Privacy Policy

This Privacy Policy explains how Clipy, Inc. (“Clipy,” “we,” “us,” or “our”) collects, uses, discloses, retains and protects personal information when you visit our websites, create or use a Clipy account, or otherwise use the Clipy Marketplace, Clipy AI, the Clipy AI Assistant, our support channels and any related services (together, the “Services”). It also explains the choices you have and the rights you can exercise under the data protection laws that apply to you.

This policy is written to meet the transparency requirements of the EU General Data Protection Regulation (“GDPR”), the GDPR as retained in the law of the United Kingdom together with the Data Protection Act 2018 (“UK GDPR”), the EU ePrivacy rules as implemented in member-state law, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), other United States state privacy laws, Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other privacy laws around the world. Where a law gives you more protection than this policy describes, we will honour that law.

This policy should be read together with our Terms of Service, our Cookie Policy, and, where they apply to you, the Creator Guidelines, the Payout Policy, the Client Policy and the Clipy AI Terms. If anything in those documents conflicts with this policy on a question of how we handle personal information, this policy governs.

Please read this policy carefully. Using the Services does not by itself mean you consent to any processing: where we rely on your consent, we ask for it separately and specifically, and you can withdraw it at any time.

The controller responsible for your personal information is Clipy, Inc., a company incorporated in Canada. As controller, Clipy decides why and how your personal information is processed, and is responsible for doing so lawfully.

For any question about this policy or about your personal information, or to exercise any of your rights, contact us at admin@useclipy.com. For general product help you can also write to support@useclipy.com, and we will route privacy questions sent there to the right people.

Clipy has designated a privacy contact who is responsible for overseeing our compliance with this policy and with applicable data protection laws, and who can be reached at admin@useclipy.com. Please put “Privacy” in the subject line so your message reaches the right person quickly.

Clipy has assessed whether it is required to appoint a data protection officer under Article 37 of the GDPR and UK GDPR. Where the law requires us to appoint one, we will do so and publish the officer’s contact details in this section. Until then, the privacy contact above performs that role in practice.

Because Clipy is established outside the European Union and the United Kingdom, Article 27 of the GDPR and UK GDPR may require us to appoint a representative in the EU and in the UK. Where those rules require it, Clipy will appoint a representative and publish the representative’s name and contact details in this section. You may always contact us directly at the address above, whether or not a representative has been appointed.

This policy applies to personal information about:

• creators who sign up to the Clipy Marketplace, connect social media accounts, submit clips and receive payouts;
• brands, agencies and the people who work for them (owners, administrators, members and viewers of a brand workspace) who run campaigns on the Marketplace or use Clipy AI;
• buyers and sellers who use marketplace listings and deal rooms;
• people who use the Clipy AI Assistant;
• visitors to our websites, including people who book a support call without having an account;
• people who contact us, receive email from us or otherwise interact with us; and
• people whose publicly available information we obtain from third-party platforms in connection with the Services.

This policy does not apply to the practices of third parties that we do not own or control, such as social media platforms, payment processors or other websites you reach through links in the Services. Those parties have their own privacy notices, and we encourage you to read them. It also does not cover information about Clipy’s own employees and contractors in that capacity, which is covered by separate internal notices.

For almost all of the processing described in this policy, Clipy acts as a controller: we decide the purposes and means of the processing. This includes account information, Marketplace activity, payouts, security, support and analytics.

In limited cases a brand using Clipy to run its own campaigns may upload content or provide information about other people (for example, names in a brief, faces in a video, or the email address of a colleague it invites). The brand is responsible for having a lawful basis to provide that information to us and for informing those people. Where Clipy processes such information only on the brand’s instructions and for the brand’s purposes, Clipy acts as the brand’s processor, and our agreement with the brand governs that processing. Requests from those individuals may be referred to the brand concerned, and we will assist the brand in responding.

• Personal information (also called “personal data”) means any information that identifies, relates to or could reasonably be linked with an individual.
• Processing means anything done with personal information, such as collecting, storing, using, disclosing or deleting it.
• Service providers (also called “processors” or “sub-processors”) are companies that process personal information on our behalf and under our instructions, under written contracts that restrict their use of it.
• Workspace means a brand’s shared area in Clipy, which may have several members with different roles.
• Deal room means the private space in which the parties to a marketplace transaction communicate and exchange files.

We collect the information you give us directly, including:

• Account information: your name, email address, username, account type (creator or brand), password (which we store only as a one-way hash, never in readable form) and, if you choose to set it up, two-factor authentication details (we store recovery codes only in hashed form).
• Profile information: a profile picture, display name, bio and other details you choose to add.
• Brand and workspace information: the brand’s name, website and work email addresses, the names and email addresses of colleagues you invite, members’ roles and workspace settings.
• Campaign information: briefs, budgets, requirements, rules, assets and any other content you submit to set up or run a campaign.
• Contact details: including a phone number where you give us one, for example during Clipy AI brand onboarding.
• Content you submit: clips and links to clips, images, videos, captions, listings, screenshots, messages, files and other materials you upload or send through the Services.
• Communications: the content of your messages to us, support requests, feedback, survey responses and records of calls you book with us.
• Payout information: the information needed to pay you, such as the payout method you choose, a wallet address where relevant, and payout amounts. Bank details, identity documents and similar information are collected and held by our payout and identity-verification partner, not by Clipy (see section 11).

Some of this information is required to create an account or to use a particular feature. If you do not provide it, we may not be able to provide that feature to you. We tell you at the point of collection which information is required.

You can choose to sign up or sign in with an account you hold with a third-party sign-in provider instead of a password (additional sign-in options may be shown as “coming soon” before they are available). If you do, the provider shares with us, with your permission, the identifier of your account at that provider, your email address and whether the provider has verified it, your name and a link to your profile picture, together with the tokens needed to complete the sign-in. Some providers let you hide your real email address behind a relay address, in which case we receive only the relay address.

