Privacy Policy

1. Who we are (data controller)

Clipway is an online service that lets you create and automatically publish short videos. For the personal data described in this policy, Clipway acts as the data controller, meaning we determine why and how your data is processed. References to "Clipway", "we", "us" or "our" mean the publisher operating the clipway.co service. For any privacy-related question, or to exercise your rights, you can contact us at support@clipway.co.

2. Data we collect

We collect the following categories of personal data: • Account data: email address, first name, last name, and password (stored hashed). • Usage data: history of generated videos, series and content preferences, credit consumption, subscription details, language preferences. • Billing data: subscription and purchase information, processed by our payment provider Whop. We do not store your full card details. • Social account data: when you connect a YouTube or TikTok account, the OAuth access and refresh tokens, your account or channel identifier and name, and the publishing status of your uploads. • Technical data: IP address, browser and device information, and — subject to your consent — marketing-attribution identifiers (see Sections 4 and 5). No biometric data is collected.

3. How we use your data

We use your data to: create and authenticate your account, generate your videos, publish content to your connected social accounts at your request, manage your subscriptions and credits, send you transactional notifications, provide customer support, measure and improve our service and marketing, and comply with our legal obligations. Depending on the purpose, our legal basis is the performance of our contract with you, your consent (in particular for marketing cookies and measurement), our legitimate interest in operating and improving the service, or compliance with a legal obligation. We never sell your personal data.

4. Cookies and tracking technologies

We use essential cookies to keep you signed in and remember your preferences; these do not require consent. With your consent, we also use measurement and advertising technologies from Meta (Facebook) and TikTok to understand how our marketing performs. When you opt in, these tools may receive technical identifiers and a hashed (irreversible) version of your email address so that conversions can be measured. No such tool is loaded and no data is sent before you opt in, and you can withdraw your consent at any time. We do not set third-party advertising cookies without your consent.

5. Who we share your data with

We do not sell your personal data, and we do not share it with third parties except in the limited cases below. The providers we rely on act on our behalf as processors, under contracts that require them to protect your data and use it only for the services they provide to us: • Hosting and infrastructure: Vercel (website) and Hetzner (application servers, located in Germany). • Database: Supabase, hosted in the European Union (AWS eu-central-1), where your account data and your encrypted social tokens are stored. • Payments: Whop. • Transactional email: Resend. • AI content generation: OpenAI, ElevenLabs, Replicate, KIE.ai and FAL, which process the content parameters needed to generate your videos. • Marketing measurement (only with your consent): Meta (Facebook) and TikTok, which receive technical identifiers and a hashed email address for advertising measurement (see Section 4). • Amplitude, Inc. (product analytics and audience measurement — usage events, internal account identifier, session recordings with masked fields; hosted in the European Union; enabled only with your consent) • Social platforms, at your direction: when you choose to publish, your video and the metadata you provide are sent to YouTube (Google) and/or TikTok. • Legal authorities: where we are required to do so by law or to respond to valid legal process. Important: the Google/YouTube data described in Section 7 is shared only with our hosting and database providers (Hetzner and Supabase) in order to operate the service. It is never shared with Meta, TikTok, our AI providers, or any advertising partner.

6. International data transfers

Your account data and your Google/YouTube tokens are stored in the European Union (Supabase, AWS eu-central-1) and processed on servers located in Germany (Hetzner). Some of our other providers (such as Whop, Resend, Meta, TikTok and our AI providers) may process data outside the European Economic Area, in particular in the United States. Where that is the case, the transfer is governed by appropriate safeguards such as the European Commission's Standard Contractual Clauses. Your Google/YouTube user data is not transferred outside the European Union.

7. YouTube / Google data

When you connect your YouTube account, Clipway uses the YouTube Data API to upload the videos you create to your own channel and to display your channel name and the publishing status of your uploads. The Google user data we access is limited to: your YouTube channel identifier and name, the publishing status of your uploads, and the OAuth access and refresh tokens needed to perform these actions on your behalf. We use this data only to provide the features described above. We do not use Google user data for advertising, we do not use it to develop, improve or train any AI or machine-learning model, and we never sell it. We do not transfer Google user data to any third party other than the hosting and database providers that operate our service on our behalf (see Sections 5 and 6). Clipway's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Our use of the YouTube API Services is also subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). You can revoke Clipway's access at any time at https://myaccount.google.com/permissions, or by disconnecting the account in your Clipway settings, which deletes the stored tokens. The OAuth tokens we receive are sensitive data and are stored encrypted as described in Section 8.

8. Data security and protection

The security of your data — especially sensitive data such as your login credentials and Google/YouTube OAuth access tokens — is a priority. The following measures are in place to protect the confidentiality, integrity and availability of your data: • Encryption in transit: all communication between your browser, our servers and third-party APIs (including the Google/YouTube APIs) is encrypted using HTTPS/TLS. • Encryption at rest: sensitive data, in particular Google/YouTube OAuth access and refresh tokens, is encrypted (AES-256) before being stored. • Access control: data access follows the principle of least privilege; each user can only access their own data through strict server-side authorization checks, and video files are only accessible through time-limited signed URLs. • Secure hosting: your data is hosted with reputable infrastructure providers that apply industry-standard security measures. If a data breach is likely to result in a risk to your rights and freedoms, we will notify the competent authority and, where required, you, in accordance with applicable law. Google user data obtained through the APIs is protected by these same measures and is used only to provide the features described in Section 7.

9. Data retention

We keep your personal data only as long as necessary for the purposes described in this policy: • Account data: until you delete your account or after a prolonged period of inactivity. • Google/YouTube and TikTok tokens: until you disconnect the account or revoke access, after which they are deleted. • Billing data: for the period required by applicable tax and accounting law. • Generated videos and usage data: for the duration of your account, then deleted or anonymized. • Marketing-measurement data: until you withdraw consent or after the applicable retention period. Your personal data is deleted on request or when you close your account, except where we must retain certain records to comply with a legal obligation.

10. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and object to the processing of your personal data, as well as the right to data portability and the right to withdraw your consent at any time. To exercise these rights, contact us at support@clipway.co; we respond within 30 days. You may also lodge a complaint with your local data protection authority (in France, the CNIL).

11. Minimum age and changes to this policy

Clipway is not intended for children. You must be at least 16 years old (or the age of digital consent in your country) to use the service. We may update this policy from time to time; significant changes will be communicated through the service or by email, and the "last updated" date above will be revised.