Privacy Policy

Last updated: October 30, 2026

1. Who we are

Kanzelclips is a web-based tool operated by Benjamin Graf to turn the operator's own authorized sermon recordings into reviewed clips and connect accounts that their owners explicitly authorize. The current Studio runs locally; a public hosted Studio is not yet available. Contact: benjamin.graf@ekhn.de.

2. What data we process

The Service processes the minimum data required to operate:

• Connected account profile (TikTok Login Kit, scope user.info.basic): after the account owner signs in with TikTok, we store the account's open ID, display name and avatar URL, solely to show which account is connected and to address API calls to it.
• API tokens: the OAuth access and refresh tokens issued by the platform are stored server-side in encrypted storage (Cloudflare KV) and are used only to call the platform APIs on the owner's behalf. They are never shared with third parties.
• Video content: source recordings, transcripts, reference photos, generated artwork and renders are stored in the local workspace. A separate, explicit cloud handoff can copy reviewed clip files to Cloudflare R2; account connection alone does not transfer a source recording.
• Speech and image processing: Whisper runs locally. Clip selection uses the configured local model or, if explicitly configured, an external AI provider. Paid image generation sends the selected reference images and prompt to the configured Azure image service only after operator confirmation. No new generation is performed by visiting these pages.
• Session cookie in the older web uploader: the app area sets one strictly necessary, HTTP-only session cookie (kc_session) after login. No tracking, advertising or analytics cookies are used.

3. What we do not do

• No data is collected from visitors of the public pages beyond standard technical server logs of our hosting provider (Cloudflare).
• No data about third-party accounts is collected — the Service connects only to accounts its owner explicitly authorizes.
• No data is sold or shared for advertising. No profiling, no analytics trackers.

4. Legal basis and retention

Processing is based on the account owner's consent, given through the platform's OAuth consent screen (Art. 6(1)(a) GDPR), and on our legitimate interest in operating and securing the Service (Art. 6(1)(f) GDPR). Tokens and profile data are kept only while the account connection is active; sessions expire automatically. Revoking the app's access in the TikTok settings invalidates the stored tokens.

5. Where data is processed

The local Studio runs on the operator’s workstation. Public pages and the account-connection service use Cloudflare Workers, KV and R2 (Cloudflare, Inc.), which may process data in data centers inside and outside the EU under standard contractual clauses. Video publishing transfers clip files to the respective platform (YouTube, Instagram, TikTok) at the owner's request.

6. Your rights

Under the GDPR you have the right to access, rectify and erase your data, restrict or object to its processing, and lodge a complaint with a supervisory authority. Since the only account data stored belongs to the operator's own accounts, requests can be sent directly to benjamin.graf@ekhn.de and will be handled without undue delay.

7. Changes

We may update this policy; the current version is always available at this address.