We use this information only to create, authenticate and secure your Clipy account. We link a sign-in provider to an existing Clipy account only when both the provider and Clipy have verified the same email address, and we never overwrite your Clipy profile with the provider’s data without your action. You can disconnect a sign-in provider in your security settings, subject to keeping at least one way to sign in.

To take part in campaigns, creators connect or register the social media accounts they post on. Depending on the platform and the method used, this may happen through the platform’s own authorisation flow or by giving us the public handle or link of the account and verifying that you control it.

When you connect an account through a platform’s authorisation flow, we receive the information the platform makes available under the permissions you approve, which may include your username, account identifier, profile picture, profile metadata, information about your public content and related analytics. We request only the permissions we need to verify your account and measure the performance of content you submit to campaigns.

You can disconnect a social media account in Clipy at any time. Disconnecting stops further lookups for that account. You can also revoke Clipy’s access in the settings of the platform concerned. Disconnecting an account may affect your eligibility for campaigns that depend on it and the tracking of earnings for clips already submitted.

Article 14 of the GDPR and UK GDPR requires us to tell you about personal information we obtain other than from you. We obtain the following information from third-party sources:

• Public metrics and profile information: for social media accounts that are connected to Clipy or whose content is submitted to a campaign, we collect publicly available information, such as public handles, profile and video links, platform identifiers, display names, bios, profile pictures, thumbnails, follower counts, and view, like, comment and share counts. We obtain this information directly from the social media platforms’ public interfaces and through data providers that collect public social media data on our behalf. We send these providers only the public handles, links and platform identifiers needed to look the content up.
• Sign-in providers: as described in section 7.
• Account partners: for Clipy AI, statuses, public links and post analytics for managed accounts operated on a brand’s behalf (see section 13).
• Payment processor and payout partner: payment and payout statuses, transaction identifiers and amounts, invoice and receipt links, and the outcome of identity, fraud and sanctions checks (but not the underlying identity documents).
• Other users: for example, when a brand invites you to its workspace using your email address, or when another party to a deal room refers to you.
• Calendar provider: availability slots, event identifiers and meeting links when you book a support call.

The categories of personal information involved are identifiers, public profile information, public content and engagement metrics, and transactional information. We use this information for the purposes described in section 17, primarily to verify accounts, measure campaign performance, calculate earnings and detect fraud. We keep it for the periods described in section 31. If you have not connected an account yourself but believe that we hold information about it, you can contact us to ask what we hold and to object to the processing.

When you use the Services, we and our service providers automatically collect certain information, including:

• Device and connection information: IP address, browser type and version, operating system, device type, language settings and similar technical information.
• Session and security information: the time a session started and expires, the IP address and browser used for each session, sign-in attempts, two-factor challenges, password and security-setting changes and similar security events.
• Usage information: pages and features you use, actions you take, the time and duration of your activity, and referring pages. Detailed product analytics is collected only if you allow it (see section 23).
• Error and diagnostic information: when something goes wrong, technical details of the error, such as the type of error, the page or function involved, the browser and a stack trace. Our error-monitoring set-up is configured to leave out cookies, query strings, request bodies, your email address and your IP address, and it stores nothing in your browser.
• Cookies and similar technologies: as described in section 23 and in our Cookie Policy.

When a page shows a profile picture or video thumbnail hosted by a social media platform, your browser loads that image directly from the platform, so the platform receives your IP address and browser information as it would for any image. Clipy sends those platforms nothing else about you through that process.

Brands pay for Clipy AI and certain other services through a third-party payment processor. Payment card details are entered directly into the payment processor’s form and never reach Clipy’s servers. We share with the processor the brand’s name and the owner’s email address, brand and campaign identifiers, and the line items and amounts to be charged, and we receive back transaction identifiers, statuses, amounts and links to invoices and receipts. The payment processor’s form may set its own cookies for fraud prevention, governed by its own policies.

Creators are paid through a payout and identity-verification partner. When you request a payout, we share your Clipy user identifier, email address and name, and the payout amounts and transfer references, with that partner. The partner collects and verifies the information needed for identity, fraud, sanctions and anti-money-laundering checks and to make the transfer, which may include government-issued identification, a selfie or liveness check, date of birth, address, bank account details or a wallet address. Wallet and bank details and identity documents stay with the partner; Clipy receives the status of your account and transfers, not the documents themselves. The partner’s payout window may set its own cookies, governed by its own policies.

For marketplace transactions, Clipy or its payment partner may hold a buyer’s funds in escrow to facilitate a deal, and may collect and share limited payout and identity information (such as a payout wallet address or details required for identity, fraud and anti-money-laundering checks) with that partner as required to release funds and comply with the law.

We keep records of payments, payouts, balances and ledger entries because we are legally required to keep accurate financial records and because they are needed to resolve disputes. See section 31 for how long. Further details are in our Payout Policy.

If you use the Clipy Marketplace, we collect information about the campaigns you run or join, the clips you submit (including links, captions, the account each clip was posted from and its performance), reviews and decisions on submissions, earnings and the history of your balance.

If you create a marketplace listing, we collect the information in your listing, such as the account username, platform, follower and view counts and any screenshots you upload, and the messages and files exchanged in a deal room. Deal-room communications are monitored and retained for safety, fraud prevention and dispute resolution, and are visible to the other party to the deal and to authorised Clipy staff. Do not share information in a deal room that you do not want the counterparty or Clipy to see, and never share passwords, payment credentials or identity documents there.

Clipy AI lets brands run content programmes through accounts operated on their behalf. When a brand uses Clipy AI, we collect onboarding information (including the contact person’s name, work email address and phone number), campaign settings and schedules, captions, hashtags, account usernames, bios and profile pictures chosen for managed accounts, and the images and videos the brand uploads.

Uploaded media is stored with our cloud hosting and storage providers. Uploads that are never attached to anything are deleted automatically after 24 hours. Files you delete in the app are removed from storage.

To operate managed accounts, we share with our account partners the account usernames, bios and profile pictures, captions, hashtags and posting dates, and time-limited signed links to the brand’s uploaded media (these links stop working after seven days). We receive back account, bundle and video statuses, public links to published posts and post analytics, and we store daily analytics snapshots so we can show trends. Stopping a campaign unpublishes its content from the partner’s queue. More detail is in the Clipy AI Terms.

