Information on the processing of personal data when using clippra.de and its related services.
Updated · 04.11.2026
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Lukas Fühser
Heimchesweg 13
41569 Rommerskirchen
Germany
Email: contact@clippra.de
If you have any questions about the processing of your personal data or about exercising your rights, you can contact us at any time at the address above. Further details about the provider can be found in our imprint.
As a matter of principle, we process our users’ personal data only to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with your consent or where it is permitted by statutory provisions.
Legal bases. Where we obtain consent for processing operations, Art. 6(1)(a) GDPR is the legal basis. For processing necessary to perform a contract or to take pre-contractual steps, Art. 6(1)(b) GDPR applies. Where processing is required to comply with a legal obligation, Art. 6(1)(c) GDPR applies. Where processing is necessary to safeguard our legitimate interests and your interests do not override them, Art. 6(1)(f) GDPR applies.
Retention period. Personal data is deleted once the purpose of storage no longer applies, at the latest within three months, unless the following sections state a different retention period. Uploaded video files and created videos (render outputs) are deleted automatically after the plan-dependent retention period, currently 7 days, or 30 days on the Studio plan and for projects in the Studio editor, without activity in the respective project. With a Trip Pass, this period starts no earlier than the end of the pass. After a Reel Unlock purchase, the project is deleted no earlier than seven days after the purchase. If you delete a project yourself, clips and music are deleted immediately; the finished video is kept for another 30 days and then permanently deleted. Regardless of this, finished videos and animations from the Studio editor are deleted 30 days after they were created. What happens when you delete your account is described in Section 7. Data is retained longer only where necessary, for example to perform the contract for the duration of your user account, due to statutory retention periods (in particular under commercial and tax law) or for as long as consent continues to apply.
You have the following rights under the GDPR:
The right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and the right to withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object. Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) and (3) GDPR, see Section 11).
Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for your place of residence or the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, which is responsible for us.
To exercise your rights, an informal message to contact@clippra.de is sufficient.
Each time our website is accessed, our hosting provider automatically collects information transmitted by your browser. This includes in particular the IP address, the date and time of the request, the page accessed, the previously visited page (referrer), and your browser type and operating system. This data is technically necessary to deliver the website, ensure its stability and security, and prevent misuse.
The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).
Hosting and delivery are provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. A data processing agreement is in place with the provider. Regarding the transfer to the USA, see Section 14. Further information: Vercel privacy notice.
Where you have consented, we evaluate the use of our website statistically in order to improve our offering and performance. Processing takes place solely on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
Own statistics. We collect aggregated usage and performance data (such as pages visited and technical performance values) on our own infrastructure. The IP address is not stored; it is used only transiently to rate-limit requests.
Usage events in your account. Where you have consented and are logged in, we store individual events of your use together with your internal account identifier, for example that a project was created, a video finished, an offer was shown or clicked, or a video was downloaded. An event consists of the time, the type of event, the identifiers of the project and video concerned, and a few selection values, such as the chosen type of reel or coarse device characteristics like operating system and browser. We do not store text you type or file names here. The purpose is to evaluate where users drop out and which features they use (for example whether a scene in the edit proposal is replaced), in order to improve our offering, features and checkout flow. Whether a purchase took place follows independently from our booking records (Section 9). After 90 days we remove your account identifier and the identifiers of the project and video from the event and round the time down to the day; what remains is a counter with no link to your account. If you delete your account, we delete the events that are still linked to your identifier at that point (Section 7).
Source attribution. Where you have consented and create a user account, we link to your account, once, the source through which you first reached our website (based on the cookie described in Section 5). The purpose is to evaluate through which channels users find our service. Only the scope stated there is stored, in particular neither the full referring address nor a history of your visits. The first recorded value remains and is not changed by later visits. This information is deleted together with your account.
Vercel Web Analytics. In addition we use Vercel Web Analytics provided by Vercel Inc. This service works without cookies and without cross-application recognition; collection is anonymized and based on aggregated data. A transfer to the USA takes place (see Section 14). Further information: Vercel Web Analytics privacy notice.
Where you have consented to the marketing category, we use the Meta Pixel and the Meta Conversions API (CAPI) provided by Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA). The purpose is to measure sign-ups and purchases (conversions) and the reach and advertising performance of our campaigns on Facebook and Instagram.
The following are processed: the cookies _fbp/_fbc, your hashed email address, a pseudonymous user identifier, IP address and user agent, and the respective event (such as page view, registration, checkout, purchase). Transmission happens both in the browser (pixel) and server-side (CAPI); both paths use the same event ID to avoid double counting.
