Legal
Platform Privacy Policy
- Version
- Version 1.2
- Effective
- Effective
- Reference
- Ref CBA/LEGAL/PRIV/2026-10-06
This policy explains how Creative Broadcast Agency FZE-LLC ("CBA") handles personal data on the CBA broadcast platform at creativebroadcast.com, including client workspaces operated on it. It is written for the viewers who use the platform and for the client organisations whose events run on it. For a specific engagement, the Data Handling and Retention Statement issued for that engagement gives the precise scope and prevails where more specific.
Contents
1What we collect
| Category | Detail |
|---|---|
| Registration | Name and work email address. Other fields, such as job title, only where the client asks for them. |
| Engagement | Comments and questions, poll responses, chat messages where chat is enabled, and reactions. |
| Viewing | Session attendance and viewing activity (join and leave times, watch duration), used for the client's attendance reporting. |
| Captions | Where captions are switched on, the text of what is said in the programme, in the languages captioned. |
| Remote contributors | For speakers who join remotely: their name, and their live camera and microphone for the programme. |
| Technical | Standard connection logs (IP address, browser type, timestamps) kept for security and troubleshooting. |
| Sign-in | For one-time-code sign-in, a one-way hash of the code and its expiry. For Microsoft sign-in, the verified email address only: no password, credential or token is stored by CBA. |
The platform uses essential cookies only: signed cookies for sign-in and workspace access. There is no advertising, no analytics tracking and no cross-site tracking.
2Why we process it
- To operate the event: verifying access, streaming to registered viewers, bringing in remote contributors, producing captions, running questions and polls, and moderating submissions.
- To report to the client whose event it is: attendance, engagement and export of that client's own viewer data. CBA operator accounts are excluded from client reporting.
- To keep the platform secure: connection logs, rate limits and abuse prevention.
CBA does not sell personal data, does not use it for advertising, and does not contact viewers for marketing.
3Who processes it for us
| Purpose | Provider | Notes |
|---|---|---|
| Video streaming and hosting | Cloudflare Stream | The live stream and recordings |
| Platform database and file storage | Supabase (AWS, ap-south-1, Mumbai) | Registration, engagement and caption records and uploaded slides, backed up daily |
| Web application hosting | Vercel (Mumbai region) | The platform itself; no personal data stored at this layer |
| Live session updates and email hand-off | Cloudflare Workers | Live updates during a session; passing sign-in emails to the sending service; access tokens for remote contributors |
| Sign-in emails | Resend | Delivery of one-time sign-in codes |
| Remote contributors | LiveKit Cloud | Real-time relay of contributors' camera and microphone; not recorded by the provider |
| Live captions | CBA-operated equipment | Speech to text and translation on CBA's own systems; no audio stored |
| Microsoft sign-in | Microsoft Entra ID (the client's own tenant) | Sign-in only; CBA stores no credential or token |
Each provider is an established cloud service operating under its own certified security programme. If an engagement uses any additional service, for example an outside transcription or translation service, it is named in that engagement's Data Handling and Retention Statement before the event.
4How long we keep it
- Event recordings and viewer data are kept for the period agreed with each client organisation. Where no period has been agreed, recordings stay available to viewers for thirty days after the event and are then hidden from viewers, not deleted.
- Nothing is deleted automatically. At the end of the hosting period the recording is hidden from viewers and kept for the client until the client asks for deletion, or the engagement ends.
- Viewer data is kept for the duration of the engagement. At the end, or at any time on the client's written request, CBA exports it to the client, deletes it, and confirms the deletion in writing.
- Technical logs are kept for a short rolling window for security, then discarded.
5Your rights
Viewers may ask to see, correct or delete their personal data. Where the data belongs to a client's event, CBA acts on the instruction of the client organisation, which is the controller of its own event data; CBA processes it on the client's behalf. Requests go to chris@creativebroadcast.ae and are answered within a reasonable period.
6Security
Access to viewer data is restricted to the CBA team operating the engagement, protected by multi-factor authentication. Transport is encrypted end to end. Controls are set out in the CBA Web Platform Security Configuration Standard and the CBA Information Security and Privacy Policies, available for client review.
7Applicable law and contact
CBA handles personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Questions about this policy: Christopher James McDonnell, Creative Broadcast Agency FZE-LLC, chris@creativebroadcast.ae, +971 50 119 3723.