Technical data protection and privacy policy.

Effective Date

This privacy policy took effect on 2026-10-30. It governs all technical data intake, telemetry logging, and communication protocols executed on brightcoveos.com.

Data Controller Identity

The operator and data controller for this site is Brightcoveos, trading at brightcoveos.com. Our physical operations are based at 224 Southwest 1st Avenue, Portland, Oregon 97204, Portland, Oregon, United States.

Inquiries regarding corporate governance, data handling, or technical architecture should be directed to our Portland office via email at [email protected] or telephone at +1 (910) 555-9758.

Data Collected Through Site Systems

BrightcoveOS collects only the minimum technical information required to execute streaming consultations and evaluate platform health. We record:

• Inquiry Parameters (fuwod9c.php): Name, telephone number, email address, operating domain/address, service engagement category, technical scope notes, current player specifications, and affirmative consent confirmation.
• Automated Request Metadata: The visitor’s IP address, browser user-agent string, referring URL, time of page rendering, and exact time of submission.
• Support Chat System (pigiadb.php): Dialogue transcripts and a randomized session authentication token persisted in the browser’s localStorage.
• Storage & Consent State: The visitor’s consent decision recorded under the browser key site_consent_v2.
• Advertising Campaign Parameters: URL click identifiers passed during paid acquisition campaigns, including gclid, msclkid, and fbclid.

We do not create visitor accounts, maintain passwords, or process credit card payments on this website. Our catalog is inquiry-only and conducts no retail commerce.

Purposes of Processing

Data recorded through our site is processed strictly for the following technical and operational purposes:

• To review incoming video integration requirements and return architectural assessments or hourly quotes ($125–$200/hr, $3,000/mo retainer, or $20,000 turnkey projects).
• To conduct live engineering dispatch communications via the support chat interface.
• To monitor web infrastructure uptime, mitigate automated denial-of-service attempts, and debug form submission errors.
• To evaluate advertising campaign effectiveness on Google Ads, Microsoft Advertising, and Meta Ads in accordance with user consent.

Legal Bases for Processing

We process personal and technical data under explicit legal bases defined by applicable data privacy frameworks:

• Consent: Storing client-side cookies or browser storage keys, initializing advertising measurement tags, and running non-essential telemetry. Consent is freely given and revocable at any time.
• Contractual & Pre-Contractual Steps: Processing inquiry form submissions and technical specifications to evaluate feasibility, estimate engineering hours, and formulate service quotes.
• Legitimate Interests: Maintaining server security logs, defending network infrastructure against malicious bots, and routing support chat requests.

Advertising Platforms & Click Tracking

This website receives active, paid commercial traffic from Google Ads, Microsoft Advertising, and Meta Ads. When a visitor arrives via a sponsored campaign, the destination URL attaches specific click tracking parameters:

• gclid attached by Google Ads to measure campaign routing and conversion efficiency.
• msclkid attached by Microsoft Advertising to attribute search queries.
• fbclid attached by Meta Ads where sponsored distribution is active.

We process these parameters in real time without storing unconsented tracking profiles. No advertising platform has reviewed, endorsed, or approved the technical services described on this website.

Consent Mode v2 Framework

To ensure strict regulatory compliance, brightcoveos.com implements Google Consent Mode v2. Upon initial page load, the following four consent states are held denied by default:

• ad_storage: denied
• ad_user_data: denied
• ad_personalization: denied
• analytics_storage: denied

These signals remain denied until the visitor explicitly clicks “Allow Storage” on our consent interface. If the visitor clicks “Decline Storage”, or subsequently withdraws permission via our footer controls, all four parameters are immediately set back to denied, preventing the transmission of advertising or persistent analytics identifiers.

Third-Party Data Processors

We disclose data to a restricted group of technical service providers who support our studio operations:

• Google Ireland Ltd / Google LLC: Operates Google Ads and Consent Mode infrastructure, receiving consent state pings and gclid conversion attribution if permitted.
• Microsoft Ireland Operations Ltd: Operates Microsoft Advertising and receives msclkid attribution if consented. Microsoft processes personal data in accordance with its published policies; review the Microsoft privacy statement at https://privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd: Operates Meta Ads for cross-platform sponsored attribution when enabled.
• Infrastructure Hosting Provider: Provides server computing environments, executes fuwod9c.php and pigiadb.php, and maintains protected log volumes.
• Mail Transport Relay: Relays contact form notifications securely from our server to [email protected].

