Privacy Policy

ClipFlux (“we”, “us”) operates the ClipFlux service and is the controller of the personal data described in this policy. This policy explains what we collect, why, on what legal basis, and the rights you have.

For any privacy question or request, contact team@clipflux.ai.

• Account data: your email address, your sign-in credentials or the identity supplied by your chosen sign-in provider, and when the account was created.
• Content and usage data: the topics, briefs and settings you submit, the videos and assets generated from them, your credit balance and transaction history, and records of generation activity.
• Billing data: your subscription and payment status. Card details are entered directly with our payment provider; we never receive or store full card numbers.
• Connected accounts: if you link TikTok, Instagram or YouTube, the account identifier, display name and avatar for that account, plus the access credentials needed to carry out the actions you request. Credentials are encrypted and are never exposed to your browser.
• Technical and security data: limited server logs (including IP address, browser user-agent and the page or endpoint requested) used to operate, secure and debug the Service. Logs are filtered to exclude your prompts and credentials.
• Abuse-prevention signals: at signup we record technical characteristics of your connection and browser configuration. We keep these only in irreversible hashed form, and use them for a single purpose: detecting people creating accounts in bulk to farm free credits. They are not used for advertising, not used to track you across other websites, not used to build a profile, and not shared.
• Advertising measurement: if you accept optional cookies, the Meta (Facebook) advertising pixel records that a browser visited ClipFlux and whether it went on to create an account, so we can measure whether our ads work.
• Referral data: if you arrive through an affiliate link and accept optional cookies, we record which affiliate referred you so their commission can be paid, and share the referred account's email address with our affiliate platform for that purpose only.

We rely on the following legal bases under Article 6 GDPR:

• To provide the Service — authenticating you, generating videos, publishing on your behalf when you ask, and showing your results. Basis: performance of our contract with you.
• To take payment and manage subscriptions. Basis: performance of our contract with you.
• To keep the Service secure and available — debugging, monitoring, rate limiting, and preventing fraud and abuse of free credits. Basis: our legitimate interests in running a secure, reliable service and in not having free credits farmed at our expense.
• To send service messages about your account, billing or security. Basis: performance of our contract with you.
• To measure advertising and attribute referrals. Basis: your consent, given through the cookie banner and withdrawable at any time.
• To meet accounting, tax and other legal duties. Basis: compliance with a legal obligation.

We do not sell your personal data, and we do not use your prompts or generated videos to train AI models.

We share the minimum necessary with service providers acting on our instructions, in these categories:

• Cloud infrastructure providers — hosting, database, authentication and file storage.
• AI model providers — the text, image, video and speech services that generate what you request. The inputs you submit for a given step are sent to the provider performing it.
• Payment provider — to process payments and manage subscriptions.
• Operational tooling providers — error monitoring, background job processing and abuse protection.
• Affiliate platform — referral attribution and commission payment, where applicable.
• Meta (Facebook) — advertising measurement, only if you accept optional cookies.
• TikTok, Instagram and YouTube — only for accounts you choose to connect, and only for the actions you trigger.

We may also disclose data where required by law, or to establish or defend legal claims. You can request a current list of the specific providers we use by contacting us.

Strictly necessary, always on. Your sign-in session and a record of the cookie choice you made. Without these you cannot stay signed in, and we would have to ask about cookies on every page. These do not require consent.

Optional, off until you accept. The Meta advertising pixel, the affiliate referral cookie, and a record in your browser's local storage of which campaign or link brought you here. None of these load unless you choose Accept. Choosing Reject means they are never requested, not that they load and are ignored.

You can change or withdraw your choice at any time using Cookie settings in the site footer. Withdrawing consent does not affect processing carried out before you withdrew it.

Access credentials for connected accounts are encrypted, are used only to carry out an action you requested, such as publishing a video or showing your own analytics, and are never sent to your browser. Disconnecting an account revokes our access at the platform immediately.

ClipFlux uses YouTube API Services to publish videos to your channel and to show you how they performed. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy.

What we access. Nothing until you explicitly connect a channel. After that, exactly three things:

• Your channel's ID, title and avatar, read once when you connect, so we know where to publish and you can tell your connected channels apart.
• Upload access, used only when you press Publish on a specific video. We upload that one file with the title and description you entered. We never modify or delete videos already on your channel.
• View, like and comment counts for videos ClipFlux itself uploaded, so we can show performance in the app. We do not read data about any other video on your channel.

What we store. The channel ID, title and avatar URL, and the IDs of videos we uploaded for you. View, like and comment counts are not stored: we request them from YouTube while you have the performance view open, show them to you, and keep nothing afterwards.

How to revoke. Disconnect the channel inside ClipFlux and we revoke our access with Google immediately. You can also revoke ClipFlux's access at any time from Google's security settings. Either way, stored YouTube data is deleted on request by emailing team@clipflux.ai, and automatically when you delete your ClipFlux account.

Our providers are located primarily in the European Union and the United States. One AI provider used for certain text planning steps is located in China, which is not covered by an EU adequacy decision; text you submit for those steps, such as a topic or brief, is processed there. That transfer is made under the European Commission's Standard Contractual Clauses. Transfers to the United States rely on an adequacy decision or, where it does not apply, on Standard Contractual Clauses. You can request a copy of the safeguards we rely on by contacting us.

• Account, billing and usage records: while your account is active, and for up to 2 years afterwards for accounting and abuse-prevention purposes. Records needed for statutory accounting are kept for the period the law requires.
• Generated videos and assets: while your account is active. Deleting your account removes them.
• Technical and security logs: 30 to 90 days.

Subject to the conditions in the GDPR, you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we process it, to receive it in a portable format, and, where processing is based on consent, to withdraw that consent at any time.

To exercise any of these rights, email team@clipflux.ai. Deletion requests are currently handled by email. We respond within one month, subject to the retention periods above.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have handled your data unlawfully.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Automated checks may withhold or delay promotional free credits where signup activity looks like bulk account creation; this does not affect paid access, and you can ask us to review any such decision by contacting us.

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest for credentials, access controls based on least privilege, and separation of customer data. No system is perfectly secure; please use a strong unique password and keep your devices up to date.

The Service is not intended for children under 13 (under 16 in the EEA / UK). We do not knowingly collect data from children.

We may update this Privacy Policy. Material changes will be announced by email or in-app notice. The “Last updated” date above reflects the current version.

Privacy questions or requests: team@clipflux.ai