Clipbeat Privacy Policy

1. Introduction

This policy explains what personal data Clipbeat ("we", "us") collects when you use clipbeat.app and its apps, why we collect it, who processes it and what choices you have. Contact: [email protected].

2. Information We Collect

Account information

• Email address, display name and profile picture from the provider you sign in with (Google, TikTok, YouTube or Instagram)
• Your purchases, credit balance and credit history

Content you create

• Audio files you upload, transcribed lyrics, prompts, generated images, video shots, music and voice
• Project data (timeline, titles) synced to your account so you can continue on another device
• Messages you send to the AI Director in Studio and its replies, and the looks you ask it to create (shortened)

Connected social accounts

• OAuth tokens (stored encrypted), account username and display name, profile picture URL

Payments

• Card payments are processed by iyzico (iyzico Ödeme Hizmetleri A.Ş., a licensed payment institution in Turkey). We receive the video or credit pack you bought, amounts and transaction IDs — never your full card details, which are handled by iyzico.

Usage and device data

• Product events such as uploads, AI generations, exports and checkout steps
• A hashed (not raw) IP address, browser user agent and referring page
• Marketing source of your first visit: UTM campaign parameters, the referring website (domain only) and the landing page. We do not collect ad click IDs such as gclid or fbclid.
• Error logs used for debugging

Your own API keys (optional)

If you add your own fal.ai or OpenRouter key, it is stored in your browser and those requests go directly from your browser to the provider. We do not receive these keys.

2a. Your face and voice — saved characters, My artist and lip-sync (biometric data)

Effective October 23, 2026. These features let you appear in your own music videos with your own face and voice. They are optional and only used if you turn them on in Studio. They are for adults (18+) only, and only for your own face and voice or those of another adult who agreed (see Terms section 6a). Celebrities, public figures and minors are never allowed.

What we collect

• "Me" and saved characters: one photo of a face (a selfie or an uploaded photo), the name and short description you give it, the results of our automatic photo check, and the date and time you confirmed it is you or a person who agreed.
• My artist: 3 to 6 photos of you that you upload; a four-view "character sheet" of you that we generate from those photos (front, two three-quarter views, full body); and a short text description of your stable visible features (for example hair, eye color, freckles) generated from the sheet. It never contains your name.
• My artist consent record: the consent text version, the name you typed to confirm, date and time, IP address and browser user agent.
• Voice clone: not offered. Clipbeat does not offer voice cloning and does not create a copy of anyone's voice. If you recorded a voice for cloning before November 2026, email us and we will delete it, including at our voice provider.
• Lip-sync: the scene image with the singer's face and the vocal part of your song that the lip-sync model needs to make the shot.
• Results of our automatic photo checks (for example "more than one face" or "adult not confirmed") and, for each scene with your face, a 1-5 likeness score.
• The scenes, voice-overs and videos you generate with these features (your content, see section 2).

Why this is sensitive data, and our legal basis

Photos, facial features and voice recordings used to recreate a specific person can be biometric data — a special category of personal data under the GDPR (Article 9), the Turkish KVKK (Article 6) and US state laws, and "sensitive personal information" under the California CCPA/CPRA. We process it only with explicit consent, which you give in the app before a face is saved or checked: a confirmation that the photo shows you, or an adult who agreed, for saved characters; and two separate checkboxes plus your typed name (your written electronic release) for "My artist". You can withdraw your consent at any time by deleting the data (see "Your controls" below); this does not affect processing that already happened.

What we use it for — and nothing else

• Checking that each photo is usable and shows one adult person, the same person in every photo, and not a promotional photo, screenshot or poster of someone else.
• Building your character sheet and generating the scenes, lip-synced shots and voice-overs you ask for, with you in them.
• Checking that a generated scene still looks like you, so we can retry or repair the face automatically.
• Handling abuse reports and disputes (consent record only).

We do not use your photos, voice or likeness to train AI models, we do not sell, lease, trade or share them for advertising, and we do not use them to identify you or anyone else. We do not create or store face recognition templates or "embeddings": a likeness check compares two images at the moment of generation and only the 1-5 score is kept. The safety filters of our AI providers stay on for every image and video we generate, including scenes with your face, and cannot be turned off. Artists flagged by our checks (for example a possible public figure) are reviewed by a person at Clipbeat.

