content or any information you provide to it. Section 6 of the Terms of Service addresses Third-Party Services generally.

14. Changes to this Policy

We may amend this Policy from time to time. Where we do, we will revise the date at the head of this page and maintain the current version here. Where a change is material, for example where we begin to collect a category of information not described in section 3 or engage a new service provider, we will give notice in the Service, and we may ask you to agree to the amended Policy before you continue to use it. Where a change is not material, for example a correction, a clarification or a change to formatting or contact details, the revised date is the notice and we will not necessarily display anything in the Service. We will not use personal information we already hold for a materially different purpose without your consent where the law requires it. Your continued use of the Service after an amendment takes effect constitutes your acceptance of the amended Policy.

15. European Economic Area and United Kingdom

15.1. Controller. Where the General Data Protection Regulation or the UK GDPR applies to our processing, Prune Media Corp is the controller of the personal data described in this Policy, and may be contacted at comphero@dashmedia.so, which is the email address in section 18.

15.2. Legal Bases. We process personal data on the following bases:

• Performance of a contract (Article 6(1)(b)), for your account, authentication, licence and device verification, the compilation history described in section 3.3a, taking payment, and the transactional messages the account requires. This is the basis for most of what we do, because it is what you asked us to provide.
• Legitimate interests (Article 6(1)(f)), for securing accounts, preventing and investigating fraud and abuse, diagnostic reports and server logs, the record of exports described in section 3.3, the messages and count described in section 3.4b, the records of visits described in section 3.6a, the refund records described in section 3.7a, and maintaining and improving the Service. Our interests are in operating a secure and functioning product; we have considered your interests and rights and consider this processing proportionate given the limited information involved and the safeguards described in section 3.4. For the records described in section 3.6a in particular, a browser sending Global Privacy Control is not recorded at all, which is a refusal honoured before anything is written rather than a preference recorded afterwards. You may object under section 15.3, and section 10.3 is how to ask us to erase what we hold. For the records described in section 3.7a, our interest is in offering a refund that anyone can take immediately without asking a person for it, which is only possible if a limit of one per person can be applied. They are read only when a refund or a dispute arises, they are never used to decide anything else about you, and they hold no card number. You may object under section 15.3.
• Legal obligation (Article 6(1)(c)), for accounting, tax and regulatory records, and for responding to lawful requests.
• Consent (Article 6(1)(a)), only where we ask for it separately for a specific purpose. You may withdraw that consent at any time without affecting processing carried out before withdrawal.

15.3. Your Rights. Subject to the conditions and exceptions in the applicable Regulation, you have the right to request access to your personal data; to have inaccurate data rectified; to have data erased; to restrict processing; to data portability; and to object to processing carried out on the basis of legitimate interests, including at any time. To exercise any of these, email comphero@dashmedia.so. We respond within one month, extendable by two further months where a request is complex, in which case we will tell you within the first month. We do not carry out automated decision-making producing legal or similarly significant effects.

15.4. International Transfers. Personal data is transferred outside the European Economic Area and the United Kingdom, as described in section 8. Canada has an adequacy decision from the European Commission in respect of commercial organisations subject to PIPEDA. Transfers to our processors in the United States are made under the Standard Contractual Clauses adopted by the European Commission, together with the UK International Data Transfer Addendum where the UK GDPR applies. You may request a copy of the relevant safeguards at the address above.

15.5. Complaints. You have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the place of an alleged infringement, or with the Information Commissioner's Office in the United Kingdom.

16. California Residents

The categories of personal information we collect, the purposes for which we collect them, the categories of recipients and our retention periods are described in sections 3, 5, 7 and 9 of this Policy. In the preceding twelve months we have disclosed personal information to the service providers listed in section 7.1 for the business purposes described there.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

Subject to verification and to the exceptions the law provides, you may request to know what personal information we have collected, to delete it, and to correct it, and you have the right not to receive discriminatory treatment for exercising these rights. Requests may be made at comphero@dashmedia.so and are handled as described in section 10.3. An authorised agent may submit a request on your behalf with proof of authorisation.

17. Automated Decisions and Profiling

We do not use your personal information to make automated decisions about you that produce legal or similarly significant effects, and we do not profile you. Rate limiting and device limits operate on technical identifiers and thresholds described in this Policy and do not evaluate you as a person.

18. Contact

Prune Media Corp, British Columbia, Canada
comphero@dashmedia.so

That address reaches our privacy officer and is the correct one for a privacy question, a request for a copy of your information, a correction or a deletion request. Our Terms of Service govern the remainder of the relationship, including billing, refunds and liability.