The legal basis is solely your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without marketing consent no transmission to Meta takes place, neither in the browser nor server-side. We do not use the Meta Pixel on the withdrawal and cancellation pages. You can withdraw your consent at any time via the “Cookie settings” link in the footer. The transfer is to the USA (see Section 14). Further information: Meta privacy policy.
A user account is required to use protected features. We handle login, registration and session management via the Clerk service provided by Clerk, Inc. (USA). This involves processing account and login data (such as name and email address), authentication and session data, and related log data.
The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). A data processing agreement is in place; regarding the transfer to the USA, see Section 14. Further information: Clerk privacy notice.
Voluntary answer on how you found us. In the logged-in area we ask how you heard about Clippra (for example ChatGPT, Google or a friend); if you name an AI, you can also tell us what you asked it (up to 200 characters, please without personal details). The answer is voluntary, is stored with your account, is used to evaluate how users find our service (legitimate interest, Art. 6(1)(f) GDPR), and is deleted together with your account.
Deleting your account. You can delete your account in your profile. Clerk deletes your login details and notifies us. We then immediately delete your uploaded clips and music, your Studio videos and animations, your brand kit including the logo, cached image analyses of your clips, your daily usage statistics, the usage events still linked to your identifier (Section 6), your answer described in Section 8.1 and any entry of your email address on our waitlist; shared links stop working. From that point your projects and finished videos, including purchased ones, can no longer be accessed, and they are permanently deleted after 30 days together with their title, description, analyses and ratings. We cancel an active subscription at the end of the paid period, or immediately if an invoice is outstanding (Section 9); purchased credit is forfeited. From your user record with us we delete your email address, language setting, source information (Section 6), your answer on how you found us, and your consents including their timestamps.
We keep internal identifiers without an email address (including those of your former Clerk and Stripe accounts), plan, sign-up date and credit balances, the records of purchases and credit (Section 9), notes on free offers you used, and any withdrawal or cancellation declarations with name and email address (Section 15.1). We keep the purchase records while statutory retention obligations apply, usually eight years from the end of the calendar year (Art. 6(1)(c) GDPR); they also serve refunds and chargebacks (Art. 6(1)(f) GDPR). We keep the notes on free offers to prevent abuse (Art. 6(1)(f) GDPR), no longer than the purchase records; declarations are covered by Section 15.1. If you unsubscribed from our emails, your address stays on our suppression list permanently so that we do not contact you again.
The core of our service is processing the video and image files, and any music, that you upload. This content is stored, technically prepared and analyzed using AI services in order to generate the video edit you requested. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
Note on depicted persons.Uploaded content may contain third parties’ personal data (such as recognizable persons in recordings). You are responsible for ensuring that you are entitled to process this content and that any required consents of depicted persons are in place.
Storage. File uploads and results are stored with Cloudflare, Inc. (USA, R2 storage service). Cloudflare privacy notice.
AI analysis and edit planning. For the content analysis of recordings we use Google Gemini, depending on our configuration either via the Gemini API or via Google Cloud Vertex AI; the provider is Google Ireland Limited (Ireland) and Google LLC (USA). Google privacy notice. To create the edit plan we use Claude by Anthropic, PBC (USA); transmitted content is generally deleted there within 30 days in accordance with the provider’s terms. Anthropic privacy notice.
Processing on our own servers.Not every automated feature relies on an external service. Speech recognition for automatic subtitles and face detection for automatic reframing run entirely on our own servers. No content is transmitted to third parties for these features. For effect reels, we detect the sky or the main subject (such as a person, a vehicle or an animal) in individual frames of your recordings on our own servers and separate it from the background, so that your text can sit behind the subject or the cut-out subject can pop into the next clip; no content is transmitted to third parties for this either. These methods only distinguish between subject and background and do not recognize who is shown. This creates a mask file, a short video that contains only the cut-out part of your recording. We store it like your uploads and delete it together with the project’s clips (see retention period in Section 2), including when you delete the project or your account (Section 7).
Data processing agreements are in place with the providers named above. Regarding the transfer to the USA, see Section 14.
