Policy · Privacy

Privacy policy.

Last updated · October 1, 2026

1. Introduction

Clipflow (“we”, “our”, “us”) operates the clipflow.to website and platform. This policy explains how we collect, use, and protect your personal information.

2. Information We Collect

Account data: Name, email address when you sign up.
Content data: Videos and other content you upload or import, their transcripts, and the clips and captions you create within the platform.
Usage data: Pages visited, referrer, device type, country, features used, generation counts — for product improvement. Collected with Umami without cookies; when you are signed in, these events carry your Clipflow account ID (never your name or email).
Payment data: Handled entirely by Stripe. We never store credit card numbers.

3. How We Use Your Information

To provide and improve the Clipflow platform.
To run AI generation on Clipflow’s own provider accounts on your behalf.
To send transactional emails (account verification, password resets, review notifications).
To enforce usage limits based on your subscription plan.

4. AI Processing

AI generation runs on Clipflow’s own provider accounts — you do not connect an API key. Requests are made server-side; we do not log, inspect, or store the content of AI requests or responses beyond what is necessary to display your generated outputs. The providers we use are named in section 5.

The one credential you do connect is your posting service (Upload-Post), which lets us post to your own social profiles. It is encrypted using AES-256-GCM before storage and used only for your workspace.

5. Data Sharing

We do not sell your personal data. We share data only with:

Supabase: Database and authentication hosting.
Vercel: Application hosting and page-speed measurement (Speed Insights, cookieless).
Umami: Cookieless website and product analytics, hosted in the EU — no cookies, no cross-site tracking, IP addresses are not stored.
Stripe: Payment processing.
Resend: Transactional email delivery.
OpenAI: Language generation and speech-to-text transcription — only the content you submit for generation.
Replicate: large-file transcription (WhisperX), hosted on Replicate’s own infrastructure.
AWS: Video rendering (Remotion Lambda).
Upload-Post: Delivery of finished posts to the social accounts you connect.
FirstPromoter: Partner-program attribution — only if you arrive through a partner’s link and accept cookies; see the Cookie policy.

6. Data Retention

Your content and outputs are retained as long as your account is active. You can delete individual content items at any time. If you delete your account, all associated data is permanently removed within 30 days.

7. Security

We use industry-standard security measures including HTTPS encryption in transit, AES-256-GCM encryption for connected account credentials at rest, Row Level Security (RLS) in our database, and regular security audits.

8. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to access, correct, delete, or export your personal data. Contact us at privacy@clipflow.to to exercise these rights.

9. Cookies

We use essential cookies for authentication and session management. Our analytics (Umami) sets no cookies. If you arrive through a partner’s link and accept cookies, our partner platform (FirstPromoter) sets a referral cookie so the partner is credited; a customer’s referral link sets our own referral cookie. We do not use advertising cookies. See our Cookie policy for every cookie by name.

10. Changes

We may update this policy. Significant changes will be communicated via email or in-app notification.

11. Contact

Questions? Email us at privacy@clipflow.to.