← Back to home

Privacy policy

Last updated: June 20, 2026

1. Governance and data protection officer

The controller responsible for the processing and protection of personal information (within the meaning of Quebec's Law 25 and the GDPR) is:

  • Identity: Benoit De Grandpré (the "Publisher").
  • Contact: support@clipsify.ai.

The Publisher pledges to process your data with respect for transparency, purpose limitation, and data security.

2. Personal information collected

We only collect data strictly required to provide the Service:

  • Identity data: Email address (for authentication and service communications).
  • Financial data: Payment information (processed end-to-end securely by Stripe; the Publisher never stores or accesses credit card numbers).
  • Usage data: Submitted text content, transcripts and summaries saved in your workspace, IP address, browser type, and technical system metadata.

3. Purposes of processing and legal basis

Your data is processed to:

  • Perform the contract (provide the SaaS, generate summaries, manage subscriptions).
  • Serve our legitimate interest (secure the application, fix bugs, improve user experience).
  • Comply with legal obligations (accounting, Stripe-related tax compliance).

Important note: Your usage data is never sold to third parties, nor used to train public artificial intelligence models.

3.1 Non-sale and non-sharing of data (CCPA/CPRA)

Clipsify does not sell your personal information to third parties and does not "share" it within the meaning of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), for cross-context behavioral advertising purposes. Should our practices change, we would immediately update this policy and implement a visible opt-out mechanism (a "Do Not Sell or Share My Personal Information" link) on our website.

4. Processors and transfers outside Quebec / outside the European Union

To run Clipsify, we share certain data with the following trusted subprocessors:

  • Supabase (authentication, encrypted database).
  • Vercel (interface hosting).
  • Stripe (payment management and billing).
  • Anthropic (AI API for summary generation).
  • Supadata (transcription metadata extraction API).
  • Google (third-party authentication provider, when the user chooses "Sign in with Google").

Enhanced safeguards: In compliance with Law 25 and the GDPR, Privacy Impact Assessments (PIAs) were carried out prior to transfers. Standard contractual clauses (SCCs) adapted to the requirements of Law 25 and the GDPR are implemented. Where applicable, Clipsify also relies on the EU-U.S. and Swiss-U.S. Data Privacy Framework (DPF) for transfers to the United States. The Publisher undertakes to transfer personal data only to jurisdictions offering an adequate level of protection or subject to appropriate safeguards.

5. Data retention period

  • Account data and saved summaries are retained as long as your account remains active.
  • For free accounts, history is limited to the 10 most recent summaries; older ones are automatically purged.
  • Prolonged inactivity: Any account remaining completely inactive for eighteen (18) consecutive months will be automatically deleted after an email notice remains unanswered for 30 days.

6. Your rights (Law 25, GDPR, CCPA)

You have the following rights regarding your personal information:

  • Right to access and rectification.
  • Right to erasure (right to be forgotten) and account deletion.
  • Right to restrict processing and right to object.
  • Right to data portability in a structured, commonly used format.

To exercise these rights, please send your signed request to support@clipsify.ai. We will respond within a maximum of 30 days.

7. Cookies

Clipsify exclusively uses technical cookies that are strictly necessary for authenticating your session and maintaining your display preferences. No third-party advertising or tracking cookies are deployed.

8. Security and incident management

We apply strict organizational and technical security measures (TLS/SSL encryption, restricted access control). In the event of a confidentiality incident involving a risk of serious injury to your personal information, the Publisher will notify the Commission d'accès à l'information du Québec (CAI) as well as the affected users, in accordance with the law.

9. Supervisory authorities (complaints)

If you believe your rights have not been respected, you may file a complaint with the competent authority:

  • In Quebec: the Commission d'accès à l'information (CAI).
  • In Europe: the data protection authority of your country of residence (e.g., the CNIL in France).