The Clipy AI Assistant is an optional feature for brand users. When you use it, we collect and store your messages, any attachments you add (and the text extracted from them), the assistant’s replies and the actions it proposes or takes on your instructions.

To generate replies, we send your conversation, the text of your attachments and the relevant workspace and campaign context to third-party AI model providers. Where the assistant needs current information from the web, it sends search queries it writes to a search provider and receives result titles, links and snippets. Inputs and outputs are processed by these providers under contractual terms with Clipy. We select providers and configure available settings to limit how long they retain data and how they may use it, but each provider’s own retention follows its terms and the settings available for our account. Please do not include sensitive personal information about yourself or others in assistant conversations unless it is necessary.

What we send to the AI model provider is built on Clipy’s servers and limited to what the assistant needs: it leaves out email addresses, phone numbers (including the phone number in your Clipy AI onboarding information), the members of your workspace, and payment and billing records. Anything you type in a message, put in an attachment or write in the free-text fields of your workspace or Clipy AI profile is sent as written, because we cannot reliably remove names, contact details or other personal information from free text.

When the assistant reads a web page for you, Clipy’s server fetches it, not your browser, without cookies or your sign-in details, so the website sees a request from Clipy, not from you. The assistant only reads addresses you gave it or that a search returned, and it refuses private and internal network addresses.

Clipy AI setup. When you set up a new Clipy AI workspace, you paste a link to your website, your app’s store listing, or your public social media profile. Clipy’s server, not your browser, reads that public page within a few seconds, without cookies or your sign-in details, and refuses private and internal network addresses. For an app store listing, Clipy may ask the store’s public lookup service, sending only the app’s identifier and store country; for a social media profile, a social data provider reads the public profile for Clipy. Clipy downloads the logo or profile picture it finds and stores it as your workspace’s logo if you haven’t uploaded one. It is never used as a picture for the suggested accounts, which start without one.

Where the assistant is configured, Clipy then makes two short calls to the same AI model provider: one drafts your brand profile from what was read and your answers to the setup questions, the other proposes account names, display names and bios that say your brand runs the account. Otherwise, or when a call fails or takes too long, Clipy uses a fixed fallback and calls no AI model. Proposed usernames are checked against Clipy’s records and with a social data provider. Your answers, what was read and the suggested account names are saved with your workspace, and your workspace’s first Clipy AI campaign starts with those suggested accounts when you create it. Nothing is bought until an owner or admin pays.

The assistant may save short “memories” (for example, your brand’s tone of voice or a standing preference) so it can be more useful in later conversations. Memories belong to you within one workspace: your teammates do not see them, and they are not used in your other workspaces. Before a memory is saved, Clipy filters out statements that appear to concern health, religion, politics, sexuality, ethnicity, income or debt, passwords, home addresses, phone numbers, email addresses or dates of birth. The filter looks for words and patterns, so it can miss things. You can view, delete or clear your memories at any time. You can archive a conversation to hide it; conversations are deleted when you delete your account, or earlier if you ask us at admin@useclipy.com. Deleted conversations and memories are removed from Clipy’s active systems; any copy held by a provider follows the provider’s retention as described above.

AI output can be inaccurate. We do not use the assistant to make decisions about you that have legal or similarly significant effects.

When you contact support, we collect your name, email address, the content of your request, any attachments and, where relevant, the campaign, account or post your request concerns. We keep a record of our correspondence with you.

You can book a call with Clipy, including without a Clipy account. To book, we ask for your name, email address and the purpose of the call. We share your name and email address, the call time, topic and attendees with our calendar provider so the event and meeting link can be created, and we receive back availability slots, event identifiers and meeting links. Cancelling a call deletes its calendar event.

With your agreement, or where needed to resolve a problem you report, authorised Clipy staff may view the Services as they appear to you (“support viewing”). Support viewing is restricted to staff given that specific permission, who must confirm their identity again and record a reason before it starts. It is view-only: nothing can be changed in your account while it lasts. It ends when the staff member leaves it and after 30 minutes at most. Its start is recorded in our audit logs and shown in your account’s security history as “Clipy support viewed your account”. During support viewing, staff see what you would see, which can include your AI Assistant conversations and memories.

We do not intentionally collect special categories of personal data under the GDPR (such as information about racial or ethnic origin, political opinions, religious beliefs, health, sex life or sexual orientation, genetic or biometric data used to identify you), and we ask you not to provide it. Content that you choose to post or submit may incidentally reveal such information; we process it only as part of providing the Services you request.

Some information we handle is treated as “sensitive” under certain US state laws, such as account login credentials (your username or email combined with your password) and, in the hands of our payout partner, government identification numbers and financial account details. We use such information only for the purposes permitted by those laws, such as providing the Services, securing accounts, preventing fraud and complying with the law, and not to infer characteristics about you.

We use personal information to:

• create, operate and secure your account, and authenticate you when you sign in;
• provide the Marketplace, Clipy AI, the AI Assistant and our other features, including matching creators with campaigns, verifying connected accounts, tracking the performance of submitted clips and calculating earnings;
• process payments, payouts and escrow, and keep accurate financial records;
• operate managed accounts and publish content for Clipy AI brands;
• respond to support requests, schedule calls and communicate with you about the Services;
• send service messages, such as verification emails, password-reset links, invitations, security alerts, payout notices and changes to our terms;
• send marketing communications where permitted by law and in line with your choices;
• detect, investigate and prevent fraud, view inflation, engagement abuse, spam, security incidents and violations of our terms and guidelines;
• enforce our Terms of Service, Creator Guidelines and other policies;
• maintain, debug, monitor and improve the Services, including through error monitoring and, with your consent, product analytics;
• comply with legal obligations, such as tax, accounting, anti-money-laundering and sanctions rules, and respond to lawful requests from authorities; and
• establish, exercise or defend legal claims.

