Information on the processing of personal data when using clippra.de and its related services.
Updated · 03.08.2026
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Lukas Fühser
Heimchesweg 13
41569 Rommerskirchen
Germany
Email: contact@clippra.de
If you have any questions about the processing of your personal data or about exercising your rights, you can contact us at any time at the address above. Further details about the provider can be found in our imprint.
As a matter of principle, we process our users’ personal data only to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with your consent or where it is permitted by statutory provisions.
Legal bases. Where we obtain consent for processing operations, Art. 6(1)(a) GDPR is the legal basis. For processing necessary to perform a contract or to take pre-contractual steps, Art. 6(1)(b) GDPR applies. Where processing is required to comply with a legal obligation, Art. 6(1)(c) GDPR applies. Where processing is necessary to safeguard our legitimate interests and your interests do not override them, Art. 6(1)(f) GDPR applies.
Retention period. Personal data is deleted once the purpose of storage no longer applies, at the latest within three months. Uploaded video files and created videos (render outputs) are deleted automatically after the plan-dependent retention period, currently 7 days, or 30 days on the Studio plan, without activity in the respective project. With a Trip Pass, this period starts no earlier than the end of the pass. Data is retained longer only where necessary, for example to perform the contract for the duration of your user account, due to statutory retention periods (in particular under commercial and tax law) or for as long as consent continues to apply.
You have the following rights under the GDPR:
The right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and the right to withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object. Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for your place of residence or the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, which is responsible for us.
To exercise your rights, an informal message to contact@clippra.de is sufficient.
Each time our website is accessed, our hosting provider automatically collects information transmitted by your browser. This includes in particular the IP address, the date and time of the request, the page accessed, the previously visited page (referrer), and your browser type and operating system. This data is technically necessary to deliver the website, ensure its stability and security, and prevent misuse.
The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).
Hosting and delivery are provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. A data processing agreement is in place with the provider. Regarding the transfer to the USA, see Section 14. Further information: Vercel privacy notice.
Where you have consented, we evaluate the use of our website statistically in order to improve our offering and performance. Processing takes place solely on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
Own statistics. We collect aggregated usage and performance data (such as pages visited and technical performance values) on our own infrastructure. The IP address is not stored; it is used only transiently to rate-limit requests.
Vercel Web Analytics. In addition we use Vercel Web Analytics provided by Vercel Inc. This service works without cookies and without cross-application recognition; collection is anonymized and based on aggregated data. A transfer to the USA takes place (see Section 14). Further information: Vercel Web Analytics privacy notice.
Where you have consented to the marketing category, we use the Meta Pixel and the Meta Conversions API (CAPI) provided by Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA). The purpose is to measure sign-ups and purchases (conversions) and the reach and advertising performance of our campaigns on Facebook and Instagram.
The following are processed: the cookies _fbp/_fbc, your hashed email address, a pseudonymous user identifier, IP address and user agent, and the respective event (such as page view, registration, checkout, purchase). Transmission happens both in the browser (pixel) and server-side (CAPI); both paths use the same event ID to avoid double counting.
The legal basis is solely your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without marketing consent no transmission to Meta takes place, neither in the browser nor server-side. You can withdraw your consent at any time via the “Cookie settings” link in the footer. The transfer is to the USA (see Section 14). Further information: Meta privacy policy.
A user account is required to use protected features. We handle login, registration and session management via the Clerk service provided by Clerk, Inc. (USA). This involves processing account and login data (such as name and email address), authentication and session data, and related log data.
The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). A data processing agreement is in place; regarding the transfer to the USA, see Section 14. Further information: Clerk privacy notice.
The core of our service is processing the video and image files, and any music, that you upload. This content is stored, technically prepared and analyzed using AI services in order to generate the video edit you requested. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
Note on depicted persons.Uploaded content may contain third parties’ personal data (such as recognizable persons in recordings). You are responsible for ensuring that you are entitled to process this content and that any required consents of depicted persons are in place.
