Stillhaven
Get started

Legal

Privacy Policy

STILLHAVEN PRIVACY POLICY

Last updated: July 1, 2026 · Version: 2.4

1. Who we are and what this covers

1.1 This Privacy Policy explains how B Side Solutions, LLC d/b/a Stillhaven ("Stillhaven," "we," "us"), which operates the Stillhaven video hosting, streaming, and embedding service (the "Services"), handles personal data. It applies to our website at stillhaven.io, our account dashboard, our embeddable players, and our APIs and related products.

1.2 It does not apply to our Customers' own websites, apps, or services, or to how our Customers handle personal data — those are governed by the Customer's own privacy policy.

2. Our two roles: controller vs. processor

Because Stillhaven is a platform that businesses and creators use to host and deliver their videos, our privacy role changes depending on the data:

2.1 When we are a "controller" (we decide how and why data is used): your account, billing, and website-visitor data, and our own analytics about how the Services are used. This Privacy Policy governs that data.

2.2 When we are a "processor" (we handle data on a Customer's behalf, under their instructions): the personal data contained in a Customer's uploaded videos ("Customer Content") and the viewer data we process when delivering a Customer's videos (for example, viewer IP addresses and viewing analytics). For that data, the Customer is the controller, our Data Processing Addendum (DPA) governs, and viewers should consult the Customer's own privacy policy. If you are a viewer with a question about a specific video, please contact the business or creator who published it.

3. The personal data we collect

3.1 Account and profile data — name, email address, password/credentials, company or organization name, and role, when you register or manage an account (including Managers and team members you add).

3.2 Billing data — your plan, transaction history, and billing contact details. Card payments are processed by our payment processor (Stripe); we do not store full payment-card numbers.

3.3 Content and usage data — the videos and files you upload (Customer Content), and metadata and logs about how you use the Services (uploads, storage and bandwidth usage, feature usage, API calls).

3.4 Viewer and delivery data — when videos are viewed via our players or embeds, we process data such as IP address, approximate location, device and browser information, and viewing/engagement analytics. We typically process this on behalf of the Customer who published the video (see §2.2).

3.5 Communications and support data — messages you send us, support tickets, and related records.

3.6 Cookies and similar technologies — see §7.

3.7 Data from third parties — for example, if you sign in through a third-party identity provider or connect an integration (such as a CRM), we receive limited data from that service as you direct.

3.8 We do not intend to collect special-category or sensitive personal data through the Services, and you should not upload it as Customer Content unless you have a lawful basis and the necessary consents.

4. How we use personal data (and our legal bases)

We use personal data to:

  • Provide and operate the Services — host, transcode, stream, and embed your videos; manage your account and access. (Legal basis: performance of a contract.)

  • Bill and manage payments. (Contract; legal obligation.)

  • Secure the Services and prevent abuse — including fraud prevention, enforcing our Terms and AUP, and automated scanning of uploaded content to detect prohibited material such as child sexual abuse material. (Legitimate interests; legal obligation.)

  • Analyze and improve the Services and develop new features. (Legitimate interests.)

  • Communicate with you — service and transactional messages, and, where permitted, marketing you can opt out of. (Contract; legitimate interests; consent where required.)

  • Comply with law and enforce our rights — including responding to legal process and reporting apparent child-exploitation content to NCMEC and cooperating with law enforcement. (Legal obligation; legitimate interests.)

Where we rely on legitimate interests, we balance them against your rights. Where we rely on consent (for example, certain cookies or marketing), you may withdraw it at any time.

5. How we share personal data

We do not sell your personal data. We share it only as follows:

5.1 Service providers / sub-processors who help us run the Services under contract — for example, cloud hosting and content delivery (Amazon Web Services), payment processing (Stripe), and email/communications (Amazon SES and ActiveCampaign), and website/product analytics (Google Analytics). A current list of sub-processors is available at the sub-processor list or on request.

5.2 With the Customer, where we process viewer or content data on the Customer's behalf (§2.2).

5.3 Legal, safety, and compliance — with law enforcement, regulators, NCMEC, or others where we believe disclosure is required by law or necessary to protect rights, safety, or the integrity of the Services.

5.4 Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5.5 With your direction or consent — for example, integrations you connect.

6. "Do we sell or share your data?" (US state-law note)

We do not "sell" personal data, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and similar US state laws.

7. Cookies and similar technologies

7.1 We use cookies and similar technologies for essential functions (signing you in, security), preferences, and analytics to understand and improve the Services.

7.2 Where required (for example, in the EU/EEA and UK), we request consent for non-essential cookies through a consent banner, and you can change your choices at any time. You can also control cookies through your browser.

8. Data retention

8.1 We keep personal data for as long as needed to provide the Services and for the purposes described here, then delete or anonymize it. Account and Customer Content are retained for the life of the account and for a limited period after termination as described in the Terms (export window), subject to backups.

8.2 We retain certain records longer where required by law — for example, preserving reported child-exploitation material and related records consistent with legal preservation obligations.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights. Where we act as a processor on a Customer's behalf (§2.2), we will refer your request to that Customer or assist them in responding.

9.1 EU/EEA and UK (GDPR / UK GDPR). You may have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your data protection authority.

9.2 California (CCPA/CPRA) and other US states. You may have the right to know/access, delete, and correct your personal data, to data portability, to opt out of the "sale" or "sharing" of personal data and of targeted advertising, and to limit the use of sensitive personal data — and the right not to be discriminated against for exercising these rights. As noted in §6, we do not sell or share personal data for these purposes.

9.3 How to exercise your rights. Contact us at privacy@stillhaven.io or contact us. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent where the law permits.

10. International data transfers

10.1 We are based in the United States, and we and our service providers may process personal data in the United States and other countries. These countries may have different data-protection laws than yours.

10.2 For transfers of personal data from the EU/EEA and UK, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum — together with any supplementary measures required.

11. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. See our DPA / security documentation for more detail.

12. Children

The Services are not directed to, and are not intended for, children under 18, and you must be at least 18 to create an account. We do not knowingly collect personal data directly from children under 18. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice as described in the Terms.

14. Contact us

Questions or requests: privacy@stillhaven.io, or B Side Solutions, LLC, 517 E. Exchange St., Spring Lake, MI 49456, USA.