We do not use your personal information for targeted advertising, and we do not use content you submit to train our own general-purpose AI models.

The GDPR and UK GDPR require us to have a legal basis for each use of personal information. The list below sets out, for each main purpose, the categories of data involved, the legal basis we rely on and how long we keep the data. Section 31 gives more detail on retention.

• Creating and operating your account. Data: account, profile, sign-in provider and session information. Legal basis: performance of a contract with you (Article 6(1)(b)). Retention: for the life of your account; on deletion, removed or anonymised as described in section 32.
• Securing accounts and the Services. Data: session, device, IP address, security events, two-factor data, audit logs. Legal basis: legitimate interests in keeping accounts and the platform secure (Article 6(1)(f)), and legal obligations to secure personal data (Article 32). Retention: for the life of the account and afterwards, without your identity, for as long as needed for security and to defend claims.
• Running Marketplace campaigns and submissions. Data: campaign, submission, connected-account and public performance data. Legal basis: performance of a contract. Retention: for the life of the campaign and your account, and afterwards as needed for financial records and disputes.
• Collecting public metrics from third-party platforms. Data: public handles, profile information and engagement metrics. Legal basis: performance of a contract for creators who join campaigns; legitimate interests in verifying campaign performance and paying accurately for other public data. Retention: while the account is tracked or the clip is in a campaign, and as part of earnings records afterwards.
• Payments, payouts and escrow. Data: payment, payout, transaction, balance and ledger records; identity-check outcomes. Legal basis: performance of a contract; compliance with legal obligations (tax, accounting, anti-money-laundering, sanctions). Retention: as required by law, typically up to seven years after the transaction, kept without your name or email after account deletion.
• Marketplace listings and deal rooms. Data: listing details, messages and files. Legal basis: performance of a contract; legitimate interests in safety, fraud prevention and resolving disputes. Retention: for the duration of the deal and as long as reasonably necessary afterwards to resolve disputes and meet legal obligations.
• Clipy AI and managed accounts. Data: onboarding information, uploads, captions, account details, schedules and analytics. Legal basis: performance of a contract with the brand; for the brand’s individual representatives, legitimate interests in providing the service their organisation has contracted for. Retention: for the life of the brand’s subscription and workspace; unused uploads deleted after 24 hours; signed media links expire after seven days.
• Clipy AI setup. Data: the link you give, your setup answers, the public information read from that link and the logo or profile picture found there. Legal basis: performance of a contract (you choose to set up Clipy AI). Retention: for the life of the workspace.
• AI Assistant. Data: conversations, attachments, memories and workspace context. Legal basis: performance of a contract (you choose to use the feature). Retention: until you delete the conversation or memory, or your account.
• Support and booked calls. Data: name, email, request content, call details. Legal basis: performance of a contract for account holders; legitimate interests in answering enquiries for visitors without an account. Retention: as long as needed to resolve the request and for a reasonable period afterwards for quality and dispute purposes.
• Service emails. Data: email address, name, message content. Legal basis: performance of a contract. Retention: Clipy keeps no copy of sent emails in production; our email delivery provider keeps delivery logs for a limited period.
• Marketing emails. Data: email address, name, preferences. Legal basis: consent where required by law; otherwise legitimate interests in telling existing customers about similar services, with an opt-out in every message. Retention: until you opt out or your account is deleted; we keep a suppression record so we do not contact you again.
• Text messages and calls. Data: phone number, message history, consent records. Legal basis: consent for marketing messages; performance of a contract for account-related messages. Retention: until you withdraw consent or your account is deleted; consent and opt-out records kept as long as needed to prove compliance.
• Error monitoring. Data: technical error details, without cookies, query strings, email or IP address. Legal basis: legitimate interests in keeping the Services working. Retention: for the limited period configured with our error-monitoring provider.
• Product analytics. Data: anonymous usage events and an analytics identifier stored in your browser. Legal basis: consent (Article 6(1)(a) and ePrivacy rules). Retention: the analytics cookie lasts up to one year and is removed when you withdraw consent; event data is kept for the period configured with our product-analytics provider.
• Fraud and abuse detection. Data: submission, performance, account, device and payout data. Legal basis: legitimate interests in protecting brands, creators and Clipy from fraud; legal obligations where applicable. Retention: as long as needed to investigate and for financial and legal records.
• Legal compliance and claims. Data: any relevant information. Legal basis: legal obligation; legitimate interests in establishing, exercising or defending legal claims. Retention: as required by law or for the applicable limitation period.

Where we rely on legitimate interests, we have carried out a balancing assessment to make sure that our interests are not overridden by your interests, rights and freedoms. In summary:

• Security and fraud prevention: brands pay creators based on views and engagement, so we have a strong interest, shared by honest creators and brands, in detecting fake engagement and account takeovers. People reasonably expect a payments platform to do this. We limit the data used to what is relevant, restrict access and give you the right to human review (see section 20).
• Public performance metrics: the data is already public, is limited to accounts connected to Clipy or content submitted to campaigns, and is used for the narrow purpose of verifying and paying for campaign results. Removing an account from Clipy stops further lookups.
• Error monitoring: fixing faults benefits every user. We configure the tooling to exclude cookies, query strings, request bodies, email addresses and IP addresses.
• Answering enquiries and defending claims: these uses are expected and limited to what is necessary.

You have the right to object to processing based on legitimate interests (see section 35). You can ask us for more information about any balancing assessment by contacting us.

To protect brands and creators, we use automated systems to analyse submissions, account activity and performance data for signs of fraud, view inflation, engagement abuse, duplicate or ineligible content and other breaches of our Creator Guidelines. These systems may flag a submission or account, hold earnings pending review, or lead to a payout being withheld or reversed. This involves profiling, because it evaluates patterns associated with your account.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, unless the decision is necessary for a contract with you, authorised by law, or based on your explicit consent, and in each case with suitable safeguards. Decisions to withhold payouts, reverse earnings or suspend accounts are reviewed by a person before they become final. You have the right to obtain human review, to express your point of view and to contest the decision by contacting admin@useclipy.com or replying to the notice you receive. We will explain the main reasons for the decision, subject to not revealing information that would help others evade fraud controls.

