Legal — Privacy
Privacy Policy
Last updated — 2026-07-07
This policy explains what personal data Clepse collects, why, who processes it, how long we keep it, and the rights you have over it.
1. Who we are
The data controller is [LEGAL ENTITY NAME], Finland. Contact for anything privacy-related: [SUPPORT EMAIL]. The service is hosted in the EU (Amsterdam).
2. What we collect
- Account data — when you sign in with Google we store your email address, name, and avatar URL. We never see your Google password.
- Content you provide — topics, scripts, and reference text you enter; voiceover audio, images, and videos you upload; avatar characters and backgrounds you save; YouTube URLs you submit as style references.
- Generated content — scripts, transcripts, synthesized voiceovers, images, and rendered videos the service produces for you.
- Billing data — your Paddle customer ID, subscription status, credit balance, and a transaction ledger. We never receive or store card numbers — payment is handled entirely by Paddle.
- Usage and security data — generation, text-to-speech, and script usage records, per-feature cost records, rate-limit records, and standard server logs (IP address, browser user agent).
3. Why we process it (legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service, including AI generation from your content | 6(1)(b) — performance of contract |
| Billing, credit accounting, and fraud prevention | 6(1)(b) and 6(1)(c) |
| Rate limiting, abuse prevention, and security logging | 6(1)(f) — legitimate interest |
| Bookkeeping and tax obligations | 6(1)(c) — legal obligation |
We do not use your data for advertising, do not sell it, do not profile you, and do not make automated decisions with legal effect about you. Your content is not used to train our own models.
4. Who processes your data
We use the following processors to run the service. Your content is sent to AI providers transiently, only to fulfil the generation you requested. Where providers offer controls against using API data for model training, we rely on them.
| Provider | Purpose | Data sent | Location |
|---|---|---|---|
| Supabase | Authentication and database | Account data, project metadata, credit ledger | EU |
| Cloudflare R2 | File storage (private buckets, time-limited signed links) | Uploaded audio and images, generated media and videos | EU/Global |
| Fly.io | Application hosting | All service traffic | EU (Amsterdam) |
| Paddle | Payments (Merchant of Record) | Email, purchase and subscription details | UK/US |
| Deepgram | Speech-to-text | Voiceover audio you upload or generate | US |
| OpenRouter | AI text generation (default) | Topics, scripts, reference text | US |
| Anthropic | AI text generation (fallback) | Topics, scripts, reference text | US |
| Google (Gemini) | AI text and vision | Topics, scripts, reference text and images | US/EU |
| ElevenLabs | Text-to-speech | Script text to synthesize | US |
| Cartesia | Text-to-speech | Script text to synthesize | US |
| Inworld | Text-to-speech | Script text to synthesize | US |
| Runware | AI image generation | Image prompts derived from your script | US/EU |
| Pollinations | AI image generation (fallback) | Image prompts derived from your script | EU |
If you submit a YouTube URL as a style reference, we fetch that video's public transcript from YouTube; the transcript is used for the generation and not stored.
5. International transfers
Primary hosting and storage are in the EU. Some processors above operate in the United States; transfers to them rely on the EU–US Data Privacy Framework or Standard Contractual Clauses (GDPR Art. 46).
6. How long we keep data
| Data | Retention |
|---|---|
| Account data, saved characters and backgrounds | Until you delete your account |
| Projects and generated videos | Until you delete the project or your account |
| Heavy generation intermediates (scene media, thumbnails) | Deleted automatically 14 days after a job finishes |
| Uploaded voiceover audio and cached transcripts | Deleted automatically 30 days after upload |
| Topics, scripts, and reference text sent to AI providers | Processed transiently; not stored in our database |
| Billing and credit ledger | As long as required by accounting law |
| Rate-limit and security records | Short-lived operational data, pruned automatically |
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest.
- Erasure is self-serve — delete your account from the Account page (Credits → Delete account). This immediately removes your account, projects, uploads, generated videos, and credit balance, and cancels any active subscription.
- For any other request, email [SUPPORT EMAIL]. We respond within one month.
- You can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.
9. Children
The service is not directed at children and requires users to be at least 16 years old. We do not knowingly collect data from anyone younger; if you believe we have, contact us and we will delete it.
10. Security
Data is encrypted in transit. Uploaded and generated media live in private storage buckets accessible only through short-lived signed links. Database access is restricted with row-level security so each account can only reach its own records.
11. Changes to this policy
We will update the date at the top when this policy changes and notify signed-in users of material changes. Questions: [SUPPORT EMAIL].