Privacy notice

The controller within the meaning of the General Data Protection Regulation (GDPR) and further national data protection laws, for the processing of personal data on cliprails.com, is:

Email: contact@cliprails.com

There is no statutory obligation to appoint a data protection officer, and none has been appointed. Please address data protection requests to the email address above.

ClipRails runs clipping campaigns: a Creator funds a campaign, and Clippers publish clips on their own social media accounts and are paid for the verified views those clips earn. This notice describes which personal data we process along the way, for what purpose, on what legal basis, and which service providers receive it. We do not sell data and we do not use it for advertising.

For an account we process your email address, the username you choose and — if you upload one — a profile picture. If you register with a password, we store it exclusively as a cryptographic hash (bcrypt), never in clear text. Your account type (Creator or Clipper) and the campaigns you create or join are part of your account data as well. If a Creator gives a campaign an end date, we store the time zone their browser was set to when they chose it, so that the campaign ends at the end of their calendar day; Clippers see that time zone next to the end. When you register, you confirm that you are at least 18 years old and accept the terms — and, as a Creator, that you use ClipRails for business; we store the time of that confirmation as proof. The account data is required for the usage contract — without it we cannot create an account.

To protect accounts against passwords being tried out, we count failed sign-in attempts per identifier. All we store for that is a cryptographic hash of the email address or username entered, together with a counter and a time — no IP address. Entries older than 24 hours are removed automatically as the service runs.

Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract); for the proof of the registration confirmation and the limit on failed attempts, Art. 6(1)(f) GDPR (legitimate interest in a provable conclusion of contract and in secure accounts).

You can alternatively sign in through Google (Google login). The login serves authentication only: it requests the standard scopes openid, email and profile, and what we use out of them is your email address, so that we can match it to your account. A name or profile picture from your Google account is not stored in your ClipRails account. The login reaches none of your other Google services. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The login is separate from connecting a YouTube channel, described under “Connected social accounts” below. They are two different consents, granted at two different moments, for two different purposes, and they run through two separate Google projects: signing in never gives us access to your YouTube data, and connecting a channel is not a login. You can grant either without the other.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps and performance) and Art. 6(1)(f) GDPR (secure sign-in).

If you choose Twitch, ClipRails uses your Twitch account ID and display name to identify and show the linked login, and requests your email address and its verification status for registration. The requested permissions are openid and user:read:email. Linking Twitch to an existing account does not change your ClipRails email address, and later changes to your Twitch email do not change it either. Twitch access and refresh tokens are not stored permanently.

You can remove the Twitch login in settings after proving another sign-in method. Account deletion removes the stored Twitch identity. For accounts whose only sign-in method is Twitch, sensitive actions and account recovery use a short-lived, single-use link sent to the confirmed ClipRails email address. Completing recovery sets a password, removes the Twitch login and ends previous sessions.

The provider is Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. On the transfer to the USA, see “Hosting, infrastructure and processors”.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps and performance) and Art. 6(1)(f) GDPR (secure sign-in and account recovery).

All money flows run through Stripe. That covers two touch-points:

• Funding. A Creator pays a campaign's budget in via Stripe Checkout. For future fundings ClipRails sets up a customer profile with your email address at Stripe, and Stripe keeps the card you save there; you approve every charge individually.
• Connect payouts. For payouts to Clippers, Stripe Connect sets up a payout account; the identity and account verification required for it (KYC) is carried out by Stripe under its own responsibility. For it we pass Stripe the payout country you chose and — except for accounts in the USA and Canada — your email address. We keep the payout country ourselves as well, because whether and how a payout can be made depends on it.

Complete payment data (card or bank details, for instance) is collected and processed directly by Stripe; ClipRails does not store it, only references such as Stripe identifiers, amounts and payment status. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe is a controller in its own right for the identity check and for processing the payments; Stripe's privacy notice applies in addition.

Where we are required by law as a platform operator to do so — in particular under the German Platform Tax Transparency Act (PStTG) — we report details of Clippers and of the payments they earned through ClipRails to the Federal Central Tax Office (Bundeszentralamt für Steuern). The details needed for it (such as name, address, date of birth and tax identification number) are then collected separately.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations, among them the anti-money-laundering rules behind the KYC check, the retention duties under tax and commercial law and, where it applies, the PStTG).

When a Clipper connects a TikTok, YouTube or Instagram account, we store its stable account id, the display name, the public profile picture and an access token (plus a refresh token, where the platform issues one). These tokens are stored encrypted (encryption at rest).

On all three platforms the access is read-only and limited to the figures a payout is calculated from. On TikTok we use the scopes user.info.basic and video.list only, to read your display name and your public videos along with their public view counts — so that a submitted clip can be matched to your account and the payout it earned can be calculated.