We send service communications that are necessary to provide the Services, such as account verification, password-reset links, sign-in and security alerts, invitations, payout and billing notices, and notices about changes to our terms or this policy. You cannot opt out of these while you have an account, because they are part of the Services.

Where permitted by law, we may also send you marketing communications about Clipy products, features and events. In the EU, the UK and other places that require it, we send marketing emails only with your consent or, where the law allows, to existing customers about similar services with a clear opportunity to opt out. Every marketing email includes an unsubscribe link and identifies Clipy, Inc. as the sender with a valid postal address, as required by the US CAN-SPAM Act and Canada’s Anti-Spam Legislation. You can also opt out at any time by emailing admin@useclipy.com. We will process opt-outs promptly, and in any case within the time required by law (ten business days under CAN-SPAM).

All of our emails are sent through an email delivery provider, which receives your email address and name and the content of the message (including one-time sign-in, reset and invitation links) for the purpose of delivering it.

If you give us your phone number, for example during Clipy AI onboarding or when requesting support, we use it to communicate with you about the Services, such as appointment confirmations, service alerts, billing matters and account recovery. We will never sell your phone number or share it with third parties for their own promotional or marketing purposes.

We will send you marketing text messages, or make marketing calls using an automated telephone dialling system or an artificial or prerecorded voice, only if you have given us your prior express written consent, for example by ticking an unticked box that clearly describes those messages. Consent to marketing messages is never a condition of buying anything from us or of using the Services. Where EU or UK ePrivacy rules apply, we send marketing messages only with your prior consent or as those rules otherwise permit.

You can withdraw your consent at any time and by any reasonable means, including by replying “STOP” to any text message, by telling us during a call, or by emailing admin@useclipy.com. Reply “HELP” for assistance. Reply “START” to resubscribe after opting out. Message frequency varies. Message and data rates may apply. We keep records of your consent and any opt-out so we can honour your choices, and we will not contact you for marketing after you opt out, except to confirm the opt-out where the law allows.

We use a small number of cookies and similar browser-storage technologies. They fall into three categories:

• Strictly necessary: these keep you signed in (a session cookie lasting up to 14 days and renewed while you use Clipy), protect the sign-in process, hold a sign-in open while you enter a two-factor code, remember which brand workspace you are using, remember your analytics choice, and keep drafts safe if a page reloads. The Services cannot work without them, so they do not require consent.
• Preferences: these remember choices you make, such as light or dark theme, list or grid view, whether the sidebar is open and which Clipy product you last used. They stay in your browser and are not sent to anyone else. You can clear them under Settings → Security → Account.
• Analytics (only with your consent): if you choose “Allow” on our analytics banner, we use a product-analytics provider to understand which pages and features are used. Nothing from the analytics tool runs, is stored or is sent before you allow it. Analytics events are anonymous, are sent through Clipy’s own address without your IP address, and do not include what you type into forms. Session recording is switched off. Your choice is stored in a consent cookie and a copy in your browser's local storage for twelve months, so we don't ask again; we ask again after that, or if analytics changes in a way you should agree to again. If your browser sends a Global Privacy Control signal, we treat it as a refusal and don't show the request. You can withdraw or give consent at any time, signed in or not, under “Your choices” on our Cookie Policy page, or under Settings → Security → Account; withdrawing stops analytics and removes its stored data from your browser.

We do not use advertising or marketing cookies, and we do not load third-party advertising or tracking scripts. Our error monitoring stores nothing in your browser. Clipy does not use any third-party web-analytics service other than the opt-in product analytics described above.

The payment processor’s checkout form and the payout partner’s window, when you open them, may set their own cookies for security and fraud prevention, governed by those parties’ policies. A full, up-to-date list of every cookie and storage item we use, with its purpose and lifetime, is in our Cookie Policy.

Some browsers send a “Do Not Track” signal. Because there is no common industry standard for how to respond to it, we do not change our practices in response to Do Not Track signals alone. This makes little practical difference, because we do not track you across other websites and we do not run analytics without your consent.

We honour Global Privacy Control (“GPC”) signals as a valid request to opt out of the sale or sharing of personal information and of targeted advertising where applicable law (including the CCPA and other US state privacy laws) requires it. We do not sell or share personal information or engage in targeted advertising. When your browser sends a GPC signal, we also treat it as a refusal of optional analytics: we don't ask, and no analytics runs in that browser unless you turn it on yourself in Settings → Security → Account.

We share personal information only as described in this policy, namely:

• With service providers who process it on our behalf (section 26).
• With other users, where that is part of how the Services work (section 27).
• With third-party platforms you connect, to the extent needed to verify accounts and read public data, and with account partners for Clipy AI.
• With professional advisers, such as lawyers, accountants, auditors and insurers, under duties of confidentiality.
• For legal, safety and corporate reasons described in section 28.
• With your consent or at your direction, for example when you ask us to share information with a third party.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you, for example overall campaign statistics. Where we hold de-identified information, we maintain it in de-identified form and do not attempt to re-identify it, except to test our de-identification processes where the law allows.

We use carefully selected service providers to help us run the Services. They may only use personal information to provide services to Clipy, under written contracts that require them to protect it and, where the GDPR or UK GDPR applies, that meet the requirements of Article 28. The categories are:

• Cloud hosting and storage providers: host our application, database, backups and uploaded files. They process all categories of data held in the Services. Database backups follow the hosting provider’s rotation.
• Email delivery provider: delivers our emails; receives recipient addresses, names and message content.
• Sign-in providers: authenticate you when you choose to sign in with an account you hold with them.
• Social media platforms and social data providers: provide public profile and content metrics; receive public handles, links and platform identifiers.
• Account partners: operate managed accounts for Clipy AI brands; receive account details, captions, schedules and time-limited media links.
• Payment processor: processes payments from brands; receives brand name, owner email, identifiers and amounts.
• Payout and identity-verification partner: makes payouts to creators and performs identity, fraud and anti-money-laundering checks; receives creator identifier, email, name and payout amounts, and collects verification information directly from you.
• AI model providers: generate AI Assistant replies and draft Clipy AI setup’s brand profile and account names; receive conversations, attachment text and workspace context, and for setup, what was read from the link you gave and your setup answers.
• Search provider: returns web results for AI Assistant searches; receives search queries.
• Calendar provider: hosts booked support calls; receives the booker’s name and email, call time, topic and attendees.
• Error-monitoring provider: receives technical error reports, configured to exclude cookies, query strings, request bodies, email addresses and IP addresses.
• Product-analytics provider (only with your consent): receives anonymous usage events, relayed through Clipy without your IP address.

