Privacy Policy

Last updated: July 24, 2026

1. Information we collect

• Account information. Your name, email address and profile photo when you sign up — directly, or via Google, Microsoft, Apple or Facebook sign-in.
• Content you provide. Videos you upload, video links you paste, scripts and prompts you enter, and the clips, captions and edits you create.
• Voice-cloning audio. If you use our consent-gated voice-cloning feature, the voice recordings you provide and the resulting voice model. We only accept recordings of your own voice or a voice you have written permission to clone.
• Usage and billing data. Your plan, token usage, generation history and payment status. Payments are processed by Kelviq, our Merchant of Record (on Stripe) — card data never touches ClipItX and we never collect or store your card numbers.
• Technical data. Basic logs (IP address, browser type, timestamps) used for security, abuse prevention and debugging.
• Google user data. If you choose to connect Google services — described in detail in Section 2 below.

2. Google user data (Google Sign-In & YouTube)

Connecting Google is optional. If you connect it, we access only the data needed to run the features you choose to use. This section describes exactly what Google user data we collect, how we use it, who we share it with, and how we protect and retain it.

2.1 What Google user data we collect

• Google account basic profile (via Google Sign-In): your name, email address and profile picture.
• YouTube channel content (via the YouTube read scope): your own channel's video list and the metadata of those videos, shown inside your ClipItX dashboard.
• YouTube analytics (via the YouTube Analytics read-only scope): your own channel's performance metrics (such as views and engagement), shown inside your dashboard.
• YouTube upload permission (via the YouTube upload scope): permission to publish videos to your own connected YouTube channel.

2.2 How we use Google user data

• Google Sign-In data is used solely to create and authenticate your ClipItX account.
• YouTube upload permission is used solely to publish videos to your own connected YouTube channel — either when you click Post, or on a posting schedule that you explicitly set up and fully control through our optional Autopilot feature (which you can pause or disable at any time). We only ever upload to channels you have connected, and never to anyone else's.
• YouTube channel content and analytics are used solely to display your own channel's videos and performance inside your ClipItX dashboard.
• We use Google user data only to provide and improve these user-facing features of ClipItX, and for no other purpose.

2.3 With whom we share, transfer, or disclose Google user data

• We do not transfer or disclose your Google user data to third parties for purposes other than providing or improving the features described above.
• We may share it only: (a) with your consent; (b) with a limited set of service providers strictly necessary to operate these features (for example, secure cloud hosting), who may process it only on our instructions, under confidentiality obligations, and solely to provide the Service to you; or (c) where we are legally required to do so.
• We do not transfer Google user data to data brokers, information resellers, or for advertising of any kind.

2.4 What we do NOT do with Google user data

2.5 How we protect Google user data

• We use encryption (HTTPS/TLS) to protect your information while it is in transit between your device, our application and our servers.
• Security procedures are in place to protect the confidentiality of your data. Access to Google user data is restricted to a small, authorized team on a least-privilege basis, and only under specific, limited circumstances (for example, to investigate a technical issue you have reported, to protect against fraud or abuse, or where required by law).
• Sensitive credentials such as Google OAuth tokens are stored securely, are used only to perform the actions you request, and are never exposed to other users.
• Our database access uses parameterized queries to guard against injection attacks, and we follow widely recognized web-security practices.

2.6 Retention and deletion of Google user data

• We retain Google user data only for as long as needed to provide the features you use.
• You can disconnect Google/YouTube at any time from Settings → Integrations in the app, or revoke ClipItX's access at https://myaccount.google.com/permissions. Disconnecting deletes the stored Google authorization tokens.
• Deleting your ClipItX account removes your Google user data and other personal data from our systems within 30 days, except minimal records we must keep for legal or billing compliance.
• You may request deletion of your data at any time by emailing [email protected].

3. How we use your information

• To provide the Service: generate clips, burn captions, render videos, and store your media library.
• To process your content with AI providers (for example, transcription and scene analysis) strictly to deliver the feature you requested.
• To operate billing, enforce plan limits and prevent abuse.
• To send essential service emails (such as "export finished" and billing notices). Marketing emails are opt-in only.

We use your data only to provide and improve ClipItX's features for you. We do not use your personal information or Google user data for advertising, for selling to third parties, or to train generalized AI models.