On YouTube we request the single scope youtube.readonly, and we use it for exactly one call, at the moment you connect: reading the channel that authorised the connection — its channel id, its channel name and its channel picture. That is the whole purpose of the scope, and it is what lets us confirm which channel is yours, so that a clip submitted later can be matched to it. The view counts your payout is calculated from are not read with this authorisation: they come from the public YouTube Data API through an API key, the same data any visitor sees under the video. We hold no YouTube data beyond the three fields named above.

ClipRails uses YouTube API Services for this. The YouTube terms of service and Google's privacy policy apply in addition. You can withdraw the access you granted us at any time in your Google account under Third-party apps with account access, independently of the Disconnect control in ClipRails.

ClipRails' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular we do not use Google user data for advertising, we do not sell it, we do not train generalised AI models with it, we transfer it to no one except as needed to provide or improve the connect described here or where the law obliges us, and no human being reads it — apart from the case where you ask us to, where security demands it, or where we are legally required to.

On Instagram we request exactly two scopes. instagram_business_basic reads the identity of the connected account — its account id, username, display name, account type and profile picture — and the list of your own videos with their caption, thumbnail and publication date, so that you can pick a clip from that list and it can be matched to your account. instagram_business_manage_insights reads the view count of exactly those videos, which is what your payout is calculated from. Both are read-only and reach no further than your own posts. The access token that carries them is stored encrypted like every other (encryption at rest). The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

Instagram releases view counts for professional accounts only (Business or Creator). That is why the account type is among the fields we read when you connect: a personal account cannot be connected, and you are told so at that moment instead of finding out weeks later, through a clip that never earned anything.

On none of the three platforms do we post, comment or change anything, and we request no access to private data. You can disconnect a connected account at any time; disconnecting ends any future access, and what it removes is described under “Deleting your data” below.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Every Community has a public page that can be reached without an account. It shows the Community's name, picture, description, channel link and announcements, its running campaigns and figures such as the number of members. Of Clippers, the page shows the approved clips (preview image, link to the post, username, profile picture, verified views and approval date) and a leaderboard with username, profile picture and verified views. Earnings, email addresses and payout countries are never public. Reactions to announcements appear only as a total.

An approved clip has already been published on your own social account; the Community page shows it as the record of the work. Once an account is deleted, the page reads “Deleted account” where its username stood.

Legal basis: Art. 6(1)(b) GDPR (the public display is part of the service described in the terms) and Art. 6(1)(f) GDPR (the legitimate interest of Creators and Clippers in making a Community's work visible).

On public Community pages and in a Creator's review queue, clips can be played in place. The player then comes from the platform concerned: YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) or Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). As soon as the player loads, the platform receives your IP address and browser data for technical reasons, may use cookies or similar technologies, and may process the data in third countries such as the USA, where the level of data protection can be lower. The platform is responsible for that processing itself.

That is why no player loads by itself. A notice stands in its place first, and content from the platform is loaded only once you choose Load clip. That consent applies to every clip until you close the browser tab, and it is noted only in your browser (session storage). You can withdraw it at any time by closing the tab. For YouTube we use the privacy-enhanced mode (youtube-nocookie.com).

Legal basis: your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR; for a transfer to a third country without an adequacy decision, additionally Art. 49(1)(a) GDPR.

Inside the application we show you notifications about events concerning your account — submitted clips, payouts or campaign status, for instance. These notifications are stored in our database and displayed in the app.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a working platform).

We only send emails that belong to your account: confirming your address, resetting your password, notices and links when your address changes, and proof and recovery links for the Twitch login. We send no newsletters or advertising emails. For sending them we use the Resend service (USA) as a processor; it receives your email address and the content of the message concerned. If you reply to one of our emails, we process your message to deal with your request.

Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract) and Art. 6(1)(f) GDPR (account security, such as the warning sent to the previous address).

When you are signed in, you can send us feedback from the account menu: a problem or a suggestion, a message and up to three screenshots. Along with it we store your account, the time, the page you opened the form from (the path only, without parameters), your app language, and your browser and operating system by name — the full browser identifier and your IP address are not stored. Screenshots are encrypted with AES-256-GCM before they are stored and can only be opened by our admins. For each new feedback our admins receive an email naming its kind and your username, never its content.

Once an admin has dealt with a feedback, it is deleted together with its screenshots 90 days later. Deleting your account deletes all of your feedback on the spot, open or dealt with.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in finding faults and improving the platform).

To prevent abuse we process data from the use of the platform. Creators can reject submitted clips with a reason or report them on suspicion of fraud; a reported clip is checked by an admin in person. Binding a social account to exactly one ClipRails account prevents limits from being dodged by moving channels around. Admins can suspend a Community or remove announcements; for that we store the reason and who acted.