Effect reels. If you enter your own text for an effect reel, we use it only to place it in your video. It is stored with the project and deleted together with it, and it is not transmitted to AI services; the finished video is subject to the retention period in Section 2. Please do not include personal details of third parties in the text. To select suitable clips, we analyze your recordings with Google Gemini as described above, including for the free effect reel. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
Rating of the finished video. After a video is finished, we ask whether you would post it as it is. Answering is voluntary. If you choose “Not yet”, you can also select reasons and write a comment (up to 1,000 characters, please without personal details). We store your answer with its link to your account, the project and the video, and evaluate it to improve our edits and, where useful, to reply to you about your feedback, for example by email (legitimate interest, Art. 6(1)(f) GDPR). We delete the comment together with the clips of the project (see retention period in Section 2), including when you delete the project or your account. We keep the rating and reasons as long as the project exists and delete them together with it. If you answer the question described in Section 8.1, the rating is kept there as part of your feedback until your account is deleted.
After your first finished video, we may ask what you would like in your next reel. The question appears while the project’s clips are stored, until you answer or skip it; your browser remembers that you skipped it (see Section 5). Answering is voluntary. The purpose is to develop our service further: we evaluate which wishes users express and which of them our editing can deliver.
We process the text of your answer (up to 500 characters), the time you sent it, its number of words, your earlier rating of the video, and its link to your account, the project and the video created. We also assign your answer to a topic category by hand (for example pace or music). Whether the question was shown to you and whether you skipped it, including the time, is recorded only if you have consented to analytics (see Section 6). Please do not enter names or other personal details.
The legal basis for the answer is our legitimate interest in improving our service (Art. 6(1)(f) GDPR); for recording display and skipping, it is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We evaluate the answers ourselves and do not pass them on to third parties; they are stored in our database (see Section 10). The answer text is deleted together with the project’s clips (see retention period in Section 2), including when you delete the project or your account. We delete the category, word count, earlier rating, time and links, without the text, at the latest together with your account.
For paid services we use the payment provider Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). When you make a purchase, the data required for processing (such as name, email address, payment and billing data, transaction data) is processed. When you first start a purchase, we create a Stripe customer record with your email address and internal identifiers of your Clippra account. With each purchase we pass on these identifiers and, if present in your browser, the Meta cookie identifiers (Section 6.1). You enter full payment details directly with Stripe; we do not receive full card details. Stripe processes this data on our behalf; for its own purposes such as fraud prevention and its legal obligations, Stripe is itself responsible.
You can also pay with PayPal. Stripe then redirects you to PayPal, where you log in and confirm the payment; for a subscription you also authorise the recurring charges for it there until you cancel. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, processes the data required for the payment (such as name, email address, payment and transaction data) as an independent controller and may transfer it to PayPal group companies outside the EU. Through Stripe we only receive payment details, such as the name and email address of your PayPal account, never your PayPal login details. Further information: PayPal privacy statement.
If you pay with Apple Pay or Google Pay, the payment runs on the card stored in your wallet. Apple or Google processes data under its own privacy terms, which you agreed to when setting up the wallet.
If you delete your account, we cancel an active subscription at the end of the paid period and end a subscription with an outstanding invoice immediately. We close any open checkout, and once no subscription is running we delete your Stripe customer record including saved payment methods. We keep invoices, payment records and the details of individual purchases while statutory retention periods apply (eight years from the end of the calendar year, sec. 147 AO, sec. 14b UStG); Stripe keeps them under its own retention rules. If a purchase you started before deleting your account is only completed afterwards, we do not credit it; we refund it and immediately end any subscription it created.
The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, with regard to statutory retention obligations, compliance with a legal obligation (Art. 6(1)(c) GDPR); for the Meta cookie identifiers, your consent (Section 6.1). Regarding the transfer to the USA, see Section 14. Further information: Stripe privacy notice.
We store account, project and usage data in a database provided by Supabase, Inc. (USA). For managing processing jobs (queue) and for short-lived counters to prevent abuse we use Upstash, Inc. (USA). The actual video processing (render workers) runs on the infrastructure of Railway (USA); uploaded content is processed there while the video edit is being generated. The legal basis is the performance of the contract and our legitimate interest in reliable operation (Art. 6(1)(b) and (f) GDPR).
Data processing agreements are in place with the providers; regarding the transfer to the USA, see Section 14. Further information: Supabase, Upstash and Railway.
We send transactional and notification emails (for example about the completion of a video or about your account) and the emails about new features and offers described below via the Resend service (Resend, USA). This processes your email address and the content of the respective message.
The legal basis for transactional and notification emails is the performance of the contract or our legitimate interest in reliable communication (Art. 6(1)(b) and (f) GDPR). Regarding the transfer to the USA, see Section 14. Further information: Resend privacy notice.