Who processes it

• Cloudflare (R2) — stores your photos and character sheet privately; files are only shared through short-lived signed links.
• fal.ai (USA) — runs the image models (Google's Nano Banana family) that build your sheet and scenes, the video models that animate scenes, and the lip-sync and face repair models. When we build your sheet and artist scenes we ask fal.ai not to store the request data, and character-sheet images on fal.ai's servers expire after one hour.
• Google (USA), through fal.ai and OpenRouter — the image and video models and the photo and likeness checks (Gemini). On the paid services we use, Google does not use your data to train its models; it may keep it for a limited time (up to 55 days) to detect abuse. Google adds an invisible SynthID watermark to generated images and videos.
• OpenRouter (USA) — routes the photo and likeness checks to the AI model. We only allow providers that do not train on or store this data where such an option exists.
• MiniMax — generates voice-overs from text with its stock voices. It does not receive photos of your face and is not used for voice cloning.
• Replicate (USA) — only as a backup when animating a scene into video fails at fal.ai.
• Hetzner (Germany) — our servers and database (consent records, check results, file references).

These providers act on our instructions under data processing terms. Transfers outside the EU/EEA rely on the European Commission's Standard Contractual Clauses (and, where the provider is certified, the EU-US Data Privacy Framework).

How long we keep it (retention schedule)

• A saved character's photo is kept until you delete the character or your account. After you delete it, it is no longer used in any job and the file is removed from storage by our cleanup job.
• Your artist's photos, character sheet and feature description are kept until you delete your artist, delete your account, or 12 months after you last used your artist — whichever comes first. We email you 30 days before that automatic deletion.
• Photos that fail our checks are deleted immediately. An artist that is never finished is deleted after 7 days.
• When an artist is deleted we remove the photos and sheet from storage and our database, normally within minutes and at most within 24 hours.
• We keep only a minimal consent record (artist ID, dates, consent version, and one-way keyed hashes of your consent and typed name) for 3 years to handle disputes and abuse reports. It cannot be used to recreate your face.
• Images, voice-overs and videos you already made with these features are your content and stay in your projects until you delete them. Copies of generated scene images on fal.ai's delivery network are reachable only through a long random link and follow fal.ai's retention; we cannot delete those copies ourselves.
• In any case we permanently destroy biometric data no later than when the purpose of collecting it has been satisfied or 3 years after your last interaction with Clipbeat, whichever is earlier.

AI-generated label

Videos with your face or voice are AI-generated. Exports that contain your artist carry a small visible "AI-generated" label, and cloud renders also contain a machine-readable note in the video file.

Your controls

• Delete a saved character at any time: Studio → Settings → Characters → Delete.
• Delete your artist at any time: Studio → AI Director → My artist → Delete my artist.
• Ask for a copy of your photos, recordings and consent record, or for their deletion: [email protected].
• If someone used your face or voice without your permission, email [email protected] with "likeness" in the subject. We disable the related character or artist and the related public content within 48 hours while we investigate. You can do this even if you have no Clipbeat account.

Where "My artist" is not available

"My artist" is not offered to residents of Illinois, Texas or Washington (USA). Users confirm this when they create an artist, and we block it when our network location shows one of these states. To do this, our server looks up the approximate country and state of your IP address in an offline database stored on our own server; the IP address is not sent to a third party for this check.

IP geolocation by DB-IP, licensed under CC BY 4.0.

2c. Artist pages and showing your videos

Effective November 16, 2026. If you choose “Show this video on my artist page” for a video, we publish a page at clipbeat.app/a/your-stage-name. This is off by default and happens only for the videos you turn it on for.

What becomes public

• The stage name you choose (not the name on your account), and an optional short bio and links to your profiles on music and social platforms.
• The videos you show, their titles and the text you add about them. For songs that appear to be made with an AI music service or are covers, the video is shown with the sound off.
• These pages can be indexed by search engines. When you hide a video or your page, we notify search engines so they drop it.

What we record

For each change we keep a consent record: the version of these terms, the time, and which boxes you ticked (rights confirmation and, if the video may show your face, face consent). The record contains no IP address, device or email. We keep it for 3 years after you hide the video, to handle disputes and complaints.

