Legal
Privacy Policy
Last updated
1. Who we are
ClipCheap (“we”, “us” or “our”) is a business registered in Singapore, with its registered address at UClub LaunchPad @ one-north, Singapore. We run ClipCheap. This policy explains how we collect, use, share and protect personal data when you use our website at clipcheap.app, the ClipCheap studio and related services (the “service”).
We decide why and how this personal data is processed, which makes us the organization responsible for it under Singapore’s Personal Data Protection Act 2012 (PDPA) and its “controller” under the EU and UK General Data Protection Regulation (GDPR).
Data Protection Officer. You can reach our Data Protection Officer atprivacy@clipcheap.app.
Videos you process can show or mention other people. We handle their personal data on your behalf and on your instructions, and you are responsible for having the right to share it with us.
2. Summary
- We collect what we need to run ClipCheap: your account details, the videos you add and what we make from them, and basic billing and technical information.
- AI model providers process your audio and transcripts through OpenRouter to transcribe them and suggest highlights and captions. We don’t use your content to train AI models.
- We don’t sell your personal data, we don’t share it for advertising, and we don’t show ads.
- Polar handles payments as our merchant of record. Buffer receives your clips only if your workspace connects it and schedules posts.
- Source files are deleted after 7 days on Free and 30 days on Creator, Pro, and Business. Clips stay until you delete them.
- You can export your data and delete your account in Settings, and ask us for access, correction or deletion atprivacy@clipcheap.app.
3. Information we collect
Account details
Your name, email address and password when you sign up, whether you have verified your email address, and your email settings, such as post reminders. We store your password only as a salted one-way hash, never in readable form.
Workspace and team details
Workspace names, who belongs to each workspace and in which role, the invitations you send (including the email address of the person invited), and a record of who did what, such as who created a project or scheduled a post.
Your content
The videos you upload; the YouTube links you submit and the videos we retrieve from them, with their titles and lengths; the audio we extract; transcripts with word timings; highlight picks with their titles, hooks, reasons and scores; captions; rendered clips, posters and versions; and the tags, captions, hashtags, titles, schedules and post links you add when you publish. Videos can contain the faces, voices and names of the people in them.
Connected accounts
If your workspace connects Buffer, we store the connection’s access credentials (encrypted); the names and avatars of your Buffer organizations and channels and the app each channel posts to; the status and links of the posts we send; and, to show on your calendar, a short preview of posts already waiting in your Buffer queue: their first 200 characters, channel and due time.
Payment and billing details
Polar collects your payment details at checkout and handles them under its own privacy policy. We never receive your full card number. Polar sends us your customer and subscription identifiers, your plan, the subscription’s status and renewal date, and event messages that can include your name, email address and billing details.
Usage and technical data
The video minutes, re-renders and AI caption requests your workspace uses; your job history and processing events; your IP address and browser details; request and error logs; sign-in attempts, which we use to stop password guessing; and the bot-protection signals described in Cookies and local storage.
Messages you send us
If you email us, we keep your message and our reply so that we can help you.
Most of this information comes from you or your device. The rest comes from Polar (payment status), Buffer (channels and post status) and YouTube (the public videos you link to and their details).
4. How we use information
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide ClipCheap: run your account and workspaces, turn your videos into clips, store and show your content, run the editor, and publish what you schedule | Performance of our contract with you |
| Connect Buffer and send it the posts you schedule | Performance of our contract with you |
| Bill paid plans through Polar and apply plan limits | Performance of our contract with you; legal obligations, such as tax and accounting |
| Send service emails: email verification, password resets, invitations, job updates, post reminders, and notices about billing or changes to our terms | Performance of our contract with you; our legitimate interest in keeping you informed about your account |
| Keep the service secure: bot checks, rate limits, sign-in protection, audit records, and preventing fraud and abuse | Our legitimate interest in protecting users and the service; legal obligations |
| Enforce our terms and policies, handle copyright notices, and respond to lawful requests | Our legitimate interests; legal obligations |
| Answer your questions and support requests | Performance of our contract with you; our legitimate interests |
| Understand usage and costs in aggregate, fix problems and improve ClipCheap | Our legitimate interest in running and improving the service |
| Anything else we ask your permission for | Your consent, which you can withdraw at any time |
Under the PDPA, we process personal data with your consent, including consent given when you sign up and use the service, or where the PDPA allows us to without consent, for example for legitimate interests or business improvement.
We don’t sell your personal data, share it for targeted advertising, or build advertising profiles. We send service emails only. If we ever send marketing emails, we will ask for your consent where the law requires it, and every one will include a way to unsubscribe.
5. AI processing
AI does the first pass on your videos. This is what is sent, and where:
- Transcription. We extract the audio track from your video and send it to a speech-to-text model.
- Highlights. We send the transcript to a language model, which suggests moments with titles, hooks, reasons and editorial scores.
- Post suggestions. When you ask for captions, we send the clip’s title, hook and part of its transcript (up to about 4,000 characters) to a language model, which drafts captions, titles and hashtags for each app.
