Data Processing Addendum
Last updated October 9, 2026
This addendum sets out how 2662415 Ontario Inc. processes personal data on behalf of customers who use ClipYourSaaS. It is governed by the laws of Ontario, Canada.
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer and 2662415 Ontario Inc. ("we"), 57 Fitzgerald Drive, Cambridge, Ontario N1T 0B2, Canada. It applies when we process personal data on the customer's behalf while providing ClipYourSaaS.
For that personal data, the customer is the controller and 2662415 Ontario Inc. is the processor. Our own processing of account and billing data, as a controller, is covered by our Privacy Policy at https://clipyoursaas.com/privacy.
2. Processing details
Subject matter: creating narrated demo videos of web apps that the customer connects to ClipYourSaaS.
Duration: for as long as the customer uses the service, until the data is deleted as described in section 9.
Nature and purpose: opening the customer's app with the signed-in session of a demo account that the customer signs in to themselves, driving a browser in it, recording the screen, generating scripts and narration with AI, checking the result and storing the finished videos, so that the customer can review, revise and download them.
Categories of data: whatever personal data appears on screen in the customer's app during sign-in and recording, the encrypted signed-in session of the demo account, demo descriptions and revision requests, and the names and email addresses of workspace members.
Data subjects: the customer's workspace members, and any individuals whose data appears in the customer's connected app. We recommend using demo data so that real personal data is not recorded.
3. Customer instructions
We process customer personal data only on the customer's documented instructions. The Terms of Service, this DPA and the customer's use and configuration of the service are those instructions.
We will tell the customer if we believe an instruction breaks applicable data protection law, unless the law prevents us from doing so. The customer is responsible for having a lawful basis to provide the data to us.
4. Confidentiality
We make sure that everyone we authorize to process customer personal data is bound by a duty of confidentiality, either by contract or by law, and has access only as needed to provide the service.
5. Security measures
Encryption: customer data is encrypted in transit, and stored files are encrypted at rest by our storage provider.
Session encryption: the demo account is kept as an encrypted signed-in session; we never see or store the password. Sessions are sealed with AES-256-GCM using versioned encryption keys that we can rotate, are used only by code to open the customer's app, and are never shown to the AI.
Isolation: recording jobs run in isolated worker containers with read-only filesystems, and outbound requests from recordings are blocked from reaching private, internal and cloud-metadata addresses. Each workspace's data is kept separate from other workspaces.
Access control: recordings and reset links only reach addresses on the public internet, and access to production systems is limited to personnel who need it.
Audit logging: administrative actions are recorded in an audit log that is retained for security. More detail is on our Security page at https://clipyoursaas.com/security.
6. Subprocessors
The customer authorizes us to use the subprocessors listed below. Each is bound by written terms that protect personal data at least as well as this DPA.
We will give at least 30 days' notice before adding or replacing a subprocessor, by updating this page and emailing the workspace owner. The customer may object on reasonable data protection grounds by writing to privacy@clipyoursaas.com within that period. If we cannot resolve the objection, the customer may stop using the affected service and delete their workspace.
| Subprocessor | Purpose |
|---|---|
| OpenAI | AI models for planning, scripting, the browser agent and visual quality checks, and automated content safety checks of each video's title, narration (or on-screen labels) and share texts |
| Anthropic | Configured as the alternative provider of the AI models for planning, scripting, the browser agent and visual quality checks; we can switch to it, but don't use it today |
| ElevenLabs | Voice narration |
| Cloudflare | Object storage (R2) and DNS |
| Resend | Transactional email |
| Stripe | Payments, sales tax, invoices and receipts |
| Optional "Sign in with Google" | |
| OVH | Application hosting in Canada (Beauharnois, Quebec) |
7. Data subject requests
If we receive a request from an individual about customer personal data, we will refer them to the customer and will not respond directly unless the customer asks us to or the law requires it.
Taking into account the nature of the processing, we will help the customer respond to requests to access, correct, delete or restrict personal data. The customer can delete videos and workspaces directly in the service.
8. Personal data breach notification
If we become aware of a personal data breach affecting customer personal data, we will notify the customer without undue delay, and in any case within 72 hours of becoming aware of it.
The notice will describe what happened, the data and individuals likely affected, the likely consequences and the steps we are taking, as far as that information is available. We will provide more detail as we learn it.
9. Deletion and return
The customer can download finished videos at any time while the workspace exists. Recordings, scripts and narration are kept with each video so that it can be revised, and videos are kept until the customer deletes them.
When the customer deletes a workspace, its database records are deleted immediately and its stored files are purged from storage shortly after. Deleting an account deletes any workspace where that user is the only member. Audit logs of administrative actions are retained for security, and we may keep other data where the law requires us to.
10. Audits
We will make available the information reasonably needed to show that we comply with this DPA, and answer reasonable security questionnaires. Requests go to privacy@clipyoursaas.com.
Where that information is not enough, or a regulator requires it, the customer may carry out an audit, at its own cost, no more than once a year, with at least 30 days' notice, during business hours, and subject to confidentiality and to protecting other customers' data.
11. International transfers
Our application servers are hosted in Canada. Some subprocessors process data in the United States and other countries.
Where the GDPR or UK data protection law requires it, transfers of customer personal data are made under the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism, which are incorporated into this DPA by reference.
12. Liability and precedence
Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, unless the law does not allow it.
If this DPA conflicts with the Terms of Service, this DPA takes precedence for the processing of customer personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses take precedence. This DPA is governed by the laws of Ontario, Canada, except where the Standard Contractual Clauses require otherwise.