This Privacy Policy (“Policy”) describes how VHS Media Group LTD (“Video Highlight,” “we,” “us,” or “our”) collects, uses, stores, and discloses information, including personal data, in connection with our services (“Services”) available at https://videohighlight.com (the “Website”). We are committed to protecting your privacy and handling your personal data in a transparent and secure manner. Please read this Policy carefully. For additional details, please review our Terms of Service.

1. Information We Collect

1.1. Google User Data. When you sign in using your Google account, we collect basic profile information (email, name, and public profile picture) for authentication and account creation.

1.2. Other Personal Data. We do not collect personal data beyond your Google profile data, except for information you voluntarily provide (e.g., contacting support).

1.3. Cookies and Tracking. We use JSON Web Tokens (JWT) for authentication, which may create a cookie. We also use analytics services like Mixpanel and Google Analytics that employ cookies or similar tracking technologies to gather usage data for service improvement.

2. How We Use Your Information

2.1. Authentication and Communication. We use your Google user data (name and email) to authenticate your account, personalize your experience, and send product-related emails.

2.2. Analytics and Service Enhancement. We analyze usage data (Mixpanel, Google Analytics) to troubleshoot technical issues, monitor performance, and improve our Services.

2.3. Future Integrations. We may request your explicit consent in the future to access your YouTube account (e.g., to read playlists or process videos for creators). We will provide additional disclosures at that time.

3. Data Sharing and Disclosure

3.1. Service Providers. We rely on Amazon Web Services (us-east-1) for hosting, Mixpanel for analytics, and Google Analytics for user insights. These providers may access personal data when necessary to perform services on our behalf but are contractually obligated to maintain confidentiality.

3.2. Internal Access. Authorized personnel at Video Highlight (fewer than 10 people) may access user data for legitimate business reasons and under confidentiality obligations.

3.3. Legal Requirements. We may disclose your data to comply with applicable law or legal processes, or to protect the rights, property, or safety of our users or the public.

3.4. No Sale of Data. We do not sell or rent your personal data under any circumstances.

4. Developer APIs, Tokens, and MCP Integrations

4.1. Personal Access Tokens and OAuth Tokens. Personal access tokens (PATs) and OAuth access tokens authenticate the Video Highlight CLI, MCP servers, and other integrations on your behalf. We store only a SHA-256 hash of each token's plaintext value — the plaintext itself is shown to you once at creation and is not recoverable afterwards. Each token grants the same access as your account, except that token management, billing, and third-party integration endpoints reject token-authenticated requests. You may revoke any token at any time at /settings/api-keys. Revoked tokens are unusable immediately, and their hashed records are retained for up to 90 days for security audit purposes before being purged.

4.2. MCP Server Data Handling. Our hosted Model Context Protocol (MCP) server proxies tool calls from your AI assistant to your Video Highlight library. We log request method, scope, response status, and timing for each call; we do not log tool arguments, tool response bodies, or the transcript / summary content that passes through the server. All MCP traffic is processed in AWS us-east-1. Video Highlight is not currently an Anthropic Zero Data Retention (ZDR) partner: when you invoke our MCP tools from inside Claude or another LLM host, your prompts and the tool inputs/outputs transit that host's infrastructure under the host's terms and retention policy (e.g., Anthropic's default 30-day retention for your account). We do not control how the host stores that data. For workflows that require ZDR-style handling, contact us at security@videohighlight.com.

4.3. Third-Party MCP Clients and OAuth Connections. When you grant an MCP client (Claude Desktop, Cursor, ChatGPT, Windsurf, Codex, Zed, VS Code, or any other) access to your account via OAuth, you authorize that client to act on your behalf within the specific scopes you approve on our consent screen. The client receives a bearer token tied to those scopes; it never receives your password. You can review and revoke any connected client at /settings/api-keys; revocation invalidates the client's token immediately.

4.4. Webhook Delivery (planned). Future webhook integrations will deliver event notifications to URLs you control. Payloads will include resource identifiers (e.g., video IDs, task IDs) and status fields but will not include transcript content, summary text, or other free-form user-generated content. Failed deliveries will be retried with exponential backoff for up to 24 hours and then dropped. Webhook signing secrets will be issued to you once and may be rotated on demand. Webhook delivery is not yet live; this section will be updated when it ships.

5. Data Retention and Deletion

We store your personal data as long as your account remains active or as necessary to provide Services. If you wish to deactivate or delete your data, please contact us at contact@videohighlight.com. We will delete your data unless retention is required or permitted by law (e.g., for legal obligations or dispute resolution).

6. Data Security

We use commercially reasonable measures to protect your data. Despite our efforts, no security measure is infallible, and we cannot guarantee absolute protection against unauthorized access, hacking, or data breaches.

7. Children’s Privacy

The Services are not intended for individuals under 13. Children under 13 should not use our Services, and if we discover we have unintentionally collected such data, we will promptly delete it. Please notify us at contact@videohighlight.com if you believe we have collected a child’s information.

8. International Data Transfers

Our primary servers are in the United States (AWS us-east-1). If you access the Services from outside the U.S., you consent to your data being transferred and processed in the U.S., where data protection laws may differ from those in your jurisdiction.

9. Your Rights

Depending on your location, you may have rights under data protection laws (e.g., GDPR, CCPA) to request access, correction, or deletion of your personal data. To exercise these rights, please email us at contact@videohighlight.com. We will respond as required by applicable law.

If you reside in specific regions (e.g., EEA, UK, certain U.S. states), you may also have the right to object to processing, request data portability, or lodge a complaint with a supervisory authority.

10. Changes to This Policy

We may update this Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make significant changes, we will notify you by posting a prominent notice on the Website or via email. Your continued use of the Services following the posting of the updated Policy constitutes acceptance of the changes.

11. Contact Us

If you have any questions about this Policy, or if you wish to exercise any of your legal rights, please email us at contact@videohighlight.com. We will make reasonable efforts to address your inquiry promptly.

12. Effective Date

This Policy is effective as of the date listed at the top of this page.

13. Acknowledgment

By using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.