Stillhaven
Get started

Legal

Privacy Policy

STILLHAVEN PRIVACY POLICY

Last updated: July 1, 2026 · Version: 2.4

1. Who we are and what this covers

1.1 This Privacy Policy explains how B Side Solutions, LLC d/b/a Stillhaven ("Stillhaven," "we," "us"), which operates the Stillhaven video hosting, streaming, and embedding service (the "Services"), handles personal data. It applies to our website at stillhaven.io, our account dashboard, our embeddable players, and our APIs and related products.

1.2 It does not apply to our Customers' own websites, apps, or services, or to how our Customers handle personal data — those are governed by the Customer's own privacy policy.

2. Our two roles: controller vs. processor

Because Stillhaven is a platform that businesses and creators use to host and deliver their videos, our privacy role changes depending on the data:

2.1 When we are a "controller" (we decide how and why data is used): your account, billing, and website-visitor data, and our own analytics about how the Services are used. This Privacy Policy governs that data.

2.2 When we are a "processor" (we handle data on a Customer's behalf, under their instructions): the personal data contained in a Customer's uploaded videos ("Customer Content") and the viewer data we process when delivering a Customer's videos (for example, viewer IP addresses and viewing analytics). For that data, the Customer is the controller, our Data Processing Addendum (DPA) governs, and viewers should consult the Customer's own privacy policy. If you are a viewer with a question about a specific video, please contact the business or creator who published it.

3. The personal data we collect

3.1 Account and profile data — name, email address, password/credentials, company or organization name, and role, when you register or manage an account (including Managers and team members you add).

3.2 Billing data — your plan, transaction history, and billing contact details. Card payments are processed by our payment processor (Stripe); we do not store full payment-card numbers.

3.3 Content and usage data — the videos and files you upload (Customer Content), and metadata and logs about how you use the Services (uploads, storage and bandwidth usage, feature usage, API calls).

3.4 Viewer and delivery data — when videos are viewed via our players or embeds, we process data such as IP address, approximate location, device and browser information, and viewing/engagement analytics. We typically process this on behalf of the Customer who published the video (see §2.2).

3.5 Viewer-submitted feedback — where a Customer turns on client review for a video, a viewer who leaves a note or approves the video gives us a name, the text of the note, and an email address (optional on a note, required to approve). Notes are visible to the Customer and to anyone else who can open that share page, so please do not include personal or confidential information in them. We process this on behalf of the Customer who published the video (see §2.2).

3.6 Communications and support data — messages you send us, support tickets, and related records.

3.7 Cookies and similar technologies — see §7.

3.8 Data from third parties — for example, if you sign in through a third-party identity provider or connect an integration (such as a CRM), we receive limited data from that service as you direct.

3.9 We do not intend to collect special-category or sensitive personal data through the Services, and you should not upload it as Customer Content unless you have a lawful basis and the necessary consents.

4. How we use personal data (and our legal bases)

We use personal data to:

  • Provide and operate the Services — host, transcode, stream, and embed your videos; manage your account and access. (Legal basis: performance of a contract.)

  • Bill and manage payments. (Contract; legal obligation.)

  • Secure the Services and prevent abuse — including fraud prevention, enforcing our Terms and AUP, and automated scanning of uploaded content to detect prohibited material such as child sexual abuse material. (Legitimate interests; legal obligation.)

  • Analyze and improve the Services and develop new features. (Legitimate interests.)

  • Communicate with you — service and transactional messages, and, where permitted, marketing you can opt out of. (Contract; legitimate interests; consent where required.)

  • Comply with law and enforce our rights — including responding to legal process and reporting apparent child-exploitation content to NCMEC and cooperating with law enforcement. (Legal obligation; legitimate interests.)

Where we rely on legitimate interests, we balance them against your rights. Where we rely on consent (for example, certain cookies or marketing), you may withdraw it at any time.

5. How we share personal data

We do not sell your personal data. We share it only as follows:

5.1 Service providers / sub-processors who help us run the Services under contract — for example, cloud hosting and content delivery (Amazon Web Services), payment processing (Stripe), and email/communications (Amazon SES and ActiveCampaign), and website/product analytics (Google Analytics). A current list of sub-processors is available at the sub-processor list or on request.

5.2 With the Customer, where we process viewer or content data on the Customer's behalf (§2.2).

5.3 Legal, safety, and compliance — with law enforcement, regulators, NCMEC, or others where we believe disclosure is required by law or necessary to protect rights, safety, or the integrity of the Services.

5.4 Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5.5 With your direction or consent — for example, integrations you connect. §5.6 describes the most significant of these.

