DRAFT — not legal advice, requires user/legal review before publish.
This policy is a proposed description of the Cliphand service at https://cliphand.nuxec.com, pending an actual data-flow and vendor review. The static landing drafts do not submit forms, take payments, upload footage, set analytics cookies or send ad-measurement events. They contain no external scripts, fonts, images or video requests. Opening an external link is subject to that site's practices; any hosting service used for a future deployment may create access logs. Do not represent planned practices below as verified production controls.
1. Who is responsible and how to contact us
Cliphand by NUXEC is the service name. The legal entity responsible for personal information is Aurora PowerUp LLC. Business address: [TBD]. Privacy/support email or other contact: [TBD]. Privacy owner/legal reviewer: [TBD]. Any required representative or data protection officer: [TBD].
This policy covers visitors, prospective customers, customers and people whose information appears in submitted production materials. Where we process personal data solely on a business customer's instructions, controller/processor roles and any required data-processing agreement must be recorded before processing: [TBD]. We do not claim a completed legal-role assessment in this draft.
2. Information used for the service
| Category | Examples and source | Why it is needed |
|---|---|---|
| Eligibility and order details | Customer-provided product URLs, exact product/variant, proposed footage source, rights evidence, business name, selected pack and intended channels | Assess footage eligibility, permissions and feasible claims before requesting payment |
| Contact information | Name, business email and other contact information you choose to supply | Clarifications, approval requests, delivery, revision and refund support |
| Production materials | Scripts, briefs, footage, audio, images, brand assets, product documentation, claim evidence and finished videos | Prepare and revise the agreed videos; materials may incidentally identify people |
| Approval and support records | Version identifiers, approval timestamps, written decisions, timestamped revision notes and correspondence | Establish the approved brief/footage, start the delivery clock and resolve issues |
| Transaction records | Stripe transaction/order identifiers, payment status, amount, currency, billing/tax details and refund records made available to us | Reconcile payment, provide receipts, issue refunds and meet applicable accounting duties |
| Technical and consent data, if deployed | Host access logs such as IP address, browser/device information, referrer, request time, security events and consent choices | Operate and secure a future website; exact fields and retention must be confirmed |
| Optional measurement data, only if enabled lawfully | Campaign/referral tags, page interactions, order-conversion events and associated online identifiers | Understand campaign performance under the consent/opt-out rules described below |
Only share necessary material. Do not put passwords, payment card details, sensitive personal information, private customer lists or unrelated third-party information in product URLs or uploaded footage. URLs can themselves contain identifiers or access tokens. Remove unnecessary personal details and provide consent/rights information for identifiable people when relevant. Purchasing a physical product does not establish permission to use someone else's footage or likeness.
3. Payment through Stripe
The planned payment method is Stripe-hosted Checkout, offered only after we confirm footage eligibility, usable rights and feasible claims. Stripe collects and processes the payment information on its hosted page. Cliphand does not hold full payment card numbers or card security codes. We use only the transaction and billing information needed to administer the order, tax and refunds.
Stripe's role and practices are described in its Privacy Policy. Stripe may act in different legal capacities for different payment and fraud-prevention activities; the applicable setup must be reviewed. Merchant/account configuration, enabled payment methods and exact returned data fields are [TBD]. No live Checkout is connected to these landing drafts.
4. Purposes and legal bases
We propose to use necessary information to assess a request; create and administer a paid order; record brief and footage approvals; produce and deliver the videos; handle up to five revision rounds; assess the approved-brief guarantee; and communicate about delivery, support and refunds. We also need appropriate records for security, fraud prevention, legal compliance, accounting and disputes.
Where relevant law requires a legal basis, these activities may rely on steps requested before entering a contract and performance of that contract, compliance with legal obligations, or legitimate interests such as securing the service and maintaining reliable order records, after the required balancing assessment. Marketing and non-essential tracking require consent where applicable; local opt-out rights also apply. The actual lawful-basis and market assessment is [TBD] and must be completed before launch.
