Effective date: August 17, 2026
This policy applies specifically to Cloud Recording Exporter. It does not automatically apply to other Nimbus Whale Labs products.
Information we process
After a Zoom user authorizes the app, we may process Zoom OAuth access and refresh tokens, Zoom account and user identifiers, granted scopes, meeting and recording identifiers, recording metadata, file types and sizes, transcript readiness, webhook event metadata, and destination configuration required to perform the requested export.
When an export is enabled, recording and transcript content is processed for delivery to the storage destination selected by the user. Support communications may include the sender’s email address, issue description, and related diagnostic information.
How information is used
We use this information only to authenticate with Zoom, detect completed recordings and transcripts, transfer selected files, verify export results, provide operational support, prevent abuse, and comply with valid legal obligations. We do not sell personal information or use Zoom data for advertising, profiling, or training general-purpose AI models.
Sharing and subprocessors
Data is transmitted to Zoom and to the destination provider selected by the user, such as Google Drive, Amazon Web Services, or Microsoft Azure. We may use infrastructure providers necessary to host and secure the service. We do not disclose recording content to unrelated third parties.
Retention
OAuth tokens and operational installation metadata are retained while the app remains authorized. Sanitized event and export metadata may be retained while needed to operate, troubleshoot, and reconcile the authorized workflow. Cloud Recording Exporter is designed to stream recording content to the chosen destination rather than keep a separate content archive.
When Zoom confirms deauthorization, the matching Zoom access and refresh tokens are deleted and future exports stop. Files already transferred remain in the user-controlled destination. Support requests are normally deleted within 30 days after resolution unless longer retention is required for security or legal reasons.
Security
Zoom token sets are encrypted at rest using AES-256-GCM, private runtime files are restricted to the service account, traffic uses HTTPS, webhook signatures and timestamps are verified, and raw OAuth tokens and recording download URLs are excluded from event logs. See the Security Overview.
Your choices
You can revoke Cloud Recording Exporter from Zoom Marketplace, disconnect destination access, request deletion of associated service metadata, or ask for access and correction where applicable. Destination files must be managed through the destination provider.
Contact
Privacy requests may be sent to [email protected]. Do not include OAuth tokens, client secrets, webhook secrets, recording passcodes, or cloud-provider credentials.