A current list of our sub-processors, including their names and locations, is available on request from admin@useclipy.com. Where the law requires it, we will inform business customers of changes to our sub-processors in advance.

Some information is shared with other users as part of the Services:

• Brands running a campaign can see the clips submitted to it, the social media account each clip was posted from, the creator’s public profile and username, and performance and earnings data for those clips.
• Creators can see campaign briefs and the name and public details of the brand running the campaign.
• Members of a brand workspace can see each other’s names, email addresses, roles and the activity carried out in the workspace, according to their role.
• Parties to a marketplace deal can see the listing, the messages and files exchanged in the deal room and the other party’s chosen display information.
• Content you publish to social media platforms is public under those platforms’ own terms, regardless of Clipy.

Think carefully before sharing personal information in content, listings or messages that other users can see.

We may disclose personal information where we believe in good faith that it is necessary to:

• comply with a law, regulation, court order, subpoena or other legal process, or a lawful request from a public authority, including to meet national security or law-enforcement requirements;
• enforce our Terms of Service and other agreements, or investigate potential violations;
• detect, prevent or address fraud, security or technical issues;
• protect the rights, property or safety of Clipy, our users or the public; or
• establish, exercise or defend legal claims.

Where legally permitted and appropriate, we will tell you before disclosing your information in response to a legal request so that you can seek protection. We review requests from authorities carefully and resist those we consider unlawful or excessive.

If Clipy is involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of its business or assets, personal information may be disclosed to the parties involved and transferred as part of the transaction, subject to confidentiality obligations. We will notify you of any change in the controller of your personal information and of any new choices you may have.

Clipy does not sell personal information, and has not sold personal information in the preceding twelve months. Clipy does not “share” personal information for cross-context behavioural advertising, does not process personal information for targeted advertising, and does not allow third parties to collect personal information through the Services for their own advertising purposes. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Clipy is based in Canada, and our service providers are located in several countries, including the United States, Canada and countries in the European Economic Area. Your personal information may therefore be transferred to, stored in and processed in countries other than the one where you live, whose data protection laws may differ from yours.

When we transfer personal information from the EEA, the UK or Switzerland to a country that has not been recognised as providing an adequate level of protection, we use appropriate safeguards, such as:

• adequacy decisions of the European Commission or the UK government (for example, Canada has been recognised by the European Commission as providing adequate protection for commercial organisations subject to PIPEDA);
• the European Commission’s Standard Contractual Clauses;
• for UK transfers, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses;
• for transfers to US recipients certified under the EU-US Data Privacy Framework (and its UK Extension and Swiss counterpart), that certification, where we rely on it; and
• supplementary measures where needed after assessing the laws of the destination country.

You can ask for more information about these safeguards, and for a copy of the relevant safeguard (with commercial terms removed), by contacting admin@useclipy.com.

We keep personal information only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting and reporting requirements. When deciding retention periods we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorised use, the purposes of processing and the applicable legal requirements. Specific periods include:

• Account and profile information: for as long as your account is open. On deletion, removed or anonymised as described in section 32.
• Sign-in sessions: a session lasts up to 14 days and is renewed while you use Clipy; signing out ends it immediately.
• Data exports: the file you download is available for seven days and then deleted automatically.
• Unused uploads: files uploaded but never attached to anything are deleted after 24 hours.
• Signed media links shared with account partners: expire after seven days.
• Technical logs of requests to our providers: kept for 14 days. These contain operational metadata only, not message content.
• AI Assistant conversations and memories: until you delete them (for conversations, by asking us) or your account.
• Payment, payout, balance and ledger records: as required by tax, accounting and anti-money-laundering law (typically up to seven years), without your name or email after your account is deleted.
• Security and audit records: kept as long as needed to protect the Services and defend claims, without your identity after your account is deleted.
• Deal-room messages and files: for the duration of the deal and as long as reasonably necessary afterwards to resolve disputes and prevent fraud.
• Support records: as long as needed to resolve the request and for a reasonable period afterwards. Cancelling a booked call deletes its calendar event.
• Marketing suppression lists and consent records: as long as needed to honour your choices and prove compliance.
• Analytics: your analytics choice (a cookie and a copy in browser storage) lasts twelve months, and the analytics cookie up to one year (removed when you turn analytics off).
• Backups: deleted data may remain in encrypted backups until they are overwritten in the normal backup cycle. Backups are used only for disaster recovery.

When retention ends, we delete or anonymise the information. Where that is not immediately possible (for example, because it is in backups), we isolate it from further processing until deletion is possible.

You can ask to delete your account at any time under Settings → Security → Account. For your security we ask you to confirm the request and verify your identity again. Your request then enters a 24-hour grace period, during which you can cancel it from any of your sessions; other sessions are signed out when you make the request. After the grace period your account is deleted: your profile and sign-in details are removed, and your remaining records are anonymised so that they no longer identify you. We send a final email confirming deletion.

Some things can stop deletion until they are resolved, and we will tell you what they are and how to clear them. These include:

• money in your balance, or a payout that is still being processed;
• approved clips in campaigns that are still running, until those campaigns end and earnings are paid;
• being the only owner of a workspace that has other members, until you transfer ownership; and
• a workspace that has live campaigns, an active subscription or an unfinished payment.

