Privacy Policy

ClipFlux (“we”, “us”) operates the ClipFlux service. This Privacy Policy explains what personal data we collect, how we use it, and the choices you have.

• Account data: email address, hashed password or OAuth identity (Google sign-in), account creation timestamp.
• Usage data: topics you submit, videos you generate, credits used, generation logs, error reports.
• Billing data: handled by Stripe. We never see or store full card numbers; we receive a customer id and subscription status.
• Connected social accounts: when you link TikTok, Instagram, or YouTube, we store the platform user id, display name, avatar URL, and OAuth tokens (encrypted at rest with AES-256-GCM).
• Operational logs: server-side request logs (IP, user-agent, route) for security and debugging. Logs are redacted to remove prompts, user inputs, and tokens.
• Affiliate referral data: if you arrive via an affiliate link, a first-party cookie (60 days) records which affiliate referred you so we can pay their commission. We store the referral identifier alongside your account. If you sign up through a referral, your email is shared with our affiliate platform (Rewardful) solely for commission attribution.

• To provide the Service: authenticate you, generate videos, post on your behalf when you ask, show your analytics.
• To bill you and prevent fraud.
• To debug, monitor, and improve reliability.
• To enforce our Terms of Service and applicable law.
• To send transactional email (account, billing, security).

We do not sell your personal data. We do not use your generated videos or prompts to train AI models.

We share the minimum necessary data with vetted processors:

• Supabase — database, authentication, file storage.
• Stripe — payment processing.
• Anthropic, fal.ai, Kie.ai, Replicate, ElevenLabs, DeepSeek — AI generation. Inputs you submit (topic, refinements) are sent to the relevant provider to generate the requested asset.
• Inngest — background job orchestration.
• Vercel — application hosting.
• Sentry — error monitoring.
• Upstash — rate limiting.
• Rewardful — affiliate referral tracking and commission attribution (referral cookie + email of referred signups).
• TikTok, Instagram, YouTube — only when you explicitly connect an account, and only the data needed for the actions you trigger.

OAuth tokens for connected accounts are encrypted at rest and decrypted only on the server when fulfilling an action you requested (publish a video, read your own analytics). Tokens are never sent to the browser. Disconnecting an account from /settings/connections revokes the token at the platform and archives the local row immediately.

• Account, billing, and usage records: retained while your account is active and for up to 2 years after deletion for accounting and abuse-prevention purposes.
• Generated videos and assets: retained while your account is active. Deleting your account removes them.
• Operational logs: 30–90 days.

Depending on your location, you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, email team@clipflux.ai. You can also delete your account directly from /settings, which removes your data subject to the retention windows above.

Our processors operate in the United States and the European Union. Where required, transfers rely on standard contractual clauses or equivalent safeguards.

We use TLS in transit, encrypt OAuth tokens at rest, scope database access via row-level security, and follow the principle of least privilege for service credentials. No system is perfectly secure; please use a strong unique password and keep your devices up to date.

The Service is not intended for children under 13 (under 16 in the EEA / UK). We do not knowingly collect data from children.

We may update this Privacy Policy. Material changes will be announced via email or in-app notice. The “Last updated” date at the top reflects the current version.

Privacy questions or requests: team@clipflux.ai