If someone reports illegal content to us (§ 11 of the terms), we process the report, the reported content and — where given — the name and email address of the person reporting, in order to check the report, answer it and inform those affected.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a platform free of abuse and in correct payouts) and Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of the Digital Services Act (handling reports and giving reasons for moderation decisions).

Every time the website is called, our hosting provider Vercel processes data that is technically necessary for it: IP address, time, the address called, status code, and browser and device type. These logs serve solely the secure operation of the site, the analysis of errors and the defence against attacks; we do not combine them with other data and do not evaluate them for analytics or advertising. They are deleted automatically after a short time.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).

We use no analytics, tracking or advertising cookies and embed no analytics services. We only store entries without which the features you use do not work:

• Signing in. A session cookie keeps you signed in (for up to 30 days or until you sign out). During a sign-in, short-lived security cookies are added — protection against cross-site request forgery, the return address and the check values of the OAuth procedure — which end once the sign-in is complete, at the latest when the browser is closed or after 15 minutes.
• Connecting a social account. Three cookies secure the way to the platform and back; they expire after 10 minutes or are deleted on your return.
• Language. The cookie cliprails_locale remembers the app language you chose, for one year.
• Storage in the browser. The sign-in method you used last is kept in local storage so that the sign-in page can highlight it; it never leaves your device. For the life of a tab, the browser also notes the way back from Stripe and your consent to embedded clips.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for a service you expressly asked for) and Art. 6(1)(b) and (f) GDPR. For embedded clips your consent applies (see “Embedded clips”). You can delete every entry in your browser at any time; you may then have to sign in again.

We use service providers that process personal data on our behalf and on our instructions (processing under Art. 28 GDPR):

• Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) — hosting and operation of the application, which runs in the Frankfurt region.
• Supabase Inc. (USA) — managed PostgreSQL database; the data is held in an EU region (Frankfurt, eu-central-1).
• Inngest Inc. (USA) — background and event processing (verifying reach and triggering payouts, for instance).
• Resend (USA) — sending the emails described under “Emails”.
• Vercel Blob — image storage: uploaded profile and community pictures, the profile pictures (avatars) mirrored from a social account when it is connected, and the screenshots attached to feedback, which are stored encrypted.

Vercel, Supabase, Inngest and Resend are companies based in the USA, as is Twitch. Where data is transferred to the USA in the process or can be accessed from there, we base this on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

A Creator sees, of the Clippers in their Community, their username and profile picture, their submissions to the Creator's campaigns along with the connected account handle, the clip and its verified views, and summary figures such as the number of submissions and approved clips. A Creator does not see a Clipper's email address, payout country or payout details. A Clipper sees the reason a Creator gives for rejecting a clip. What is publicly visible is set out under “Public Community pages”. Beyond that we pass data only to the processors named above, to Stripe for payment processing and to the platforms whose interfaces we call for your connected account. We pass data to authorities only where we are required by law to do so (towards tax authorities, for instance, or on an official order).

The measures below are the ones that actually run, not a list of intentions:

• In transit. The whole site and every call to a platform API runs over TLS (HTTPS). There is no unencrypted route.
• At rest. The access and refresh tokens of connected accounts are encrypted with AES-256-GCM before they ever reach the database, each with its own random nonce; the key lives outside the database, so a copy of the database alone yields no usable token. Passwords are only ever stored as a bcrypt hash. The database itself is a managed Postgres in the EU region (Frankfurt).
• Access. Access to production data is limited to the controller named at the top. Tokens are never shown in the interface and never written to logs; they are decrypted only for the moment a call to the platform needs them.
• Deletion. Disconnecting a connected account wipes its access token, refresh token and expiry from the database on the spot — not a flag, the values themselves. From that moment we can no longer call the platform on your behalf. What that leaves standing, and how to have the rest deleted, is the section right after this one.

This section says how to have the data of a connected social account, or your whole ClipRails account, deleted — and what a deletion does not reach, so that nothing here promises more than actually happens.

Disconnecting a social account. Every connected account carries a Disconnect control under “Connected accounts” in ClipRails. It takes effect on the spot: the account's access token, refresh token and expiry are removed from the database — the values themselves, not a flag — and the account leaves your list. From that moment we make no further call to the platform in your name. On TikTok and Instagram that ends the reading of your clips' reach as well, because it runs on that authorisation; a YouTube clip's view count comes from the public API described above and is unaffected by it.

Assignment to a ClipRails account. The social platform and its stable account identifier remain assigned to your ClipRails account after disconnecting or deleting that account. This assignment has no automatic expiry and prevents the same channel being moved between accounts to bypass submission and earnings limits. Transfers require support review, consent from the previous holder or a documented recovery exception, and a fresh Connect from the named target account. We retain the assignment and transfer records, including consent, support decisions and their reasons. This does not retain access tokens after disconnecting. Contact contact@cliprails.com for a transfer or a request concerning these records.