After deletion we keep payment, payout, ledger, security and audit records without your name or email, because the law requires us to or because we need them to prevent fraud and defend legal claims. Content you published on third-party platforms is not removed by deleting your Clipy account; you must remove it on the platform concerned. Information that other users already received (for example, deal-room messages) may remain visible to them, and records held by our payout partner or payment processor are governed by their own retention obligations.

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration and destruction, appropriate to the risk. These include measures such as:

• encryption of data in transit using TLS, and secure, HTTP-only cookies for sessions;
• storing passwords only as one-way hashes, storing two-factor recovery codes only in hashed form, and encrypting stored integration secrets such as refresh tokens at rest;
• optional two-factor authentication for all users, and mandatory two-factor authentication for Clipy staff;
• re-verification of your identity before sensitive actions such as exporting data, deleting an account or changing security settings;
• role-based access controls and the principle of least privilege, so that staff can access only the products and data their role requires;
• audit logging of sensitive and administrative actions, including support viewing;
• rate limiting, monitoring and alerts for suspicious activity; and
• contractual confidentiality and security obligations for our service providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential, using a strong and unique password, enabling two-factor authentication and telling us promptly at admin@useclipy.com if you suspect unauthorised access to your account.

We maintain procedures to detect, investigate and respond to personal data breaches. Where a breach is likely to result in a risk to people’s rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by the GDPR and UK GDPR. Where a breach is likely to result in a high risk to you, or where other laws (such as PIPEDA, US state breach notification laws or the laws of other countries) require it, we will notify you without undue delay and tell you what happened, what information was involved, what we are doing and what you can do to protect yourself. We keep a record of breaches as the law requires.

If you are in the European Economic Area, the United Kingdom or Switzerland, or the GDPR or UK GDPR otherwise applies to our processing of your data, you have the following rights, subject to conditions and exceptions in the law:

• Access: to obtain confirmation of whether we process your personal information, a copy of it, and information about how we process it.
• Rectification: to have inaccurate information corrected and incomplete information completed. You can edit most account information yourself in Settings.
• Erasure: to have your personal information deleted, for example where it is no longer needed or you withdraw consent and there is no other legal basis.
• Restriction: to ask us to limit processing while a dispute about accuracy or our legitimate interests is resolved, or in other cases set out in the law.
• Data portability: to receive information you provided to us, processed by automated means on the basis of consent or contract, in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection: to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, or need the information for legal claims. You have an absolute right to object to direct marketing, including any profiling related to it.
• Withdraw consent: where we rely on consent, to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
• Automated decisions: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human intervention, express your view and contest such a decision (see section 20).
• Complaint: to lodge a complaint with a supervisory authority (see section 37).

You can exercise many rights yourself, directly in the Services:

• Download your data: under Settings → Security → Account you can request a copy of your personal information as a machine-readable JSON file. You can request one export every 24 hours; we email you when it is ready, and the file is available to you, and only you, for seven days.
• Delete your account: under Settings → Security → Account, as described in section 32.
• Correct your information: in your profile and account settings.
• Analytics and preferences: under Settings → Security → Account you can withdraw or give analytics consent and clear stored preferences. Without signing in, you can change your analytics choice under “Your choices” on our Cookie Policy page.
• Delete some things without closing your account: creators can remove a connected social account, which deletes its stored profile details and history (clips already submitted from it stay with their campaigns); anyone can remove a sign-in method under Settings → Security, as long as another way to sign in remains; and brand users can delete or clear AI Assistant memories and remove attachments, which deletes the file and the text extracted from it.
• Marketing: using the unsubscribe link in any marketing email, or by replying “STOP” to a text message.

For any other request, or if you do not have an account, email admin@useclipy.com. We will respond within one month of receiving your request. Where a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you within the first month if we do so and why. Where other laws set different deadlines (for example 45 days under the CCPA, extendable once by 45 days, or 30 days under PIPEDA), we will meet the deadline that applies to you.

To protect your information, we need to verify your identity before acting on a request. We usually do this by asking you to make the request from your signed-in account or from the email address associated with it, and may ask for further information where necessary. We will use information provided for verification only for that purpose. Exercising your rights is free of charge, but where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, as the law allows, and we will explain why. If we decline a request, we will tell you the reason and how you can challenge our decision.

You may use an authorised agent to submit a request on your behalf where the law allows. We may require the agent to provide proof of your written authorisation and may ask you to verify your identity directly with us.

We would like the chance to address any concern you have, so please contact us first at admin@useclipy.com. However, you have the right to lodge a complaint with a data protection supervisory authority at any time.

• In the European Economic Area, you can complain to the supervisory authority in the member state where you live, where you work or where you believe an infringement took place. A list of EU authorities is published by the European Data Protection Board.
• In the United Kingdom, you can complain to the Information Commissioner’s Office (ICO).
• In Switzerland, you can complain to the Federal Data Protection and Information Commissioner.
• In Canada, you can complain to the Office of the Privacy Commissioner of Canada or, where applicable, a provincial privacy commissioner.

This section supplements this policy for California residents and describes our practices under the CCPA. Terms used here have the meanings given to them in the CCPA.

Categories of personal information we collect. In the preceding twelve months we have collected the following categories:

• Identifiers: such as name, email address, username, account identifiers, IP address and social media handles.
• Customer records (Cal. Civ. Code § 1798.80(e)): such as name, phone number and payout records. Financial account details are held by our payout partner.
• Commercial information: such as purchases, subscriptions, campaign budgets, earnings and payout history.
• Internet or other electronic network activity: such as session, security and, with consent, product-usage information.
• Audio, electronic, visual or similar information: such as images and videos you upload and records of calls where you agree to recording.
• Professional or employment-related information: such as the brand you work for and your role in its workspace.
• Inferences: limited to fraud-risk assessments used to protect the Services.
• Sensitive personal information: account login credentials. Government identifiers and financial account details are collected by our payout partner for verification.

We do not collect precise geolocation, biometric information processed to identify you, or protected-classification characteristics, except where you choose to include them in content.

