Privacy policy

Who is responsible

ClipOnIt (cliponit.app) is published by an independent founder based in Nantes, France, who is the data controller under the GDPR. Contact: contact@cliponit.app.

Data we collect

Account: email address, first or last name, password (stored hashed), and if you sign in with Google: Google identifier, name and avatar.

Content: the videos you upload or import by link, their transcripts, the generated clips and exports, your logo if any.

Montage by reference: your rushes, logo, voice and filmed faces stay private to your account and never join a shared library. From a reference video (TikTok, Reels, Facebook, Shorts link) we keep nothing: it is downloaded for the analysis then deleted, with its link. Only its editing structure (shot durations, layout, kind of texts, tempo), with no content or identifier of the video, is kept and reused for all accounts, like our generic graphic elements.

Usage: number of videos processed per month, AI calls (detection, description, translation), exports, API keys and authorized OAuth connectors.

Technical: session cookie, affiliate "ref" cookie (60 days) if you arrive through a referral link, theme and language in your browser's localStorage, IP address and server logs.

Partnerships waitlist (/partenaires page): email address, role (brand or clipper), language, referral code if any and the date of your consent. Used only to tell you when Partnerships open, based on your consent, which you can withdraw at any time by emailing contact@cliponit.app.

Analytics: our own tool, hosted by us, with no third party. A random identifier ("cv_vid" cookie) tells visits from the same browser apart, and the "cv_ft" cookie keeps the landing page and referring site of your first visit (link, campaign). We record page views, clicks, scroll depth, errors and load times, plus the main steps in the app (importing a video, exporting, subscribing). No IP address, typed text or email is recorded in these statistics; the country is inferred from the browser's time zone. These statistics are not sold, shared or used for advertising, except the three steps described under "Advertising", and only with your consent. When you sign up, these statistics are linked to your account, and you can tell us how you heard about ClipOnIt (optional).

Advertising (only with your consent)

To measure our ads, we may use the Meta pixel (Facebook, Instagram), the TikTok pixel and the Google tag. They only load once you allow the "Advertising" category in the cookie banner ("Accept all", or "Choose" then the "Advertising" switch). Until you choose, or if you decline, none of these scripts is loaded and no advertising cookie is set. Declining is as easy as accepting, and your choice is remembered for 6 months ("cv_consent" cookie). As of today, none of these pixels is configured yet: even after you accept, nothing is loaded.

If you accept, our server also sends Meta, TikTok and Google three steps of your account: sign-up, first successful video and subscription (with its amount). Your email address and account identifier are sent hashed (SHA-256), never in clear, with the identifier set by their pixel and your browser type; never your IP address nor the content of your videos. Legal basis: your consent, which you can withdraw at any time with the "Cookies" link at the bottom of every page or the "Manage cookies" button at the bottom of this page; after withdrawal, nothing more is sent.

Why

Providing the service (transcribing, detecting highlights, reframing, captioning, exporting), managing your account and subscription, answering your requests, preventing abuse (per-IP limits on the free tool), and improving the product from usage statistics and analytics (understanding where visitors come from, where they get stuck, what works). Legal basis: performance of the contract, legitimate interest (security), legal obligations (invoicing).

Your videos are not used to train AI models, neither ours nor our processors'.

Processors

Hosting and storage: Hetzner, Helsinki (Finland, European Union). Transcription: OpenAI (Whisper). Highlight detection, descriptions and translations: Anthropic (Claude), which receives the transcript, not the video. B-roll: Pexels (search queries only). Payment: Stripe (we do not store your card). Transactional emails: Resend. Google sign-in: Google. DNS and protection: Cloudflare. Advertising, only with your consent: Meta Platforms, TikTok and Google (Ireland).

OpenAI, Anthropic, Pexels, Stripe, Resend, Google and Cloudflare are based in the United States; transfers rely on the European Commission's standard contractual clauses or the Data Privacy Framework.

Retention

Videos, transcripts and clips: on paid plans, clips, exports and transcripts are kept while the subscription is active, and the source video file is deleted 30 days after it was imported (the date is shown on the video page, with a button to download it beforehand); Free plan: 7 days; free tool without an account: 24 hours. You can delete a video at any time, which deletes its clips and exports.

Account: until you delete it, on request. Invoices: 10 years (accounting obligation). Server logs: 30 days. Analytics (events and "cv_vid" / "cv_ft" cookies): 13 months at most.

Your rights

Access, rectification, erasure, portability, restriction and objection: write to contact@cliponit.app from your account's address; we answer within 30 days. You can also lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.

