Not happy with your first video? We work on it until you are

Privacy Policy

Last updated: October 10, 2026

1. What we collect

  • Account data: email address, full name (if provided), authentication tokens via Supabase.
  • Usage data: projects created, renders started, style extractions, chat messages, credit ledger entries.
  • Uploaded content: video, image, and audio files you upload, plus any reference URLs you paste.
  • Billing data: payment method details are collected and stored by Stripe; we only retain a customer ID, subscription status, and invoice history.
  • Technical and interaction data: IP address, user agent, device fingerprint (for fraud prevention on signup), timestamps, page visits, clicks, navigation, product events, errors, and performance timing.
  • Advertising measurement data: this tells us which of our ads bring customers. We never send your videos or uploads to Meta, Google Ads or TikTok for ad measurement.
    • Meta (Facebook and Instagram): Meta's pixel sees page views on our public pages and sets a browser ID cookie. Meta may use those page views to show our ads to people who visited. When you sign up, make your first video, start a checkout or pay, we also send Meta that browser ID, your IP address, your browser's user agent (its name, version, operating system and device), a one-way hash of your email and account ID, and, when you pay, the amount. If you followed a link to us from Facebook or Instagram (an ad or any other link), it carries a click ID: we keep it in our own cookie for up to 90 days and send it to Meta with those events.
    • Google Ads: only if you arrive by clicking one of our Google ads, we keep that ad's click ID and, when you sign up, make your first video or pay, send Google that click ID, a one-way hash of your account ID and, when you pay, the amount. We may also send a one-way hash of your email so Google can match the visit to you.
    • TikTok: TikTok's pixel sees page views on our public pages and sets a browser ID cookie. When you sign up, start a checkout or pay, we also send TikTok that browser ID, your IP address, your browser's user agent, a one-way hash of your email and account ID, and, when you pay, the amount. If you came to us from a TikTok ad, it carries a click ID: we keep it in our own cookie for up to 90 days, save it with your account so a later payment can be matched, and send it to TikTok with those events.
  • Session replay data: a visual reconstruction of interactions with the website and Studio may be collected to help us understand usability problems. Form inputs, Director prompts and messages, attachment names, project titles, uploaded media, video/audio, preview canvases, and payment details are excluded or masked from replay.

2. Why we process it

  • Deliver the video-editing service (core functionality).
  • Manage subscriptions and usage-based limits.
  • Prevent abuse (rate-limits, fraud scoring at signup).
  • Understand acquisition, conversion, feature adoption, reliability, and usability so we can improve the offer, funnel, website, and Studio.
  • Measure which of our ads bring customers.
  • Legal obligation (tax records retained 7 years).

We do not train foundation models on your content. We do not sell your data. We send ad measurement data only to Meta, Google and TikTok, and only the data listed above.

3. Sub-processors

Your data passes through:

  • Supabase, authentication, account records, and database storage (Postgres + RLS).
  • Vercel, hosting for the web app and browser-facing API routes.
  • AWS, encrypted media storage, API and worker compute, rendering, and operational logs.
  • Stripe, payment processing + subscription state.
  • PostHog, product analytics, heatmaps, error and performance signals, and privacy-filtered session replay.
  • Meta Platforms, advertising measurement and audiences for our own ads on Facebook and Instagram (the Meta pixel and Conversions API, with the data listed above).
  • Google Ads, advertising measurement for our own Google ads (the click ID, hashed account ID, amount paid and, when sent, the hashed email listed above).
  • TikTok, advertising measurement for our own TikTok ads (the TikTok pixel and Events API, with the data listed above).
  • ElevenLabs, speech-to-text for your audio. Audio and transcripts are processed and may be retained by ElevenLabs according to our workspace settings and their retention terms.
  • OpenAI, AutoCut and clip analysis on bounded source evidence.
  • Moonshot AI, Director editing, style work, and analysis of reference and b-roll evidence.
  • Alibaba Cloud Model Studio, the configured Qwen fallback for Director and style work when that rail is used.
  • fal.ai, optional image generation, background removal, and tracked media isolation when you request those tools.
  • Pexels, licensed stock footage source. We read their catalog; they don't receive your content.

4. Retention

Finished renders, uploaded source material, and chat messages are retained for the lifetime of your account. Deleted when you delete your account (see §6) or when you remove individual items from the cockpit. Billing records are retained for 7 years per tax regulations. Analytics events and session replays are retained according to our configured analytics retention window and may be deleted earlier when no longer needed.

Clypmint in ChatGPT

When you link Clypmint to ChatGPT, Clypmint receives the video you choose to share, the instructions you send with it, and an account link for the Clypmint account you approve. We use this data only to show your Clypmint work and complete the editing actions you request. Videos shared through ChatGPT follow the same retention rules as Studio uploads. Disconnect Clypmint in ChatGPT settings to stop new access. Delete an item in Clypmint, or delete your Clypmint account, to remove stored content under the rules above.

5. Security

Data at rest is encrypted by our sub-processors. Traffic is HTTPS-only. Supabase Row-Level Security enforces per-user data isolation. Payment card numbers never touch our servers, Stripe Checkout handles that end-to-end.

6. Your rights (GDPR / CCPA)

  • Right of access: email us and we'll provide a copy of your data.
  • Right to deletion: use the "Delete account" control on your Plan & billing page, or email us. All data is deleted (some billing records retained per §4).
  • Right to correction: edit your profile in-app or email us.
  • Right to portability: we can export your data as JSON + your videos as MP4s.
  • Right to opt out of sale or sharing: we do not sell data. Sending ad data to Meta, Google or TikTok, as described above, may count as “sharing” under California law. A Global Privacy Control or Do Not Track signal turns it off for your browser, and for your account if you are signed in.
  • Analytics and ad preferences: Clypmint honors a browser Do Not Track signal by disabling product analytics, session replay, and ad measurement for that browser. A Global Privacy Control signal turns off ad measurement with Meta, Google and TikTok for that browser. If you are signed in when your browser sends either signal, ad measurement stays off for your account from then on, on any device and for renewals. Ad measurement is off for visitors in the EEA, the UK and Switzerland.

7. Children

Clypmint is not intended for children under 13. If you believe a child has created an account, email us and we will delete it.

8. Contact

parker@clypmint.com