Last updated: 2026-07-02 — Draft. Legal review pending before public launch. The clauses below are implementation-complete pending counsel sign-off.
All data is used exclusively to provide the AutoClip service — generating personalised clip candidates and content recommendations for your channel. We do not sell your data, share it with advertisers, or use it to train models for other users.
AutoClip accesses YouTube data via the YouTube API Services under your authorisation. Your YouTube data is handled per the Google Privacy Policy. You can revoke access at any time via Google Security Settings. Analytics data is refreshed periodically and not retained indefinitely.
AutoClip's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, AutoClip:
AutoClip uses the following third-party sub-processors to deliver the service. Each sub-processor is bound by a Data Processing Agreement (DPA) or equivalent contractual instrument. For the full sub-processor record including transfer mechanisms and DPA details, see docs/SUBPROCESSORS.md.
| Vendor | Purpose | Data categories |
|---|---|---|
| Anthropic | LLM inference (DNA synthesis, clip scoring, AI chat) | Creator analytics summaries and behavioural patterns (no raw PII, no email, no OAuth tokens enter prompts) |
| Voyage AI | Text embeddings for semantic search and DNA similarity | Anonymised transcript segments, creator DNA profile text |
| Deepgram | Speech-to-text transcription | Creator audio (spoken word only; no video frames uploaded) |
| Cloudflare R2 | Object storage (source video files and rendered clips) | Uploaded video bytes, rendered Shorts clips (creator-owned content) |
| Stripe | Payment processing | Name, email, payment card data (Stripe-tokenized; AutoClip never sees raw card numbers) |
| Google / YouTube | OAuth identity and YouTube Data API (channel metadata, analytics) | YouTube channel ID, channel title, video metadata, aggregated analytics |
All sub-processors listed above are US-based. Personal data transferred from the European Economic Area (EEA) or United Kingdom to these processors is governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Art. 46(2)(c), as recorded in docs/SUBPROCESSORS.md.
None of the sub-processors listed above are currently self-certified under the EU–US Data Privacy Framework (DPF) for this account relationship. SCCs are therefore the operative transfer mechanism for all vendors. This will be updated if any vendor becomes DPF-certified and that certification is confirmed at dataprivacyframework.gov.
You may request deletion of all your data at any time via the account deletion option in your profile settings. This revokes our OAuth access, deletes all stored data (including telemetry logs), and purges all media files. The deletion record we retain contains no personal data — only an internal identifier as evidence the erasure occurred.
Deletion takes effect immediately in our live systems; copies of your data may persist in encrypted, access-restricted backups for up to approximately 56 days before expiring, and if we ever restore from a backup, deletions are re-applied so erased accounts are not restored.
Access & portability: you may request a copy of your data at any time. AutoClip generates a machine-readable JSON export of your profile, channel DNA, videos and metrics, clips, feedback, outcomes, chat history, and billing records, with download links for your rendered clips. The export is prepared on request and made available as a download from your account.
EU/UK residents: you have additional rights under the GDPR / UK GDPR, including the right to access, rectification, restriction of processing, and the right to lodge a complaint with your national supervisory authority. To exercise these rights, contact us at [email protected].
This section applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
Categories of personal information collected: identifiers (Google account ID, email, YouTube channel ID); internet or other electronic network activity (clip interactions, session data); commercial information (billing records); inferences drawn from this information (channel DNA, content style profile).
Purposes of collection: to provide and improve the AutoClip service as described in this policy.
We do not sell or share your personal information. AutoClip does not sell personal information to third parties, and does not share personal information for cross-context behavioural advertising purposes.
Your CCPA rights: you have the right to know about personal information collected, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of sale or sharing (not applicable — we do not sell or share). To exercise these rights, contact [email protected].
Global Privacy Control (GPC): we recognise the Global Privacy Control browser signal as a valid opt-out-of-sale/sharing preference. Because AutoClip does not sell or share personal information, a GPC opt-out is satisfied by default — the signal does not need to change how your data is handled, and we do not log or store it.
AutoClip is a general-audience service not directed to children under 13. We do not knowingly collect personal information from anyone under the age of 13 (or the applicable minimum age in your jurisdiction — 16 in EU member states that have adopted the GDPR Article 8 digital-consent age of 16). We screen for minimum age at account creation: users must affirmatively confirm they are 13 or older before the sign-in flow can be completed.
If you believe that a child under the applicable minimum age has created an account, please contact us at [email protected]. We will promptly investigate and, if confirmed, delete the account and all associated personal data.
This section constitutes AutoClip's COPPA notice for purposes of the US Children's Online Privacy Protection Act (16 CFR Part 312, as amended effective 2025-06-23). AutoClip does not have actual knowledge that it has collected personal information from users under 13.
AutoClip uses strictly necessary cookies only:
No analytics trackers, advertising pixels, or third-party cookies are set. Because only strictly-necessary cookies are used, no consent banner is required under the ePrivacy Directive.
OAuth tokens are encrypted at rest using industry-standard symmetric encryption. All data is transmitted over TLS. We minimise stored PII to what is strictly necessary for the service.
In the event of a personal data breach, you may be notified at the email address registered with your account. Data breach queries and reports can be directed to [email protected]. Once a Data Protection Officer (DPO) is designated, this section will be updated with the DPO contact and the relevant supervisory authority referral.
For questions or data requests: [email protected]