These requests go through OpenRouter, which routes each one to a model provider. We currently use speech-to-text models and language models that include DeepSeek models, and we may change models or providers. We set OpenRouter to use only providers that don’t train on the data we send and don’t keep it after they respond.
Video frames never go to AI providers. Rendering, captions and auto-reframe run in our own processing containers on Cloudflare. Auto-reframe detects where faces are in a frame so that it can keep the speaker in view. It doesn’t identify anyone, and it doesn’t create or keep face templates or any other biometric data.
We don’t use your content to train AI models. AI output is only a suggestion: it doesn’t make decisions with legal or similarly significant effects on you, and nothing is posted unless someone schedules it.
6. Service providers and sharing
We share personal data only as this policy describes. These service providers process it for us under contracts that require them to protect it and to use it only to provide their services:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting, processing containers, storage for videos and clips (R2), background queues, bot protection (Turnstile), and the connection to our database | Worldwide network; Cloudflare, Inc. is based in the United States |
| Our managed PostgreSQL provider | The database that holds accounts, workspaces, projects, clips, posts, and billing status | One region we select; ask us for details |
| OpenRouter | Routes AI requests for transcription, highlight picks, and post suggestions to model providers | United States |
| AI model providers, through OpenRouter | Run the speech-to-text and language models that process your audio and transcripts | Varies by provider, including the United States |
| Resend | Sends service emails, such as email verification, password resets, invitations, and job updates | United States |
| Polar | Merchant of record for paid plans: checkout, payments, tax, invoices, and the billing portal | United States |
| Buffer | Schedules and publishes posts to social apps, only if your workspace connects it | United States |
As our merchant of record, Polar is also the seller of your subscription, and it handles payment details as an independent business under its own privacy policy. Buffer is used only if your workspace connects it, and its own privacy policy and your agreement with Buffer apply to what it receives.
We also share personal data:
- When you publish. When you schedule a post through Buffer, we send Buffer the clip (as a signed link that expires), its caption, title, hashtags and schedule. Buffer publishes it to the app you chose, where it is as public as you set it to be and that app’s privacy policy applies.
- Within your workspace. Members of a workspace can see its projects, clips and posts, and the names, email addresses and roles of its members.
- For legal reasons. To comply with the law or a valid request from a court or authority; to enforce our terms; to handle copyright notices, which means we may forward a notice, including the sender’s contact details, to the user concerned, and a counter-notice to the person who sent the notice; and to protect the rights, safety and property of our users, the public or us.
- With our advisers, such as lawyers, accountants and auditors, who must keep it confidential.
- In a business transfer. If we are involved in a merger, acquisition or sale of assets, personal data may pass to the new owner, who must respect this policy. We will tell you before that happens.
- With your consent, or when you ask us to.
7. International transfers
We are based in Singapore, and our service providers process data in other countries, including the United States and the countries where Cloudflare runs its network. Data protection laws there may differ from those where you live.
When we transfer personal data out of Singapore, we make sure it keeps a standard of protection comparable to the PDPA, mainly through contracts with our providers that include data protection commitments. For personal data from the European Economic Area, the UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer Addendum, or on another lawful transfer mechanism. To learn more about the safeguards we use, contact privacy@clipcheap.app.
8. How long we keep information
| Information | How long we keep it |
|---|---|
| Source video, extracted audio and full transcript | Your plan’s source retention period after processing (7 days on Free and 30 days on Creator, Pro, and Business), so you can keep editing. Then deleted. |
| Uploaded files of jobs that failed or were cancelled | Up to the same period, so you can retry. Then deleted. |
| Temporary processing copies | Deleted when processing finishes. |
| Clips, captions, posters, highlight details and posts | Until you delete the project or your account. Earlier versions of a re-rendered clip, beyond the newest three, may be deleted sooner. |
| Account details | While your account is open. Deleted when you delete your account. |
| Workspaces and their content | Until the workspace is deleted, which happens when its owner deletes their account. |
| Buffer connection | Until the connection is removed. Previews of posts in your Buffer queue: up to one day. |
| Billing records | While your account is open, and afterwards as long as needed for tax, accounting and legal purposes. Event messages from Polar are cut down to their reference and outcome after 30 days. |
| Copies of service emails | 30 days after they are sent or fail. |
| Sign-in sessions | Until you sign out, or 7 days. |
| Security and request logs | Up to 30 days, unless we need them longer to investigate abuse or a security incident. |
| Audit records of account and administrative actions | As long as needed to protect the service, resolve disputes and meet legal obligations. |
| Database backups | Up to 30 days before they are overwritten. Videos and clips are not kept in backups. |
| Messages you send us | As long as needed to help you, and then for a reasonable time in case you contact us again. |
We may keep information longer when the law requires it, or to establish, exercise or defend legal claims. When we no longer need personal data, we delete or anonymize it.
9. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and learn how we use it;
- correct data that is inaccurate or incomplete;
- delete your data;
- export your data in a portable format;
- object to processing based on our legitimate interests, or ask us to restrict it;
- withdraw consent at any time, which doesn’t affect processing that happened before, but may mean we can no longer provide some or all of the service; and
- complain to a data protection authority, such as Singapore’s Personal Data Protection Commission or the authority where you live in the EU or the UK.
In the studio
- Change your name and password in Settings.
- Delete clips and projects at any time.
- Export your account data as a JSON file from Settings, and download your clips.
- Delete your account in Settings. If you own a workspace that others still use, transfer it first, and cancel any paid plan.
- Turn off post reminder emails in Settings, and disconnect Buffer in Settings, then Publishing.
By email
For anything else, email privacy@clipcheap.app from the address on your account. We may need to confirm your identity before we act. We aim to respond within 30 days; if we need longer, as the law allows, we will tell you why and when to expect an answer.
Requests are free. Under the PDPA we may charge a reasonable fee for some access requests, and if so, we will tell you the amount before we go ahead. We may decline a request where the law allows, for example if it would reveal other people’s personal data, and we will tell you why.
If your data is in a workspace someone else owns, or in a video someone else added, we may pass your request to the owner of that workspace, who controls that content.
10. California privacy rights
This section applies to California residents. It adds to the rest of this policy, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).
What we collect and why
In the past 12 months, we collected these categories of personal information:
- Identifiers, such as your name, email address, IP address and account IDs;
- Customer records, such as your name, email address and billing status;
- Commercial information, such as your plan and subscription history;
- Internet or other electronic network activity, such as usage data and logs;
- Audio, visual or similar information, such as the videos, audio and images you process; and
- Sensitive personal information, limited to your account login: email address and password.
We collect it from the sources in Information we collect, use it for the business purposes in How we use information, disclose it to the service providers inService providers and sharing, and keep it for the periods inHow long we keep information. We don’t infer characteristics about you, and we use sensitive personal information only to provide the service and keep it secure.
No sale or sharing
We don’t sell personal information or share it for cross-context behavioral advertising, and we haven’t done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, even though there is nothing to opt out of.
Your California rights
You have the right to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; and not to be discriminated against for using these rights. To use them, emailprivacy@clipcheap.app from the address on your account. We will confirm receipt within 10 business days and respond within 45 days, or tell you if we need up to 45 more. We verify each request by matching it to your account. You can ask an authorized agent to make a request for you; we will ask for your signed permission and may ask you to confirm your identity with us directly.
11. Cookies and local storage
In the studio
- Session cookie. One strictly necessary cookie keeps you signed in. Scripts can’t read it, it is only sent over HTTPS, and it lasts until you sign out, or for 7 days.
- Bot protection. The sign-up, sign-in and password reset forms use Cloudflare Turnstile, which runs a check in your browser and processes technical signals from your browser and device to tell people from bots.
- Local storage. The studio keeps some choices in your browser, such as post drafts, the apps you last posted to, dismissed banners, your settings for new videos and your color theme. They stay on your device, and signing out clears them, apart from the theme.
On our website
clipcheap.app sets no cookies of its own and uses no analytics, advertising or tracking tools. If you pick a color theme, your choice is saved in your browser’s local storage and never sent to us. Our hosting provider, Cloudflare, may set a strictly necessary security cookie when it checks traffic for bots or attacks.
Because we use only strictly necessary cookies and storage, we don’t show a cookie banner. If we ever add optional cookies or analytics, we will update this policy and ask for your consent where the law requires it.
12. Security
We protect personal data with safeguards that match the risks, including:
- encryption in transit (HTTPS) for every connection;
- private storage for videos and clips, which leave your workspace only through signed, expiring links for the posts you schedule;
- passwords stored only as salted, one-way hashes, and sign-in sessions that end when you sign out or reset your password;
- encrypted storage of Buffer credentials;
- access to production systems only for people who need it, with multi-factor authentication for administrators; and
- rate limits, bot protection and an audit trail of sensitive actions.
No system is completely secure, so please use a strong, unique password. If a data breach is likely to cause you significant harm, we will tell you and the relevant authorities, such as Singapore’s Personal Data Protection Commission, as the law requires.
13. Children
ClipCheap is only for people aged 18 or over, and we don’t knowingly collect personal data from anyone younger. If you believe someone under 18 has given us personal data, contact privacy@clipcheap.app and we will delete it.
14. Changes to this policy
We may update this policy. The date at the top of this page shows the latest version. If we make a material change, we will tell you by email or in the studio before it takes effect.
15. Contact us
For questions or requests about privacy, contact our Data Protection Officer at privacy@clipcheap.app, or write to us at our registered address.
- Legal name
- ClipCheap
- Registered address
- UClub LaunchPad @ one-north, Singapore
- Privacy and data requests (Data Protection Officer)
- privacy@clipcheap.app
- Help and billing
- support@clipcheap.app