Security

Encryption in transit (HTTPS). Passwords, API keys, extension tokens and access tokens issued by ClipOnIt to OAuth / MCP connectors: stored hashed (SHA-256 for tokens). Access tokens of the TikTok, YouTube and Instagram accounts you link: stored encrypted (AES-256-GCM), because ClipOnIt must be able to read them back to act on your behalf; they are never sent back to the browser. Server access limited to the founder. No system is infallible: if a data breach affects you, you will be notified.

Connecting a TikTok account

If you link your TikTok account (Login Kit), TikTok sends us, with your consent: your TikTok identifier (open_id), your display name, your avatar and, depending on the permissions you grant, the list of your public videos and their statistics (views, likes, comments, shares). We also keep the history of sends made from ClipOnIt (video, caption, visibility, status).

Use: only to post to your profile, or send as a draft to your TikTok inbox, the video you chose, with the settings you reviewed and confirmed for each send, and to show you your statistics. Nothing is ever posted without your confirmation click.

TikTok access tokens are stored encrypted (AES-256-GCM) and never sent back to the browser. This data is kept while the TikTok account stays linked, and deleted when you disconnect it or delete your ClipOnIt account.

Revocation: the "Disconnect" button in ClipOnIt revokes access with TikTok and erases the tokens; you can also remove access from the TikTok app (Settings and privacy › Security › Authorized apps). This data is never sold or used for advertising.

YouTube and Instagram accounts linked for Partnerships: same approach, read-only (channel or account name, identifier, views of posts submitted to a campaign), tokens encrypted (AES-256-GCM), deleted on disconnect (revoked with Google for YouTube; for Instagram, also remove access in its settings), never sold.

OAuth and MCP connectors

If you connect ClipOnIt to Claude, ChatGPT or another MCP client, that connector can, with your account: import videos, read and edit your clips, run exports. It never sees your password. You can revoke each connector in Billing → API key and MCP, and revoke your API key in the same place.

Chrome extension

The ClipOnIt extension for Chrome adds a button under the YouTube player. When you click it, it sends two things to cliponit.app and nothing else: the address of the video you ask to clip, and your account token. It does not read your history, your other tabs, or the pages you visit.

The account token and your preferences (export format, caption style) are kept in the extension's local storage, on your machine. They stay there until you sign out or uninstall the extension. You can revoke the token at any time from your account.

The extension carries no advertising tracker, no analytics and no remotely loaded code. Videos processed from the extension follow exactly the same retention and deletion rules as those imported from the website.

Cookies

On your first visit, a banner offers "Reject all", "Accept all" or "Choose". All three buttons carry the same weight, nothing is pre-ticked, and no optional tracker is set until you choose. Your choice is kept for 6 months in the "cv_consent" cookie, then the banner asks again. You can change your mind at any time with the "Cookies" link at the bottom of every page or the "Manage cookies" button at the bottom of this page; withdrawing consent deletes the cookies concerned.

Necessary (sign-in, language), always on: "session" (login), the OAuth state during a Google sign-in, "ref" (affiliate attribution, 60 days) if you arrive through a referral link, "cv_consent" (your choice, 6 months), theme and language in the browser's local storage. Our in-house analytics, exempt from consent because it is hosted by us, with no third party and no advertising use: "cv_vid" (random browser identifier) and "cv_ft" (source of the first visit), read only by us, 13 months at most. glot Insights also counts, cookieless, one visit per session plus conversions, to learn which language and wording serve visitors best. The language switcher also asks glot (app.glotlang.com) for the list of available languages and, only if you pick a language other than French or English (or your browser is set to one it publishes), its translations: public requests, with no cookie or identifier, that only pass on your IP address, like any page load.

Audience measurement (off by default): Google Analytics ("_ga", "_ga_*" cookies, 13 months at most), to learn how the site is used. Advertising (off by default): Meta pixel ("_fbp", "_fbc", 90 days), TikTok pixel ("_ttp", 13 months) and Google Ads tag ("_gcl_*", 90 days), to learn which ads bring you here. Each category only loads with your consent for it. As of today, none of these tools is configured on ClipOnIt: whatever you choose, no third-party script or cookie is loaded. If we turn them on, this page will be updated. No data is sold or joined across sites.

Minors

ClipOnIt is for people aged 16 and over. If an account was created by someone under 16, write to us: it will be deleted.

Changes

This policy may change with the product. The date at the top shows the current version; a significant change is announced by email to the affected accounts.

Manage cookies

Contact: contact@cliponit.app