Privacy Policy

1. Who is responsible for your data

The Service is operated by Bisso Technologies Ltd. (the “operator”) and developed by Yusuf Sadick. For the purposes of data-protection law the operator is the controller of the personal data described in this policy.

You can contact us about privacy at support@hasheemstudio.com.

2. Information we collect

We collect only what is needed to run the Service.

• Account data: your email address, your password (stored only as a salted hash by our authentication system, never in readable form), and one-time verification codes. If you choose Google Sign-In we also receive your name, email address and profile picture from Google.
• Your videos: the MP4 or MOV files you upload, the file name, and technical properties read from the file (for example container, codec, resolution, frame rate, duration, size and colour information). We also store the processed output we create for you and the automated check results that confirm it plays correctly.
• Guest use: if you use the Service before signing in, we place a random token in your browser (and the id of your latest video in the page address) to keep your upload and result together, and we keep a one-way cryptographic hash of your network address to enforce the daily guest limit. We cannot reverse that hash into your address.
• Payment records: when you buy a paid plan we store the plan, amount, currency, status, our internal reference, the payment provider’s reference and timestamps. To start a mobile-money payment we send your mobile number, first name, last name and email to our payment provider, Snippe. Our systems do not store your mobile number or your wallet PIN, and we never see your PIN.
• Technical and security data: IP address, browser type, requested pages, timestamps, error events and abuse-prevention signals, held in server logs.
• Messages: anything you send to our support address, and our replies.

3. Cookies and similar storage

We do not use advertising or analytics cookies and we do not run third-party trackers. The Service uses your browser’s local storage and session storage only for things it needs to work: your sign-in session, the guest token described above, and temporary interface state. Clearing your browser data signs you out and forgets a guest session; it does not delete files already stored on our servers, which expire automatically as described in section 6.

4. How we use information and why

• To provide the Service: receive your upload, process it, verify the result and let you download it (performance of our contract with you).
• To run accounts and payments: authenticate you, apply plan limits and quotas, confirm payments and activate plans (contract).
• To keep the Service safe: detect abuse, hostile or malformed files, fraud and attacks; enforce limits (legitimate interests and legal obligations).
• To communicate: send verification codes, security notices and replies to your requests (contract and legitimate interests).
• To improve reliability: investigate errors and capacity using aggregated technical data (legitimate interests).
• To comply with law: keep financial records and respond to lawful requests (legal obligation).

We do not sell your personal data, we do not use it for advertising, and we do not use your videos to train machine-learning models.

5. What happens to your videos

Your video is processed automatically by software running on our own servers. We do not watch, review or share your videos as a matter of routine. A person may access a file only where strictly necessary to investigate a security incident, to respond to a lawful request, to enforce our Terms (for example a report of illegal content), or to fix a fault you have asked us to look into.

Uploads and results are private. Download links are issued only after we check your account and allowance, and expire within a few hours. We do not publish your videos or make them publicly accessible.

6. How long we keep data

• Uploaded source videos: deleted automatically within about an hour of upload (and never while your video is still being processed).
• Processed results: deleted automatically 5 minutes after your video is ready. The result page shows a countdown; after that the file has been removed and cannot be recovered, and you can simply prepare the video again.
• Account data: kept while your account exists. You can ask us to delete your account at any time; see section 10.
• Payment records: kept for as long as accounting, tax and anti-fraud rules require, even if you delete your account.
• Server logs and security records: kept for a limited period needed for security and troubleshooting, then deleted or anonymised.
• Backups: our database is backed up in encrypted form. Data you delete may remain in backups until they rotate out; it is not restored except to recover from a failure.

7. Who we share data with

We share personal data only with service providers that help us run the Service, under obligations to protect it, and only what they need:

• Snippe: processes mobile-money payments for paid plans.
• Resend: delivers our verification and account emails.
• Google: only if you choose Google Sign-In.
• Hosting and network providers: the servers and network that run the Service, and DNS.

We host our own database, authentication and file storage; your videos are not sent to any third-party video, cloud-AI or storage service. We may disclose information if required by law, court order or a valid request from a competent authority, or to protect the rights, safety and security of our users, the public or the Service. If the business is reorganised or transferred, data may move to the successor under this policy.

8. International transfers

Our infrastructure and our providers may be located outside your country. Where personal data is transferred across borders we take steps to ensure it remains protected as this policy describes and as applicable law requires.

9. How we protect data

• Encrypted connections (HTTPS/TLS) for all traffic to the Service.
• Private file storage: no public access to uploads or results; short-lived, per-file download links issued only after authorisation.
• Row-level access controls so accounts can only reach their own data.
• Sandboxed, resource-limited media processing that treats every uploaded file as untrusted.
• Encrypted backups and protected, non-shared credentials.
• Rate-limiting and abuse detection.

No system is perfectly secure. If a breach affecting your personal data occurs we will notify you and the relevant authority as the law requires.

10. Your rights and choices

Depending on where you live (including under Tanzania’s Personal Data Protection Act, 2022 and, where applicable, other data-protection laws such as the GDPR) you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data and account (“erasure”), subject to records we must keep by law;
• object to or restrict certain processing, and withdraw consent where we rely on it;
• receive your data in a portable format;
• complain to a data-protection authority, such as Tanzania’s Personal Data Protection Commission, or the authority in your country.

To exercise a right, email support@hasheemstudio.com from the address on your account. We may need to verify your identity, and we aim to respond within 30 days. You can also remove any video earlier than its automatic expiry by asking us to delete it.

11. Children

The Service is not directed at children under 18 and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

12. Links to other sites

The Service may link to other sites, for example the developer’s website and social profile. We do not control those sites and this policy does not cover them.

13. Changes to this policy

We may update this policy as the Service changes. The “Last updated” date above shows the current version. If a change is significant we will give notice on the Service or by email before it takes effect.

14. Contact

Questions or requests: support@hasheemstudio.com.