Privacy Policy
Effective date: 2026-10-24 · Last updated: 2026-10-24
ClipVeil exists to reduce the personal information in the videos you share — and we apply the same discipline to our own data handling. This Privacy Policy explains what personal data we collect when you use clipveil.com (the "Service"), why we collect it, how long we keep it, and the choices you have.
1. The short version
- Your account is an email address. We use one-time verification codes; we hold no passwords and offer no third-party sign-ins.
- Your videos are working data, not an archive. Direct-upload originals are deleted within 2 hours of preprocessing; workspaces and results are kept for 48 hours; share copies expire with their links. We keep no backups beyond these deadlines — no off-retention archives, no object versioning.
- We don't build profiles. We do not transcribe speech, do not collect playback duration, completion rates or "verified viewer" counts, run no advertising or cross-site tracking, and never sell personal data.
- Payments run through Paddle, our Merchant of Record. Paddle processes your payment data and shares with us the transaction data needed to run your account (see §5).
2. Who we are and who this policy covers
The Service is operated by an individual seller based in Mainland China ("we", "us"), which is the controller of the personal data described here; the operator's identity and address were provided to Paddle for merchant verification and are available on written request. Privacy contact: [email protected].
This policy covers the Service at clipveil.com. It does not cover the processing performed by Paddle as Merchant of Record (payment processing, fraud screening, invoicing) — see Paddle's Privacy Policy at paddle.com — or by other providers you use on your own (for example, your email provider).
3. What we collect, and why
3.1 Account and sign-in data
- Email address (normalized: trimmed, lower-cased domain) — identifies your account and receives the one-time sign-in codes.
- Verification challenge records — digests only, never the codes in plain text. Deleted within 24 hours after a challenge expires, is used or is replaced.
- Login session records — opaque session tokens stored only as digests, valid up to 12 hours; digests are cleared within 24 hours after expiry or sign-out.
- Rate-limit counters (per mailbox and per source IP, rolling windows) — protect against code-request and code-guessing abuse; cleared within 24 hours after the window closes.
Purposes: giving you access to your account; preventing brute-force and abuse. Legal bases (GDPR terms): performance of the contract; legitimate interest in security.
3.2 Your media and processing artifacts
Videos you upload, and everything derived from them for processing: the normalized master, review proxy, audio track, timeline data, person thumbnails, audition clips, your review decisions and manual regions, and the result masters.
Retention by artifact:
| Artifact | Retention |
|---|---|
| Direct-upload original file | Deleted as soon as preprocessing succeeds; at most 2 hours from upload |
| Long-recording source and its previews/index | Deleted once the derived clip artifacts are validated; at most 2 hours after source upload completes |
| Event workspace and result masters (incl. review decisions, thumbnails, auditions) | 48 hours from first upload |
| Share copies, recipient identity, token digests | Until the share link expires (24/48 hours); revoked links stop serving immediately |
| Share access records | 90 days after the link expires |
| Deletion audit traces | 90 days after the deletion |
Deletion is enforced by an automated lifecycle service (checks at most every 15 minutes, deletion within 15 minutes of a trigger under normal operation). We keep no media, recipient identity, review content or token data beyond these deadlines — no off-retention backups, no object versioning, no logs of that content. You can also delete media actively at any time, and closing your account triggers immediate cleanup.
Purposes: performing the redaction service you requested. Legal basis: performance of the contract.
3.3 Share data and access records
When you create a share link you enter a recipient name; it is burned into the watermark on the share copy and kept in your share records until the link expires. For each share link we keep access records: a stable identifier, the share and result version, UTC timestamps, the requesting IP address and client information — for 90 days after the link expires, so you can audit who accessed your shared footage.
We do not track playback duration, completion, or whether a person actually watched; access records show that the link was used from a given client, not the identity of the viewer.
Purposes: providing controlled sharing; your audit trail. Legal bases: performance of the contract; legitimate interest in security.
3.4 Billing data
If you purchase a plan or minute pack: your purchase records, subscription status, metering ledger and quota state, and the Paddle customer ID that links your account to Paddle. We never receive your full payment credentials — card and wallet data are handled by Paddle as Merchant of Record. Paddle shares with us the transaction data needed to activate and manage your entitlements (e.g., order references, subscription state, your email address). Purchase and accounting records are retained for 10 years as required for tax and accounting purposes.