Sources, purposes and recipients. We collect these categories from the sources described in sections 6 to 15, use them for the business and commercial purposes described in sections 17 and 18, and disclose them for business purposes to the categories of service providers and other recipients described in sections 25 to 28. We retain each category for the periods described in section 31.

No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted by Cal. Code Regs. tit. 11, § 7027(m). For this reason we do not offer a “Do Not Sell or Share” or “Limit the Use of My Sensitive Personal Information” link, but we honour GPC signals as described in section 24.

Your rights. Subject to exceptions in the law, California residents have the right to:

• know what personal information we have collected about them, including the categories and specific pieces of information, the sources, the purposes and the categories of third parties to whom we disclose it;
• delete personal information we have collected from them;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (although we do not sell or share it);
• limit the use and disclosure of sensitive personal information (although we use it only for permitted purposes); and
• not receive discriminatory treatment for exercising these rights.

To exercise your rights, use the in-app tools described in section 36 or email admin@useclipy.com. We will confirm receipt within ten business days and respond within 45 days, which we may extend once by a further 45 days with notice. We verify requests as described in section 36; for requests for specific pieces of information we apply a higher standard of verification. You may use an authorised agent, who must provide signed permission from you, and we may ask you to verify your identity directly. We will not deny you services, charge you different prices or provide a different quality of service because you exercised your rights.

Shine the Light. California Civil Code § 1798.83 lets California residents ask for information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Residents of other US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, may have some or all of the following rights, depending on the state and subject to exceptions:

• to confirm whether we process their personal data and to access it;
• to correct inaccuracies;
• to delete personal data;
• to obtain a portable copy of personal data;
• to opt out of targeted advertising, the sale of personal data and profiling in furtherance of decisions that produce legal or similarly significant effects;
• where required, to obtain a list of the specific third parties to which personal data has been disclosed; and
• to appeal our decision on a request.

We do not sell personal data, process it for targeted advertising or use it for profiling in furtherance of solely automated decisions with legal or similarly significant effects. We process sensitive data only with consent where those laws require it, or as otherwise permitted. To make a request, use the in-app tools or email admin@useclipy.com. We will respond within 45 days, which may be extended by a further 45 days where reasonably necessary. If we decline your request, you may appeal by replying to our decision with the word “Appeal”; we will respond to your appeal within the time required by law (usually 45 or 60 days), and if you are not satisfied you may contact your state attorney general.

Nevada law allows Nevada residents to opt out of the sale of certain covered information. We do not sell covered information as defined by Nevada law. If you are a Nevada resident and wish to submit a request, you may email admin@useclipy.com and we will record it.

Clipy is incorporated in Canada and complies with PIPEDA and, where they apply, provincial private-sector privacy laws such as those of Quebec, Alberta and British Columbia. We obtain consent appropriate to the sensitivity of the information, which may be express or implied, and you may withdraw consent subject to legal or contractual restrictions and reasonable notice. You have the right to access and to request correction of your personal information. Information may be processed outside Canada by our service providers, where it may be accessible to the courts, law-enforcement and national security authorities of those countries. Our privacy contact (section 2) is accountable for our compliance. You can complain to the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner.

If you are in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, also gives you the right to:

• receive computerised personal information you provided to us in a structured, commonly used technological format, or have it sent to a person or organisation you choose;
• be told when a decision about you is made exclusively by automated processing, be told the personal information and the main factors used to make it, have it corrected, and submit observations to a person at Clipy who can review the decision (see section 20);
• ask us to stop disseminating your personal information, or to de-index a hyperlink attached to your name, in the circumstances the law provides; and
• be told whether we use technology that can identify, locate or profile you, and how to turn it off. Clipy does not locate you. The AI Assistant’s memories note your campaign preferences, and you can delete or clear them at any time (section 14); optional analytics is off unless you allow it (section 23).

You can make these requests, and any access or correction request, in writing to our privacy contact (section 2). We answer within 30 days of receiving a request. If you are not satisfied with our answer, you can complain to the Commission d’accès à l’information du Québec.

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you rights including confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about the entities with which we share data, information about the possibility of refusing consent and its consequences, and withdrawal of consent. We rely on the legal bases in the LGPD that correspond to those described in section 18. You can exercise your rights by contacting us, and you may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

If you are in Australia, we handle your personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to and correction of your personal information. Some of your information may be disclosed to service providers located overseas, including in the United States, Canada and Europe, as described in section 30. If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

If you are in India, we process your digital personal data in accordance with the Digital Personal Data Protection Act, 2023 and its rules as they come into force. Where we rely on consent, we ask for it in clear terms and you may withdraw it as easily as you gave it. You have rights to information about processing, correction, completion, updating and erasure, grievance redressal and nomination. You can raise a grievance with our privacy contact at admin@useclipy.com and, if you are not satisfied, approach the Data Protection Board of India.

If you live in another country with data protection laws, you may have rights similar to those described in this policy. We will respond to requests in line with the law that applies to you. Please contact us at admin@useclipy.com to exercise them.

The Services are intended only for people aged 18 or over, and you must be at least 18 to create an account. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 18, including from children under 13 within the meaning of the US Children’s Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from someone under 18, we will delete it and close the account. If you believe a minor has provided us with personal information, please contact admin@useclipy.com.

The Services contain links to, and integrations with, third-party websites and services, such as social media platforms, the payment processor’s checkout and the payout partner’s window. When you use them, the third party collects information under its own privacy policy, and we are not responsible for its practices. We encourage you to review the privacy policies of any third-party services you use.

We may update this policy from time to time to reflect changes in our practices, the Services or the law. We will post the updated policy on this page and change the “Last updated” date above. If we make material changes, we will notify you in advance by email or through a notice in the Services. Where a change requires your consent under applicable law, we will ask for it. We encourage you to review this policy regularly. Previous versions are available on request.

If you have any questions, concerns or requests about this policy or our handling of your personal information, contact:

Clipy, Inc. — Privacy

Email: admin@useclipy.com

Support: support@useclipy.com

Related documents: Terms of Service, Cookie Policy, Creator Guidelines, Payout Policy, Client Policy and Clipy AI Terms.