Privacy Policy

1. Who we are

ClipYourSaaS is operated by 2662415 Ontario Inc., 57 Fitzgerald Drive, Cambridge, Ontario N1T 0B2, Canada, a company based in Ontario, Canada. We are responsible for the personal information described in this policy, except where we process it for a customer as described below.

When a customer uses ClipYourSaaS to record their own app, any personal information that appears in that app is processed on the customer's behalf. For that information the customer is in control, and our Data Processing Addendum at https://clipyoursaas.com/dpa applies.

2. Information we collect

Account data: your name, email address and password (stored only as a one-way hash), or your basic Google profile if you choose "Sign in with Google". We also keep your workspace memberships and invitations.

Workspace content: the apps you connect, their URLs, the demo descriptions you write, your settings and the comments or revision requests you make.

Connected app sessions: when an app needs a sign-in, you sign in to your demo account yourself in our secure browser, and we keep an encrypted signed-in session; we never see or store your password. It is never shown to the AI, and you can disconnect it at any time.

Sign-in links: when an assistant or the API asks for a video of a site that needs a sign-in, it can give you a link to our secure browser. The link works for 30 minutes, for that one site only. You sign in there yourself, as in the dashboard, and we store the signed-in session for that one site, as with the dashboard sign-in; we never see or store your password. We store only a one-way hash of each link. While a link is open, we show it again to your workspace, on the video's page and to your API keys and assistants; it stops working once someone signs in with it, when the video is cancelled, or after 30 minutes.

Recordings and scripts: screen recordings of your app, screenshots, the scripts and narration we generate, and the finished videos.

Usage and billing data: the videos you create, credits bought, granted and used. We also keep billing records (amounts, tax and invoices). Payment details are handled by Stripe, listed below, and never reach our servers.

Technical logs: IP addresses, browser type, timestamps and error logs that our servers record when you use the service, plus audit logs of administrative actions.

API, assistant and webhook data: for each API key we store a one-way hash (never the key itself), the 8 characters after cys_live_ so you can tell keys apart, its name, who created it, its optional daily credit cap and when it was last used. When a request to create a video sends an Idempotency-Key, we keep the Idempotency-Key values and a hash of the request body for 24 hours, so a retried request returns the same video. For each AI assistant you connect we store the name and address it registered with, which workspace it works in, its optional daily credit cap and when it was last used; its refresh tokens are stored only as a one-way hash, and its access tokens expire within an hour. For each webhook endpoint we store its URL, its description, who created it and an encrypted signing secret. We keep webhook delivery logs (the event, status, response code and a short error, never the response body) for 30 days. No additional providers receive this data.

3. How we use it

We use your information to provide the service: to sign you in, run your workspaces, record your app, generate scripts, narration and videos, and send you emails such as email verification, password resets, workspace invitations and notices when a video is ready or has failed.

We also use it to keep the service secure, prevent abuse, enforce usage limits, fix problems, answer support requests and meet our legal obligations. We do not sell your information, use it for advertising or use your content to train AI models.

4. Legal bases (GDPR)

If the EU or UK General Data Protection Regulation applies to you, we rely on these legal bases: performance of our contract with you to provide the service; our legitimate interests in securing, supporting and improving the service; compliance with legal obligations; and your consent where we ask for it, such as before showing your video as an example.

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object as described in section 9.

5. Sharing and subprocessors

We share personal information only with service providers that help us run ClipYourSaaS, only for that purpose and under contracts that protect it. The providers we use, or can switch to, are listed below.

If you create a share link for a video, anyone with that link can view the video and, if you allow it, download it. Share links are unlisted, and you can revoke them at any time.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy will continue to apply to your information.

6. International transfers

Our application servers are hosted in Canada. Some of our providers, including our AI, voice and email providers, process data in the United States and other countries, so your information may be stored or processed outside Canada and outside your own country.

When we transfer personal information, we use contracts and other safeguards that provide a comparable level of protection. Where the GDPR requires it, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. Information processed in another country may be accessible to its authorities under its laws.

7. Retention

Recordings, scripts and narration are kept with each video so that you can revise it. Videos are kept until you delete them.

When you delete a workspace, its database records are deleted immediately, and its stored files are purged from storage shortly after. When you delete your account, any workspace where you are the only member is deleted with it.

We keep audit logs of administrative actions for security purposes, and we may keep other records where the law requires us to.

8. Security

Connected app sessions are sealed with AES-256-GCM using versioned encryption keys that we can rotate. They are opened only by code, inside an isolated job, to load your app, and are never shown to the AI.

Data is encrypted in transit, recordings run in isolated worker containers, and access to production systems is limited to staff who need it. You can read more on our Security page at https://clipyoursaas.com/security. No system is perfectly secure, but we will notify you and the authorities of a breach as the law requires.

9. Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you can ask to access the personal information we hold about you and ask us to correct it if it is inaccurate or incomplete. You can also withdraw consent, subject to legal or contractual limits.

If the GDPR applies to you, you also have the right to erasure, restriction of processing, data portability and to object to processing based on legitimate interests, as well as the right to complain to your local data protection authority.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) to know, delete and correct your personal information. We do not sell or share personal information, as those terms are defined in the CCPA, and we will not discriminate against you for exercising your rights.

To make a request, email privacy@clipyoursaas.com. We may need to verify your identity, and we will respond within the time the law requires, usually 30 days. If your information was provided to us by a customer, we may refer your request to that customer.

10. Cookies

We use only essential cookies that keep you signed in and protect your session. They are needed for the service to work.

If you follow a friend's referral link, we set one first-party cookie (cys_ref) for up to 30 days so that your sign-up is credited to them. It is essential to the referral service and is not used for tracking. To stop abuse of referral links, we count clicks per network address using a one-way hash of the address, kept for no more than an hour.

We do not use analytics, advertising or cross-site tracking cookies, and we do not allow advertising trackers on our site.

11. Children

ClipYourSaaS is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.

12. Changes

We may update this policy from time to time. We will post the new version on this page with a new date and, for material changes, notify you by email or in the app before they take effect.

13. Contact and complaints

For privacy questions or requests, email privacy@clipyoursaas.com or write to 2662415 Ontario Inc., 57 Fitzgerald Drive, Cambridge, Ontario N1T 0B2, Canada. For general support, email support@clipyoursaas.com.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). If the GDPR applies to you, you can also complain to your local data protection authority.