We do not turn an eligibility request into permission for promotional email. Any marketing programme must have a lawful basis, clear choices and a working opt-out before it begins. Transactional messages remain separate from optional marketing. There is no automated eligibility decision or profiling system implemented in these static drafts.
5. Service providers and recipients
The future service may share only the necessary information with people and providers performing the following roles. Except for the selected payment method, this is a category inventory to confirm, not a claim that a vendor contract or integration exists.
| Role | Possible information involved | Implementation status |
|---|---|---|
| Payment processing — Stripe | Payment, billing, fraud-prevention and transaction information | Selected provider; account, configuration and contractual role [TBD] |
| Website hosting and delivery | Website requests, IP addresses and technical logs | Exact provider, regions and log controls [TBD] |
| File storage and secure delivery | Approved footage, production materials, video exports and access metadata | Exact provider, locations, access controls and deletion handling [TBD] |
| AI generation providers | Only necessary script text, presenter directions and production assets, which may contain personal data | Exact providers, subcontractors, retention, training settings and transfer safeguards [TBD] |
| Email, support and order tools | Contact details, correspondence, order and approval records | Exact providers, access and retention settings [TBD] |
| Authorized production staff or contractors | Relevant briefs, approved assets, revisions and deliverables | Roles, confidentiality obligations and access scope [TBD] |
| Optional analytics or advertising measurement | Consent-permitted events and identifiers | Whether enabled, exact providers, fields and settings [TBD] |
We may disclose information where required by law or reasonably necessary to establish legal claims, prevent fraud or protect rights, with the safeguards required by applicable law. Any business transfer involving personal data requires appropriate notice and protections. We do not authorize public disclosure of private customer assets merely because you ordered a video.
6. AI processing, confidentiality and portfolio permission
The service uses an AI presenter with real exact-product footage. We send only material necessary for the agreed production task to approved providers. We do not gain an automatic right to use customer materials for model training, unrelated product development, public examples or marketing. A production approval is not training consent or permission to publish your brand in our portfolio.
Provider-side training defaults, opt-outs, retention, human review, deletion limits and whether identifiable footage needs to leave our editing environment are [TBD]. Confirm these before selecting a provider or uploading customer data. This draft does not assert that every provider disables training or deletes data immediately. Any proposed use outside fulfilment needs a separate lawful basis and appropriate notice or permission before it occurs.
Customer work appears in the public portfolio only with separate explicit permission describing the material and permitted use. The planned DIY Life and self-initiated portfolio demos are labelled accordingly and must not be represented as client work. AI disclosure inside a finished video does not remove privacy, likeness or advertising obligations.
7. Cookies, analytics and advertising measurement
The delivered HTML drafts contain no tracking integration, analytics beacon, advertising pixel, external media embed, local-storage order capture or functioning submission endpoint. The gallery filters and placeholder viewer run locally in the page.
Before any production tracking is enabled, document the technologies, recipients, purposes, data fields, cookie/storage lifetimes and choice mechanism: [TBD]. Essential hosting/security processing must be distinguished from optional analytics and ad measurement. Where consent is required, non-essential storage, tracking and related third-party requests must wait for valid consent. Rejecting should be as accessible as accepting, and withdrawal must be available. Where applicable, provide opt-out of targeted advertising/sale/sharing and honour legally required preference signals. Server-side measurement does not bypass these duties.
Do not send raw footage, scripts, private product URLs, email addresses or payment-card information as advertising event payloads. Minimize event data and use a separate assessment for any identifiers. We have not verified a future sale/sharing or targeted-advertising classification; that assessment and any required notice/opt-out route are [TBD]. This policy cannot promise that advertising measurement is anonymous simply because a provider hashes an identifier.