5.6 AI assistants and other tools you connect (including the Claude connector). You can connect Stillhaven to an outside tool, either through our API using a key you create, or by adding Stillhaven as a connector inside Anthropic's Claude. In both cases you start the connection, and data about your library is sent to that tool as a result.

For the Claude connector specifically:

  • What is sent. Whatever the connector is asked to do on your behalf: video titles and descriptions, folder and channel names, upload and update timestamps, durations and file sizes, storage and bandwidth figures for your account, play and completion analytics, share links, embed codes, and the list of domains a video may be embedded on.
  • What is not sent. Your video and audio files never pass through the connector. It moves information about your library, not the media itself. It is also not given your password, your payment details, or anything belonging to another account.
  • Nothing about your viewers is sent. This matters most if you run private channels. The analytics the connector can read are counts only — plays, loads, and how many people reached a quarter, half, three quarters, and the end. It has no access to the email addresses of channel viewers, to who watched what, or to notes left on a share page. Where we act as a processor on your behalf (§2.2), that data stays out of this connection entirely.
  • What it can change. With your permission it can rename videos, edit descriptions, move videos between folders, start an upload, move a video to trash and restore it, reorder a channel, and set where a video may be embedded. It cannot change billing, manage your team, alter your branding, manage API keys, or delete anything permanently.
  • Who receives it. Anthropic, PBC, as the operator of Claude. Anthropic is not our sub-processor and does not act on our instructions. You are directing the disclosure by connecting the two services, and what Anthropic then does with that data is governed by your agreement with Anthropic, not by this Policy.
  • How you sign in. Through our own sign-in page. Your Stillhaven password is never given to Claude. Claude receives a limited-life access token instead: it expires after 60 minutes, and the refresh that renews it expires after 30 days without use.
  • How to stop it. In Stillhaven, open Settings → API and press Disconnect Claude. Access ends within moments and stays ended: signing in again from Claude will not restore it, because the connection stays switched off until you allow it again on that same page. You can also remove the connector in Claude, which clears what it holds at that end. An unused connection expires on its own after 30 days.

If you use the API with a key instead, the same principle applies: the key acts as your account within the permissions you gave it, whatever you connect it to receives the data it asks for, and you can revoke the key at any time in Settings → API.

6. "Do we sell or share your data?" (US state-law note)

We do not "sell" personal data, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and similar US state laws.

7. Cookies and similar technologies

7.1 We use cookies and similar technologies for essential functions (signing you in, security), preferences, and analytics to understand and improve the Services.

7.2 Where required (for example, in the EU/EEA and UK), we request consent for non-essential cookies through a consent banner, and you can change your choices at any time. You can also control cookies through your browser.

8. Data retention

8.1 We keep personal data for as long as needed to provide the Services and for the purposes described here, then delete or anonymize it. Account and Customer Content are retained for the life of the account and for a limited period after termination as described in the Terms (export window), subject to backups.

8.2 Viewer-submitted feedback (§3.5) is kept until the Customer deletes the note or deletes the video it belongs to, whichever comes first. Because the Customer controls that data, a viewer who wants a note removed should ask the Customer, or contact us and we will refer the request (§9).

8.3 We retain certain records longer where required by law — for example, preserving reported child-exploitation material and related records consistent with legal preservation obligations.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights. Where we act as a processor on a Customer's behalf (§2.2), we will refer your request to that Customer or assist them in responding.

9.1 EU/EEA and UK (GDPR / UK GDPR). You may have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your data protection authority.

9.2 California (CCPA/CPRA) and other US states. You may have the right to know/access, delete, and correct your personal data, to data portability, to opt out of the "sale" or "sharing" of personal data and of targeted advertising, and to limit the use of sensitive personal data — and the right not to be discriminated against for exercising these rights. As noted in §6, we do not sell or share personal data for these purposes.

9.3 How to exercise your rights. Contact us at privacy@stillhaven.io or contact us. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent where the law permits.

10. International data transfers

10.1 We are based in the United States, and we and our service providers may process personal data in the United States and other countries. These countries may have different data-protection laws than yours.

10.2 For transfers of personal data from the EU/EEA and UK, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum — together with any supplementary measures required.

11. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. See our DPA / security documentation for more detail.

12. Children

The Services are not directed to, and are not intended for, children under 18, and you must be at least 18 to create an account. We do not knowingly collect personal data directly from children under 18. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice as described in the Terms.

14. Contact us

Questions or requests: privacy@stillhaven.io, or B Side Solutions, LLC, 517 E. Exchange St., Spring Lake, MI 49456, USA.