Purposes: billing, entitlement management, tax compliance. Legal bases: performance of the contract; legal obligation.
3.5 Security and audit records
- Workspace access checks are enforced on every request; violations are recorded for security.
- Deletion traces (what was deleted, when, with what result): 90 days.
- Account closure records: opaque identifiers, timestamps, result and cleanup status — no email, no media — for 90 days.
- Security and migration event traces: opaque subject references, events, timestamps — 90 days; no codes, no plaintext credentials, no email.
Purposes: security, integrity, abuse prevention. Legal basis: legitimate interest; legal obligation where applicable.
3.6 Technical preferences
Theme and language preferences are stored in your browser only, never in your account, and never leave your device with us.
4. What we deliberately do not do
- No speech transcription or word-level redaction — audio is only muted, beeped or kept.
- No playback or viewing analytics: no actual-play-duration, completion-rate or authenticated-viewer metrics.
- No advertising, no cross-site or cross-product tracking, no sale of personal data.
- No retention of media or share identity beyond the deadlines in §3.2 — no off-retention backups or archives.
5. Who we share data with
- Paddle (Merchant of Record): processes your payments, taxes, invoices, refunds and chargebacks; receives your email address and order data, and payment credentials we never see.
- Email delivery provider: delivers sign-in codes; sees the delivery address and message envelope. Provider: Resend.
- Hosting/infrastructure provider: runs the Service and its storage. The site is served through the Cloudflare CDN; the application and its storage run on third-party cloud infrastructure.
- Legal process: we may disclose data where required by law, to respond to lawful requests, or to protect our rights and the safety of others, notifying you where legally permitted.
We do not otherwise share your personal data with third parties, and we do not sell it.
6. Retention summary
| Data | Kept until |
|---|---|
| Email address (active account) | Until account closure (then removed within 24 hours) |
| Verification challenge digests | ≤ 24 hours after use/expiry/replacement |
| Session digests | ≤ 24 hours after invalidation |
| Rate-limit counters | ≤ 24 hours after window |
| Upload originals / sources | ≤ 2 hours (see §3.2) |
| Workspaces and results | 48 hours |
| Share copies, recipient identity, tokens | Link expiry (24/48 hours) |
| Share access records | Link expiry + 90 days |
| Deletion traces / closure records / security traces | 90 days |
| Billing records | 10 years |
| Account closure identity | Active identity cleared within 24 hours of closure; opaque closure record kept 90 days |
7. Security
- Every read/write is checked against your personal workspace; other users' data is indistinguishable from nonexistent data to you.
- Session and API tokens are stored only as digests; cookies are HttpOnly and Secure in production; traffic runs over TLS.
- Share playback is app-mediated — media is only ever served after per-request token validation, and share tokens are 128-bit random values kept only as digests.
- Results leave the platform with device and location metadata removed and redaction destructively burned in.
- Payments run through Paddle's certified payment infrastructure.
No system is perfectly secure; if a security incident ever affects your data, we will notify you and the competent authorities as required by law.
8. Your rights
Where you live, you may have the right to: access your personal data; have it corrected or erased; restrict or object to processing; data portability; and withdraw consent where processing is based on it. You can exercise many of these directly in the product: delete media at any time, review your share and purchase history, and close your account (irreversible — deletes media and ends shares and subscriptions). For anything else, contact [email protected]; we respond within the statutory period (up to 30 days where GDPR applies). You may also lodge a complaint with your local supervisory authority.
9. International transfers
The Service is served through the Cloudflare CDN from third-party cloud infrastructure; Paddle and our email provider may process data in other regions. Where required, transfers rely on appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms required by applicable law.
10. Children
The Service is not intended for anyone under 16. If we learn of an account held by a minor, we close it.
11. Changes to this policy
We may update this policy; the "Last updated" date will change and, for material changes, we will notify you in the Service or by email where reasonably practicable. Prior versions are available on request.
12. Contact
[email protected] · clipveil.com