8. Retention and deletion
Keep information only as long as needed for the disclosed purpose, applicable legal obligations and legitimate disputes. Set and disclose actual periods or meaningful criteria before launch; do not assume indefinite storage.
| Record | Proposed retention criterion | Duration/owner to confirm |
|---|---|---|
| Unpaid eligibility requests | Resolve the enquiry, then delete or de-identify if there is no continuing purpose | [TBD] |
| Raw footage, scripts and working files | Fulfil production and included revisions, then follow the agreed deletion schedule | [TBD] |
| Finished videos and delivery links | Support the agreed delivery/download period; no indefinite hosting promise | [TBD] |
| Approved briefs, permissions and revision/support records | Evidence the order, licence and guarantee; retain only what is needed for applicable claims | [TBD] |
| Payment, tax and refund records | Meet the accounting and legal duties applicable to the actual entity/markets | [TBD] |
| Security logs and consent choices | Support security investigations and demonstrate applicable consent choices | [TBD] |
| Backups and provider-held copies | Limited recovery cycle and provider deletion terms, with restricted use pending expiry | [TBD] |
Deletion requests may be limited where records must be retained by law or for legitimate claims; explain the basis and scope. Provider backups and legal holds can affect timing and must be accounted for. A refund does not automatically require deletion of legally required transaction records. Download your deliverables within the confirmed access period.
9. International transfers
The operating entity, hosting regions, production access locations and provider processing countries are [TBD]. We may need to process information outside your country. Before doing so, identify the actual transfers, applicable restrictions and appropriate safeguards, such as an applicable adequacy decision or legally recognized contractual arrangements and any required transfer assessment. Do not claim that standard clauses or another safeguard are in place until verified. Contact [TBD] for the applicable transfer information once confirmed.
10. Security
We propose proportionate access controls, restricted customer delivery links, minimum-necessary sharing and secure handling of order and production records. The actual controls, incident response owner, provider arrangements and any required breach-notification process must be verified before customer data is collected: [TBD]. No system guarantees absolute security. This draft makes no claim of certification, a completed audit or an unimplemented encryption configuration.
11. Your rights and choices
Depending on your location and the applicable law, you may have rights to access, correct, delete or receive a portable copy of personal information; object to or restrict certain processing; withdraw consent; opt out of applicable targeted advertising/sale/sharing; and complain to the relevant supervisory authority. We will handle qualifying requests within applicable legal periods and explain lawful limitations. Withdrawing optional consent does not affect processing already performed lawfully or prevent necessary order administration.
Use [TBD] to make a request. We may verify identity or an agent's authority proportionately, without asking for unnecessary sensitive data. The operational request route, responsible owner, jurisdiction-specific notice and appeal process where required are [TBD]. Supported customer markets and relevant authorities must be identified before launch. We do not invent a response deadline or a named regulator for an unknown entity and market.
12. Children, sensitive material and other sites
Cliphand is intended for business customers and is not designed to collect children's information. Age-related eligibility and any relevant safeguards are [TBD]. Do not submit footage identifying children or sensitive information without advance assessment and the permissions required by law. Report unintended submissions through [TBD] so they can be assessed and removed or otherwise handled as required.
Our pages can link to other sites and, once implemented, a hosted payment page. Those services have their own privacy notices. A product URL submission does not authorize us to scrape private account data or bypass access restrictions.
13. Changes and contact
We will date and version the final policy and notify people of material changes where required. A revised policy does not by itself authorize a new incompatible use of existing customer data; any necessary consent or other legal basis must be obtained first. Privacy questions, requests and complaints: [TBD]. Postal contact: [TBD].
Review notes — remove only after resolution
The named controller, support route, reviewer, markets, data roles, vendor inventory, transfer safeguards, retention schedule, training controls, tracking decisions, rights procedure and actual security controls must be completed and checked against the deployed service before publication. Stripe setup and Terms/Privacy owner remain [TBD]. Nothing in this draft authorizes collection of customer data, spending or publication.
Coverage and structure were reviewed against the live Viral Ecom Adz Privacy Policy, Terms and Refund Policy, and MakeUGC's Privacy Policy, Terms and Refund Policy, on 16 October 2026. These references are not incorporated policies or partner relationships. Their business identities, tracking stack, training permissions, retention periods and jurisdictional assertions have not been imported into Cliphand's draft.