Withdrawing the authorisation on the platform itself. This works independently of the control above, and it works whether or not you still have a ClipRails account: on Instagram under Apps and websites, on YouTube under Third-party apps with account access in your Google account, and on TikTok in the app settings under “Security and permissions”. The authorisation ends either way, and the token stored here opens nothing from that moment on; on TikTok and Instagram the next read marks the account here as needing a reconnect. Use the Disconnect control as well if you want the stored value itself gone from the database.

Deleting your whole account — as a Clipper, in the app. Your settings carry a Delete account control (avatar menu → Settings, under Close account). It takes effect on the spot and cannot be undone: your email address, your username and an uploaded profile picture are erased, the picture file included, and the credentials of every social account you had connected are removed with them. You are signed out on every device, your old username and your old address are free again the same moment, and you can register anew under that address whenever you like. What is not erased is two paragraphs down.

Deleting a Creator account. Creators can also use Settings → Close account → Delete account, including before setting up a Community. Self-service becomes available once campaigns and payments are settled: ongoing campaigns, unresolved funding, unconfirmed refunds and chargebacks still being processed prevent immediate deletion. The app names these matters and does not schedule deletion for later. Independent Clipper payouts remain payable and do not prevent deletion. After a fresh identity check and explicit confirmation, personal account data, public Community content and unfunded drafts are removed; Community addresses remain unavailable permanently. Saved payment methods and the customer profile managed by ClipRails are removed at Stripe. Payment records, relevant campaign terms and Clipper history remain; retained documents require an authorised account. If an external step fails, the account stays accessible for another attempt, although files or payment methods may already have been removed. For any deletion request the app cannot complete, write to contact@cliprails.com from the registered address; no form is required. The self-service prerequisites do not restrict this request route or your statutory rights.

A payout still owed to you survives the deletion. We do not make erasure conditional on anything — Art. 17 GDPR gives you the right without conditions we get to set — and we take no waiver of money already earned. The claim therefore stays, and the app names the amount before the last click. What changes is only how you reach it: after the deletion there is no account to log into, so it runs through contact@cliprails.com.

Your Stripe payout account is not deleted with it. Where you completed the payout onboarding, the connected account you opened stays with Stripe: Stripe is a controller in its own right for it, with retention duties of its own under payment and money-laundering law, and we cannot erase it on your behalf. Their privacy notice is linked under “Payment processing via Stripe” above.

What a deletion does not reach. Submissions, the reach recorded for them and the payouts made from them stay. They are the accounting behind money that has already moved: a Creator paid for that reach, a Clipper was paid for it, and a dispute about either can only be settled on those rows. They are therefore exempt from erasure for as long as the statutory retention periods run (Art. 17(3) GDPR, together with the tax and commercial retention duties under “Retention” below). Of the connected account itself what stays is its account id, its display name and the profile picture mirrored when it was connected — the row the submissions hang from. No token stays: those went with the disconnect. None of it carries your name any more: wherever your username stood, leaderboards and lists read “Deleted account”.

We keep account data for as long as your account exists. Recorded reach snapshots are kept as an audit trail for any payout disputes. Payment and accounting data is subject to the statutory retention periods (in particular under tax and commercial law, as a rule six to ten years). Once the respective purpose and any such period has passed, the data is deleted or anonymised. Failed sign-in attempts are removed after 24 hours, and feedback 90 days after it has been dealt with. We keep the time of your registration confirmation as proof of the contract for as long as claims under the usage contract can arise.

The payout for a clip is calculated automatically from the view counts the platform reports and the conditions of the campaign. Whether a clip is paid, however, is decided by a person — the Creator when approving it, and an admin on suspicion of fraud. A decision based solely on automated processing within the meaning of Art. 22 GDPR does not take place, and we do no profiling. Where consequences follow automatically from the campaign conditions — that a submission is no longer paid once a campaign has ended, for instance — this is necessary for the performance of the contract (Art. 22(2)(a) GDPR); you can ask at any time for a person to review it and put your point of view.

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on a legitimate interest (Art. 21). Consent you have given can be withdrawn at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR). Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object to that processing at any time on grounds relating to your particular situation. We then no longer process the data, unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

A message to contact@cliprails.com is enough to exercise them. Independently of that, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent one is the authority at the controller's seat: Berliner Beauftragte für Datenschutz und Informationsfreiheit (Alt-Moabit 59–61, 10555 Berlin).

We update this privacy notice when the processing or the service providers we use change. The version published here is the one that applies; the date under “Last updated” at the top shows the most recent change.