Privacy Policy

About this notice

Approved and effective 12 October 2026. This notice is for the current Clipely account, planning, support and qualified paid-production service on clipely.app, dashboard.clipely.app and api.clipely.app. A feature receives data only when actually enabled. This notice replaces historical reference claims with the supplied operator facts and the source-derived processing description.

Operator and contact

Stanislaw Tomaszewski, Szeligowska 25, 01-320 Warsaw, Poland, operates Clipely as an individual in Poland and is the controller for the processing described here. The United States is the primary customer market; this does not establish worldwide eligibility or exclude other countries automatically. Contact hello@clipely.app about support or privacy requests, or write to this postal address. This notice does not describe the operator as an incorporated company or assert a VAT registration. Privacy enquiries use the contact above.

Information and purposes

Account email, identity, membership, authentication and session records provide sign-in and workspace access. Supabase Auth handles password credentials. Workspace/channel names, creative briefs, niche/style settings, reference inputs, saved quotes, scripts, review decisions, media and delivery records provide the selected production service. Approval/payment/rights evidence binds the exact order and output. Support messages and replies answer requests. Stripe billing identifiers, invoice/payment/subscription status and limited payment metadata administer purchases; full card number and CVC are submitted to Stripe, not stored by Clipely. Request, error and abuse-prevention records protect the service.

The bases are contractual necessity for requested account/production/billing support; legal obligation for records required by a specified applicable law; and legitimate interests for proportionate security and fraud prevention subject to assessment. Optional marketing requires a separate lawful basis and choice. A sale or OAuth permission does not provide consent for unrelated marketing, portfolio use or model training.

Browser storage can retain the authentication session and builder drafts/preferences. Clearing site storage can sign you out or remove a draft. Any optional analytics or advertising processing requires its own accurate disclosure and applicable choice; this notice does not claim that Vercel Analytics is installed.

Recipients and locations

Source integrations include Cloudflare for web/API infrastructure and private file storage; Supabase for database/authentication; Stripe for billing; Resend for email; and Google/Gmail for the support inbox. Production adapters include OpenAI for text/images, ElevenLabs for speech and fal for the separately controlled generated-media path. Rendering/storage infrastructure processes the media needed to produce and deliver files. An adapter in source does not establish that every provider is active for every order. The provider and any applicable licence or data-transfer restrictions for an enabled path must be established before that path processes your information. You may request information about the applicable recipients and safeguards at hello@clipely.app. A US database location does not establish US operator residence or that all processing stays there. The relevant provider terms and safeguards govern their processing; Clipely does not claim that every provider has identical retention, training or location controls.

Do not submit sensitive personal data, private information about others, unauthorized recordings or unlicensed materials. A separately disclosed public-source generation path uses only approved public-safe inputs; it must exclude private briefs, personal information and customer uploads. That generated source may be publicly accessible at its provider. Customer final files require private customer access. Manual downloading does not authorize Clipely to post to a social account or use finished work in its portfolio.

Retention

Released packages are kept through the later of 30 days after release and the end of the paid period that funded them, with reminder targets 7 days and 1 day before removal. A corrected release has its own window. Payment, correction, rights, incident or legal holds preserve affected records; a hold does not itself reopen access. Restored payment follows the applicable recovery window of at least 7 days. Unreleased media has a 14-day target after definitive closure or supersession, excluding active work and holds. Briefs, scripts and project records are kept while the account is active, then 30 days after verified closure or the last paid period, whichever is later. Profile and membership removal has a 30-day verified-closure target; shared ownership must first be resolved. Support and notification content has a 90-day target from last contact. Email recipient/delivery metadata has a separate 30-day closure target. Redacted application logs have a 30-day target; backup snapshots have a 35-day target. Deletion depends on current holds and verified execution and must be replayed before restored data becomes accessible. Billing and tax records are retained where needed to meet applicable record-keeping obligations or establish, exercise or defend claims. Their category, legal basis and applicable end date must be assessed before removal; these terms do not invent a fixed seven-year period or authorize indefinite retention unrelated to those purposes. These are operational targets, not a representation that every historic record has already been deleted.

Browser drafts remain until cleared or replaced. Provider-managed logs, inboxes and copies are also subject to the relevant provider configuration and applicable legal requirements. A category kept for a legal claim or obligation must be identified with its reason and applicable period rather than an unlimited blanket exception. Closure/export requests are reviewed against ownership, shared-workspace membership and open paid/rights obligations.

Requests and security

Email hello@clipely.app or write to the postal address for access, correction, export, deletion, restriction, objection or withdrawal of consent where applicable. Include enough information to identify your account and request; do not email passwords or full card information. Identity and authority may need verification before disclosure or deletion. Requests are handled without undue delay and normally within one month where GDPR applies, with applicable extensions/exceptions explained. You may complain to a competent data-protection authority, including Poland's UODO. See European Commission request guidance.

Clipely uses HTTPS, authenticated requests and workspace access checks. These measures do not guarantee absolute security. Account closure must preserve required billing/rights evidence and protect other workspace members. This notice does not promise that an unverified self-service deletion feature exists. Do not submit children’s personal information or use the service on their behalf without an applicable lawful basis and authority. Any age condition shown for your order also applies.

Changes

The published version will state its effective date/version. Material changes to processing will be disclosed through an appropriate notice. Legal-basis, recipient, retention and rights disclosures must reflect the actual service; see European Commission transparency guidance.