Privacy Policy

Last updated: July 15, 2026

1. Who we are

Kanzelclips is a web-based tool operated by Benjamin Graf to turn the operator's own sermon recordings into short clips and publish them to the operator's own social media accounts. Contact: benjamin.graf@ekhn.de.

2. What data we process

The Service processes the minimum data required to operate:

• Connected account profile (TikTok Login Kit, scope user.info.basic): after the account owner signs in with TikTok, we store the account's open ID, display name and avatar URL, solely to show which account is connected and to address API calls to it.
• API tokens: the OAuth access and refresh tokens issued by the platform are stored server-side in encrypted storage (Cloudflare KV) and are used only to call the platform APIs on the owner's behalf. They are never shared with third parties.
• Video content: the clips processed by the Service are the operator's own recordings, stored in the operator's own cloud storage (Cloudflare R2).
• Session cookie: the app area sets one strictly necessary, HTTP-only session cookie (kc_session) after login. No tracking, advertising or analytics cookies are used.

3. What we do not do

• No data is collected from visitors of the public pages beyond standard technical server logs of our hosting provider (Cloudflare).
• No data about third-party accounts is collected — the Service connects only to accounts its owner explicitly authorizes.
• No data is sold or shared for advertising. No profiling, no analytics trackers.

4. Legal basis and retention

Processing is based on the account owner's consent, given through the platform's OAuth consent screen (Art. 6(1)(a) GDPR), and on our legitimate interest in operating and securing the Service (Art. 6(1)(f) GDPR). Tokens and profile data are kept only while the account connection is active; sessions expire automatically. Revoking the app's access in the TikTok settings invalidates the stored tokens.

5. Where data is processed

The Service runs on Cloudflare Workers, KV and R2 (Cloudflare, Inc.), which may process data in data centers inside and outside the EU under standard contractual clauses. Video publishing transfers clip files to the respective platform (YouTube, Instagram, TikTok) at the owner's request.

6. Your rights

Under the GDPR you have the right to access, rectify and erase your data, restrict or object to its processing, and lodge a complaint with a supervisory authority. Since the only account data stored belongs to the operator's own accounts, requests can be sent directly to benjamin.graf@ekhn.de and will be handled without undue delay.

7. Changes

We may update this policy; the current version is always available at this address.