Emails about new features and offers. If you have an account with us, we also use your email address to occasionally inform you about new Clippra features and offers, for example new style templates or a discount code; this only covers our own services. We point this out when you sign up. The legal basis is Section 7(3) of the German Act Against Unfair Competition (UWG) in conjunction with our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). If you have subscribed to the monthly update in your profile, the legal basis for it is your consent (Art. 6(1)(a) GDPR).
You can object to this use at any time (Art. 21(2) GDPR): via the unsubscribe link in each of these emails or with an informal message to contact@clippra.de. This incurs no costs other than transmission costs at basic rates. After that, we no longer use your address for such emails and add it to our suppression list (Section 7). You will still receive necessary emails about your account and your purchases.
To detect and fix technical errors we use Sentry, provided by Functional Software, Inc. (USA). Processing takes place on our servers and, if you have consented to the “Analytics” category, also in your browser. Without this consent, error monitoring is not loaded in your browser and your browser sends no error reports to Sentry.
If an error occurs, our servers or, after your consent, your browser send an error report to Sentry. It contains the error message, the address of the page or request concerned without its parameters, the previously visited page (referrer, likewise without parameters), details of your browser, operating system, language and time zone, and a technical log of the last steps before the error: pages opened, controls clicked and input fields used, with their technical identifiers and assigned labels, technical requests made by the application and browser console messages. We do not transmit the content of your videos. Your IP address is processed when the report is sent.
The legal basis for processing on our servers is our legitimate interest in the security and stability of the service (Art. 6(1)(f) GDPR). The legal basis for processing in your browser is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the “Cookie settings” link in the footer; after that, your browser sends no further error reports. Regarding the transfer to the USA, see Section 14. Further information: Sentry privacy notice.
On individual pages we embed third-party content, which may transmit your IP address to the respective provider. This is technically necessary in order to display the content.
In detail: Spline (USA) to display interactive 3D graphics; Unsplash to display individual images; Cloudflare Turnstile (Cloudflare, Inc., USA) to protect forms against automated requests. The legal basis is our legitimate interest in an appealing and secure presentation (Art. 6(1)(f) GDPR).
Fonts are served locally from our own server; no connection to external font providers takes place.
Several of the services we use are based in the USA or process data there. A level of data protection equivalent to that of the EU is not automatically guaranteed in third countries.
Where providers are certified under the EU-US Data Privacy Framework (DPF), the transfer takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR). To our knowledge this is the case for Vercel, Clerk, Stripe, Resend, Sentry, Cloudflare, Google LLC and Upstash. In addition and otherwise, we base transfers on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You may request a copy of the safeguards from us.
If you contact us via the contact form or by email, or sign up for a waitlist, we process the data you provide (in particular your email address and your message) in order to handle your request or to inform you.
The legal basis is your consent or the handling of pre-contractual and contractual requests (Art. 6(1)(a) and (b) GDPR) and our legitimate interest in responding (Art. 6(1)(f) GDPR). The data is deleted once it is no longer required for the purpose and no retention obligations apply.
If you submit a notice via “Withdraw from contract here” or “Cancel contracts here”, we process the details from the form (name, email address, contract details and, for a cancellation, its type, any reason and the requested end date), the time of receipt, a receipt number and, if you are signed in, your account identifier. We do not store your IP address with the notice itself. To prevent abuse, we briefly count with Upstash (Section 10) how many notices arrive per IP address (for IPv6 only per network prefix) and per email address or account (the email address only as a hash). We use the per-IP counters to limit the number of notices, of our internal notifications about suspected spam and, unless the confirmation goes to the email address of your signed-in account, the number of confirmation emails; we use the per-address or per-account counter to limit confirmation emails to the same address. This is based on our legitimate interest in a working form (Art. 6(1)(f) GDPR). These counters expire after 24 hours at most.
We use this data to confirm receipt to you by email without delay, to process your notice (for example a refund or ending the contract) and to be able to prove that it arrived in time. The legal basis is compliance with our legal obligations under Sections 356a and 312k of the German Civil Code (Art. 6(1)(c) GDPR) and the handling of the contract (Art. 6(1)(b) GDPR). We send the confirmation email via Resend (Section 11).
We keep these notices for as long as claims under the contract can be asserted and statutory retention obligations apply, and delete or anonymise them afterwards.
We update this privacy policy whenever changes to our data processing make it necessary, for example when introducing new services or when the legal situation changes. The version published on this page applies. If you have any questions, you can reach us at contact@clippra.de.