Storage. File uploads and results are stored with Cloudflare, Inc. (USA, R2 storage service). Cloudflare privacy notice.
AI analysis and edit planning. For the content analysis of recordings we use Google Gemini, depending on our configuration either via the Gemini API or via Google Cloud Vertex AI; the provider is Google Ireland Limited (Ireland) and Google LLC (USA). Google privacy notice. To create the edit plan we use Claude by Anthropic, PBC (USA); transmitted content is generally deleted there within 30 days in accordance with the provider’s terms. Anthropic privacy notice.
Processing on our own servers. Not every automated feature relies on an external service. Speech recognition for automatic subtitles and face detection for automatic reframing run entirely on our own servers. No content is transmitted to third parties for these features.
Data processing agreements are in place with the providers named above. Regarding the transfer to the USA, see Section 14.
For paid services we use the payment provider Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). When you make a purchase, the data required for processing (such as name, email address, payment and billing data, transaction data) is processed. You enter full payment details directly with Stripe; we do not receive full card details.
The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, with regard to statutory retention obligations, compliance with a legal obligation (Art. 6(1)(c) GDPR). Regarding the transfer to the USA, see Section 14. Further information: Stripe privacy notice.
We store account, project and usage data in a database provided by Supabase, Inc. (USA). For managing processing jobs (queue) we use Upstash, Inc. (USA). The actual video processing (render workers) runs on the infrastructure of Railway (USA); uploaded content is processed there while the video edit is being generated. The legal basis is the performance of the contract and our legitimate interest in reliable operation (Art. 6(1)(b) and (f) GDPR).
Data processing agreements are in place with the providers; regarding the transfer to the USA, see Section 14. Further information: Supabase, Upstash and Railway.
We send transactional and notification emails (for example about the completion of a video or about your account) via the Resend service (Resend, USA). This processes your email address and the content of the respective message.
The legal basis is the performance of the contract or our legitimate interest in reliable communication (Art. 6(1)(b) and (f) GDPR). Regarding the transfer to the USA, see Section 14. Further information: Resend privacy notice.
To detect and fix technical errors we use Sentry, provided by Functional Software, Inc. (USA). This may involve processing diagnostic and log data including the IP address. Processing takes place exclusively on the server side.
The legal basis is our legitimate interest in the security and stability of the service (Art. 6(1)(f) GDPR). Regarding the transfer to the USA, see Section 14. Further information: Sentry privacy notice.
On individual pages we embed third-party content, which may transmit your IP address to the respective provider. This is technically necessary in order to display the content.
In detail: Spline (USA) to display interactive 3D graphics; Unsplash to display individual images; Cloudflare Turnstile (Cloudflare, Inc., USA) to protect forms against automated requests. The legal basis is our legitimate interest in an appealing and secure presentation (Art. 6(1)(f) GDPR).
Fonts are served locally from our own server; no connection to external font providers takes place.
Several of the services we use are based in the USA or process data there. A level of data protection equivalent to that of the EU is not automatically guaranteed in third countries.
Where providers are certified under the EU-US Data Privacy Framework (DPF), the transfer takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR). To our knowledge this is the case for Vercel, Clerk, Stripe, Resend, Sentry, Cloudflare, Google LLC and Upstash. In addition and otherwise, we base transfers on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You may request a copy of the safeguards from us.
If you contact us via the contact form or by email, or sign up for a waitlist, we process the data you provide (in particular your email address and your message) in order to handle your request or to inform you.
The legal basis is your consent or the handling of pre-contractual and contractual requests (Art. 6(1)(a) and (b) GDPR) and our legitimate interest in responding (Art. 6(1)(f) GDPR). The data is deleted once it is no longer required for the purpose and no retention obligations apply.
We update this privacy policy whenever changes to our data processing make it necessary, for example when introducing new services or when the legal situation changes. The version published on this page applies. If you have any questions, you can reach us at contact@clippra.de.