Privacy Policy

Scope and Our Role

• This Policy applies to website visitors, Platform users, customer and organization representatives, and anyone who contacts us for a demo or support.
• LIGHTCLIP is operated from the Kingdom of Saudi Arabia. You can contact the operator at [email protected]. Additional statutory provider details appear in the customer’s commercial proposal, contract, or invoice, depending on the engagement.
• LIGHTCLIP acts as a Controller when it determines why and how personal data is processed. When we process data uploaded by an enterprise customer on its behalf and instructions, we may act as a Processor; the customer remains responsible for having a lawful basis to collect and provide that data.
• This Policy does not cover independent practices of external websites and platforms reached through LIGHTCLIP links or integrations; their own policies apply.

Personal Data We Collect

Sources of Data

• Directly from you when you create an account, upload content, use features, or contact us.
• From your organization or workspace administrator when they create your account or assign roles and permissions.
• From social platforms and services you connect after you grant authorization.
• Automatically from your device, browser, and service operating logs.
• From service providers as needed to confirm an operation, diagnose an error, or prevent misuse.

Purposes for Using Data

• Create accounts and manage identity, permissions, workspaces, and projects.
• Provide editing, design, streaming, clipping, transcription, translation, scheduling, publishing, and analytics features.
• Run AI requests and produce the results requested by the user.
• Connect external services and perform authorized publishing or import actions.
• Operate, maintain, measure, and improve the service and user experience.
• Protect accounts and the Platform, prevent fraud and abuse, and investigate incidents.
• Provide support and respond to questions, requests, and complaints.
• Send operational, security, and administrative messages, and marketing messages where there is consent or another lawful basis, with an opt-out.
• Meet legal obligations, preserve rights, and enforce the Terms and agreements.

Lawful Bases for Processing

• Performing a contract with you or taking requested steps before entering a contract.
• Your consent where consent is required; you may withdraw it without affecting processing lawfully completed before withdrawal.
• Meeting a legal obligation or responding to a request from a competent authority.
• Pursuing our or another party’s legitimate interest after assessment, provided your rights and interests are not prejudiced and the data is not sensitive, where the Law permits.
• Any other basis permitted by the Personal Data Protection Law and other applicable laws.

Data Disclosure and Sharing

We do not sell your personal data. We disclose it only for a specified purpose, to the minimum extent necessary, or under a lawful basis.

• Infrastructure and operations providers: Such as hosting, storage, content delivery, email, and technical monitoring services acting as processors or service providers.
• AI and media processing providers: We may send only the prompts, text, images, audio, or video needed to perform a feature you request, such as generation, transcription, translation, or rendering.
• Platforms you connect: Such as YouTube, X, TikTok, Instagram, and Facebook when you ask us to connect, publish, or retrieve data.
• Your organization and team: Account, activity, and content data may be visible to workspace administrators and authorized members according to permissions and sharing settings.
• Competent authorities: Where required by law, or to protect rights and safety and investigate fraud or incidents through lawful procedures.
• Corporate transactions: In a restructuring, merger, acquisition, or business transfer, subject to confidentiality and protection requirements and notice where required.

Storage and Transfers Outside Saudi Arabia

• Some data may be processed or stored by cloud, AI, or social platform providers whose infrastructure is outside Saudi Arabia.
• We transfer data outside Saudi Arabia only for a specified purpose, to the necessary extent, and under the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom.
• We assess the recipient, country, purpose, and risks and use appropriate legal safeguards, such as Standard Contractual Clauses, where required.
• The processing country may vary by feature, provider, and the region selected by a customer or offered by an external service.
• You may request more information about recipient categories or transfer safeguards at [email protected].

Cookies

• We use necessary cookies and technologies to keep sessions active, store language, appearance, and preferences, and apply security controls.
• We may use aggregated usage data or measurement tools needed to understand performance and improve the service, subject to required settings and consent.
• External services may set their own cookies when you open their content or complete authorization with them; their policy applies.
• You can control cookies in your browser, but disabling necessary cookies may prevent login or impair features.

Artificial Intelligence and Automated Processing

• When you use an AI feature, we process the inputs, attachments, and context needed to perform your request and return a result.
• The minimum necessary data may be sent to the model or processing provider described among the recipient categories in this Policy.
• Do not use AI results to make significant decisions about people without suitable human review and a lawful basis.
• Avoid entering sensitive or confidential personal data that the feature does not need, and ensure you are authorized to process other people’s data.
• We may retain request, result, and technical metering records for service delivery, security, and accounting under the appropriate retention period.

Data Protection

• We apply technical and organizational measures proportionate to the nature of the data and processing risks.
• Measures include encryption in transit, credential protection, and role- and project-based access controls.
• We provide controls such as two-factor authentication and use audit logs and monitoring to help detect unauthorized activity.
• We limit employee and provider access to what is needed for their duties, with appropriate confidentiality and protection obligations.
• We review and update controls as risks and technology change, but no system can be guaranteed absolutely secure.
• If a personal data breach requires reporting or notification, we will take the steps required within the statutory periods.

Data Retention

• We keep data only as long as needed for the purpose for which it was collected, to perform the contract, or for a period required by law.
• The period varies by data type, account or project status, security and audit needs, and claim resolution requirements.
• When an account or content is deleted, we delete or anonymize records subject to deletion; limited copies may remain temporarily in backups until replaced through a secure deletion cycle.
• We may retain a limited record where needed for a legal obligation, dispute, fraud prevention, or rights protection, then destroy it when the purpose ends.
• We may retain anonymized or aggregated data that does not identify a person for statistics and service improvement.
• Deleting content from LIGHTCLIP does not delete it from an external platform to which it was published; manage it through your account on that platform.

Personal Data Subject Rights

Under the Saudi Personal Data Protection Law, subject to statutory conditions and exceptions, you have:

• Right to be informed: Know the lawful basis and purpose for collection and how your data is processed and disclosed.
• Right of access: Access personal data about you that we hold.
• Right to obtain a copy: Request a clear, readable copy matching the substance of our records, under applicable controls.
• Right to correction: Ask us to correct, complete, or update your data.
• Right to destruction: Ask us to destroy data when it is no longer needed, unless a lawful basis requires retention.
• Withdrawal of consent: Withdraw consent at any time where consent is the basis, unless another lawful basis applies.
• Complaint and compensation: Complain to the competent authority and seek compensation for material or moral harm under the Law.

To exercise a right, email [email protected] from your account email and identify the right and data concerned. We may request information to verify identity and authority. We respond without delay and within the statutory period, generally 30 days, with extensions only where the Regulations allow and with notice explaining the extension.

Children and Persons Lacking Legal Capacity

• The Platform is intended for professional use and is not intentionally directed to persons under 18.
• Where processing a child’s or legally incapable person’s data is necessary, it must be carried out by or with the consent of the legal guardian and under applicable requirements.
• If you believe a child provided data without appropriate authority, contact us so we can take appropriate action.

Updates to This Policy

• We may update the Policy when the service, processing practices, or legal requirements change.
• We will publish the updated version on this page and change the Last updated date.
• We will provide appropriate notice if a change is material or new consent is legally required.
• The updated version applies from its stated date and does not affect rights previously acquired under law.

Contact and Complaints

For questions, rights requests, or privacy complaints, contact the LIGHTCLIP privacy team at [email protected] or through in-product support. Do not send your password or verification codes with the request.

If you are dissatisfied with our response, you may complain to the Saudi Data and AI Authority (SDAIA), as the competent authority, through the National Data Governance Platform at dgp.sdaia.gov.sa, subject to statutory procedures and periods.