Your face

A video that may show your face is shown only with your separate, explicit consent for that video (our legal basis for this sensitive data is your explicit consent, as described in section 2a). You can withdraw it at any time by hiding the video; it goes offline immediately.

Your controls

You can hide a single video or your whole page at any time from the Studio. Children's videos are never shown.

2b. Connected accounts — YouTube and TikTok

You can connect a YouTube or TikTok account in Studio (Settings → Connected accounts) to publish a finished video directly. This is optional and only happens when you click Connect and approve access on the platform's own screen.

• What we access: for YouTube, we use the YouTube Data API to upload the video you choose (youtube.upload) and to read your channel name and picture (youtube.readonly, userinfo.profile) so you can see which channel is connected. For TikTok, we read your nickname and avatar (creator info) and upload the video you choose (video.upload, video.publish).
• What we store: the access and refresh tokens (encrypted), the account ID, display name, handle and avatar URL. While a post is processing, Studio uses the upload/publish ID, its status, any failure reason and the published post ID returned by the platform to show progress and a link to the post; these are not kept in our database. We do not read or store your other videos, comments, subscribers or analytics.
• How we use it: only to publish the videos you select, with the title, description and privacy setting you choose, and to show you the result. We never post without your action.
• Sharing: this data is not sold, not used for advertising, not used to train AI models and not shared with anyone except the platform itself.
• Removing access: click Disconnect in Studio to delete the stored tokens and account details immediately. You can also revoke access at Google security settings or in TikTok (Settings → Security → Manage app permissions). Deleting your Clipbeat account deletes all of it.

Clipbeat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our YouTube publishing uses YouTube API Services: by connecting YouTube you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies.

3. How We Use Your Information

• Provide the Service: transcription, AI generation, project sync, export and publishing
• Manage your purchases, credits and payments, and prevent abuse of promotional credits
• Send service emails (for example, welcome and account emails); you can unsubscribe from non-essential emails at any time
• Understand which pages and features work, and fix problems
• Review AI Director requests and replies to improve its suggestions and results

We do not sell your personal data, and we do not use your uploads to train AI models.

4. Service Providers

We share data only with providers that help us run the Service:

• Hetzner — application servers and database
• Cloudflare — website hosting, CDN and file storage (R2) for uploads and generated media
• fal.ai, OpenRouter, MiniMax, Replicate — AI processing of the audio, prompts and images you send to them (for saved characters, "My artist" and lip-sync, including photos of your face and the vocal of your song — see section 2a)
• Pexels, Pixabay — stock media search (your search terms)
• iyzico (iyzico Ödeme Hizmetleri A.Ş., Turkey) — card payment processing and refunds
• Cloudflare Email Service — sending emails
• Google Analytics, Microsoft Clarity — only if you allow analytics cookies
• YouTube, TikTok, Instagram — when you connect an account and publish a video

Some of these providers process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

5. Cookies and Similar Technologies

Analytics cookies are off until you allow them. Google Analytics and Microsoft Clarity are not loaded at all without your consent, so no data is sent to them. If you decline, existing analytics cookies are deleted. We also use your browser's local storage for preferences, drafts and (optionally) your own API keys. When a page crashes, we send an error report (error message, page path without query, browser details) to our own servers to fix bugs — it sets no cookies and contains no personal data.

First-party cookies are set on .clipbeat.app so that the website and the apps share your choice. Change your cookie settings.

6. Data Retention

We keep account data for as long as your account exists. Uploads and projects are kept until you delete them or your account; media that no longer belongs to a project is cleaned up automatically. Photos and character sheets for "My artist" are deleted when you delete your artist or after 12 months without use (see section 2a). Payment records are kept as long as required for tax and accounting.

7. Data Security

• HTTPS encryption for all data in transit
• Encrypted storage of OAuth tokens
• Server-side access control on every account resource

8. Your Rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you and receive a copy
• Correct inaccurate data
• Delete your account and associated data
• Object to or restrict certain processing
• Withdraw consent for analytics at any time (Cookie settings in the footer)
• Withdraw your consent for "My artist" at any time by deleting your artist
• Disconnect social media accounts at any time
• Lodge a complaint with your local data protection authority

To exercise these rights, email [email protected].

9. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. "My artist" is only for adults (18+): we reject photos where we cannot confirm that the person is an adult, with no override.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the date above.

11. Contact Us

Questions about this policy or your data: [email protected]