Privacy policy

Who is responsible

The service is independently run from India and is the controller of the personal data described here. For privacy questions, or to exercise a right, email virat@clpx.video.

What we collect

• Account data. Your name, email address and sign-in method, held through our authentication provider. We never see or store your password.
• Your product. The website address, documents or description you give us, the text of the pages we fetch from that address, and the screen recording you upload. From these we write a brief and a set of hook lines, which we also keep.
• The creator and the videos. The casting preferences you choose, the generated creator image, every generated hook clip and every finished video, with the result of the face check on each.
• Connected accounts. When you connect a TikTok, Instagram or YouTube account, the access tokens are held by our publishing provider. We keep the account’s platform, username, the age you tell us it is, its posting schedule, and the views and engagement figures the platform reports back for each post.
• Videos you paste. If you paste a public video so the service can study its format, we keep that address and what we learned from it.
• Usage and diagnostics. Which features you use, job outcomes, generation cost per job and errors. This is how we find faults and size capacity.
• Billing data. Your plan and subscription history. Card details are handled by our payment provider and never reach our systems.

Why we use it, and on what basis

• To provide the service: writing the brief, casting the creator, generating and checking videos, scheduling and publishing posts, and reading back their figures. Basis: performance of our contract with you.
• To keep it working and secure: diagnostics, abuse prevention, capacity planning. Basis: our legitimate interests.
• To bill you and meet tax and accounting duties. Basis: contract and legal obligation.
• To answer your support messages. Basis: contract and legitimate interests.
• To send product updates. Basis: consent where required; you can unsubscribe at any time.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Who receives it

A small set of vendors processes data on our behalf. Each is named, with exactly what it receives, on our Subprocessors page. In outline:

• Clerk runs sign-in and receives your name, email address and sign-in method.
• Convex is our database and runs our application logic. It holds your account, product brief, hook lines, creator and video records, connected-account details, posting schedule and the figures that come back. It does not hold media files.
• Cloudflare hosts the site and the app, and stores media in its R2 object storage: your screen recording, documents you upload, creator images and generated videos.
• fal.ai generates the creator image and the hook clips. It receives the casting brief and hook line as prompts and the creator’s own generated face image. It never receives your screen recording.
• OpenRouter routes requests to text and vision models. It receives the text of your product pages, documents and description, the brief and hook lines, and frames of generated clips for the face check.
• Zernio connects to the platforms and publishes. It holds the access tokens for the accounts you connect and receives each finished video with its caption and chosen music track; it returns the figures the platforms report.
• Polar is the merchant of record for billing and receives your name, email address, plan and payment details.
• ScrapeCreators reads a public video when you paste one. It receives that address and nothing about you.
• PostHog, where product analytics are enabled, receives which screens and features you use in the app, under a pseudonymous identifier.

Purchases are handled by Polar Software Inc. as merchant of record. They are a controller for the payment itself; see their privacy notice.

When a post goes out, the video, its caption and the chosen track go to the platform you connected. TikTok, Instagram and YouTube are independent controllers of what is posted there and of the figures they report back, under their own terms and privacy policies.

Your material and models

Your material is processed to make your videos. We do not use it to train general-purpose models, and the model providers we use are engaged on terms under which they process inputs to return an output rather than to train on them. The creator is generated; it is not based on a photograph of you or of any real person. We may use aggregated, non-identifying statistics, for example average generation time, to improve the service.

International transfers

The service is operated from India and our providers operate globally, so your data is transferred and stored outside your country, including in the United States and the European Union. Where the law requires a transfer safeguard, we rely on our providers’ Standard Contractual Clauses or an equivalent mechanism.

How long we keep it

• Product material, creators and videos: until you delete them, or until 30 days after your account is closed.
• Connected-account tokens: until you disconnect the account, which revokes them with the publishing provider.
• Account and workspace data: for as long as your account is open, then deleted within 30 days of closure.
• Billing and tax records: for as long as tax and accounting law requires, which is longer than the above.
• Diagnostic logs: a rolling short window, then discarded or aggregated.
• Backups: our database provider keeps snapshots for a limited period, so anything you delete stays in those snapshots until they age out.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can also withdraw consent where we relied on it, and complain to your local data protection authority.

Much of this is immediate and self-serve: from inside the app you can delete a video, retire a creator, remove a product, disconnect a social account, or delete your entire account. For anything else, email virat@clpx.video and we will answer within 30 days. We do not charge for this and we will not treat you differently for asking.

Security

Access to production systems is restricted and authenticated. Data is encrypted in transit, and at rest by our storage and database providers. Media is stored under per-account prefixes and served over expiring links. No system is perfect; if a breach affects your data we will notify you and the relevant authority as the law requires.

Children

The service is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

Cookies and local storage

We use what is needed to keep you signed in and to remember interface preferences. We do not run advertising trackers and we do not sell what we measure. Where product analytics are enabled, they are used to understand how the app is used, not to profile you.

Changes

We will update this policy as the service changes. If a change is material we will tell you by email or in the app before it takes effect, and the date at the top always shows the current version.

Contact

Email virat@clpx.video.