4. How we share information — our processors

• We share data only with the service providers strictly needed to run ClipItX (cloud hosting, object storage, AI transcription/analysis, payment processing), under their respective data-processing terms and only to deliver the Service.
• We do not sell your personal data or your content.
• We do not transfer or disclose your data to third parties for advertising, data brokerage, resale, or any purpose unrelated to operating ClipItX.
• We may disclose data if required by law, or to protect the rights, safety and security of our users and the Service.

These are the named providers that process data on our behalf, and what each one does:

5. Legal bases and international transfers

• Contract. Most processing — hosting your media, generating clips, billing, posting to accounts you connect — is done because it is necessary to provide the Service you signed up for.
• Consent. Some processing happens only when you opt in: connecting Google/YouTube, TikTok or Instagram accounts, uploading voice-cloning audio, and marketing emails. You can withdraw consent at any time (for example by disconnecting an account or deleting a voice).
• Legitimate interest. Security logging, abuse and fraud prevention, and service debugging rest on our legitimate interest in keeping the Service safe and working.
• International transfers. ClipItX is operated from India and the providers listed above run infrastructure in other countries (including the United States and the European Union), so your data may be processed outside your own country. We share it only under the providers' data-processing terms and with the protections described in this policy.

6. Cookies

• We use cookies and similar storage only to keep you signed in (authentication session) and to remember essential preferences.
• We do not use advertising or cross-site tracking cookies, and we do not run third-party ad trackers.
• Blocking cookies in your browser will prevent you from staying signed in but the marketing site remains readable.

7. Data security & how we protect your sensitive data

Protecting your data — especially sensitive information such as your account credentials, your Google OAuth tokens, and the private content you create — is a top priority. We apply layered administrative, technical and organizational safeguards designed to protect it at every stage.

• Encryption in transit. All traffic between your device, our application and our servers is protected with industry-standard TLS/HTTPS encryption. Your uploaded media and generated videos are stored on reputable cloud object storage and are encrypted in transit.
• Security procedures & least-privilege access. Security procedures are in place to protect the confidentiality of your data. Access is restricted to a small, vetted team on a least-privilege basis; we do not routinely access your personal data or content, and only do so under specific, limited conditions (a technical issue you reported, fraud/abuse protection, or a legal requirement).
• Defence against attacks. Our database access uses parameterized/prepared statements to guard against SQL injection, user input is validated, and we follow widely recognized web-security guidance (such as OWASP) to reduce common vulnerabilities.
• Credential protection. Sensitive credentials, including Google OAuth tokens, are stored securely and used only to perform the actions you request. We never store your payment card numbers — those are handled by our PCI-compliant payment provider.
• Monitoring & breach response. We monitor for suspicious activity and maintain procedures to detect, contain and respond to security incidents, and to notify affected users and authorities where required by law.

We use commercially reasonable safeguards to protect your information. However, no method of transmission over the Internet or electronic storage is 100% secure, so while we cannot guarantee absolute security, we are committed to protecting your data and continually improving our safeguards.

8. Data retention and deletion

• We retain your personal information only for as long as needed to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.
• Your projects and media stay in your library — while your account is active — so you can re-edit them, until you delete them or delete your account.
• Deleting your account removes your personal data, stored media (including the underlying objects in Cloudflare R2 storage), and Google user data from our systems within 30 days, except minimal records we must keep for legal or billing compliance. When a retention period expires, we delete or destroy the data.
• When you remove a cloned voice, or delete your account, the associated voice-clone model and its source recordings are deleted.
• You can request deletion of your data at any time from Settings → Account, or by emailing [email protected].

9. Your rights

Depending on your location, you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing. Email [email protected] and we will respond within 30 days.

10. Children

ClipItX is not directed to children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect their data. Users under 18 may only use ClipItX through an account opened and held by a parent or legal guardian, as described in our Terms of Service.

11. Changes to this policy

We will post any changes to this policy on this page and update the "Last updated" date above. Material changes will also be announced in the app.

12. Contact us

Questions or requests about privacy, or to exercise any of your rights:
ClipItX, a sole proprietorship operated by Janaki Kalyani Bandaru, India
[email protected]