International Data Transfers

Data collected through brightcoveos.com is hosted on secure servers in the United States. Where visitors access this site from the European Economic Area, the United Kingdom, or Switzerland, personal data is transferred to the United States on the basis of adequacy decisions, Standard Contractual Clauses (SCCs) executed with our service providers, or the explicit consent provided when initiating pre-contractual inquiries.

Definitive Retention Schedules

We do not keep personal or technical records indefinitely. We operate under strict retention windows:

• Project Inquiries & Email Copies: Retained for exactly 36 months to reference prior scoping discussions, after which records are purged.
• Support Chat Transcripts: Retained for exactly 18 months in server storage before deletion.
• Web Server & Access Logs: Retained for exactly 30 days before rotation and irreversible destruction.
• Consent Decision Records (site_consent_v2): Stored client-side for exactly 6 months before prompting for confirmation.

Technical Security Measures

We apply production engineering controls across our web properties. All web traffic is strictly encrypted over TLS 1.3 using valid certificates. Inquiries sent to fuwod9c.php are verified against honeypot traps (branch, weblink) and timestamp deltas. Direct server access is restricted through multi-factor authentication, and raw database stores are isolated from public web directories.

European Visitor Rights (GDPR)

Visitors accessing our website from the European Union or United Kingdom possess comprehensive rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a complete export of all personal data held concerning your organization.
• Right to Rectification: Request correction of inaccurate contact or project records.
• Right to Erasure: Request permanent deletion of inquiry transcripts and contact logs.
• Right to Restrict Processing: Request suspension of data handling during verification disputes.
• Right to Data Portability: Receive submitted engineering specifications in a structured, machine-readable format.
• Right to Object: Object to processing justified under legitimate interests.
• Right to Withdraw Consent: Revoke consent for tracking or cookies at any time without penalty.

United States Privacy Rights & California (CCPA/CPRA)

Under United States state privacy statutes—including the California Consumer Privacy Act (CCPA) as amended by the CPRA, and comparable regulations in Colorado, Connecticut, Utah, and Virginia—consumers have defined statutory protections:

• The right to know what personal information is collected, disclosed, or retained.
• The right to delete personal information collected from the consumer.
• The right to correct inaccurate personal information.
• The right to non-discrimination for exercising statutory privacy rights.

BrightcoveOS does not sell or share personal information for monetary consideration. In the preceding 12 months, we have neither sold nor shared personal information of any consumer.

Global Privacy Control (GPC)

We respect automated browser signals. If your browser broadcasts the Global Privacy Control (Sec-GPC) header, our site automatically treats this as a valid opt-out request for advertising tracking and storage, suppressing non-essential tracking without requiring secondary manual prompts.

Children’s Privacy Protection

BrightcoveOS is a commercial engineering service intended strictly for adult business operators, software engineers, and IT directors. We do not knowingly solicit, record, or retain information from individuals under the age of 18. If we discover an inquiry originating from a minor, the record is immediately purged from our database.

Regulatory Complaints Authority

If you believe our processing of your personal information violates applicable laws, you retain the right to lodge a formal complaint with an authorized supervisory authority:

• In the United States: Your state Attorney General’s consumer protection division, or the California Privacy Protection Agency (CPPA) for California residents.
• In the European Union: The national Data Protection Authority (DPA) of your member state of residence.
• In the United Kingdom: The Information Commissioner’s Office (ICO).

Data Subject Access Request Procedure

To exercise your rights of access, rectification, or erasure under GDPR, CCPA, or other state frameworks, submit a formal request to our Portland engineering office. All requests are logged, verified, and answered within 14 days of receipt at zero charge.

Policy Changes & Version History

We update this policy whenever operational workflows, advertising network integrations, or statutory frameworks evolve. When revisions occur, the effective date at the top of this document is refreshed, and substantial changes are noted directly in the policy ledger.

Engineering Compliance Contact

For questions regarding our privacy protocol, Consent Mode v2 implementation, or telemetry architecture, contact our technical desk directly: