Data Processing Agreement
Last updated:2/11/2026
Agreement Overview
This Data Processing Agreement ("DPA") describes how CLIPPO processes personal data on behalf of its users and the technical and organizational measures we implement to protect that data.
1. Data We Process
The following categories of personal data are processed through the CLIPPO platform:
Identity & Account Data
- Name, email, username
- Hashed password (bcrypt)
- Profile image URL and bio
- Account role
Financial Data
- Payment method and payment email
- Payment details (bank info, crypto wallet)
- Earnings, balance, payout history
- Transaction IDs for processed payouts
Content & Performance Data
- Submitted content URLs
- View, like, comment, and share counts
- Daily performance statistics
- Campaign participation and earnings per submission
Social Media Data
- Platform usernames and verification status
- Profile bios (scraped for verification)
- Verification codes and attempt history
Application Data
- Creator demographics (age, country, niche, follower count)
- Brand details (company name, promotion types, budget)
- Proof video URLs
- Admin review notes
Support & Communication Data
- Support ticket subjects and message threads
- Bug reports with browser and page context
- Feature requests
- Notification history
2. Third-Party Data Processors
We use the following sub-processors to deliver our services:
Infrastructure
- Vercel: Hosting, analytics, speed insights
- PostgreSQL (via Prisma): Primary data storage
- Upstash Redis: Session caching (5-min TTL), rate limiting
- Cloudflare R2: File storage (thumbnails, images)
Services
- Apify: Scrapes TikTok/Instagram content metrics and profile bios
- Resend: Transactional email delivery
- Pusher: Real-time notifications and support chat
3. Security Measures
We implement the following technical and organizational measures:
Authentication & Access
- Passwords hashed with bcrypt
- JWT-based session tokens
- HttpOnly secure cookies in production
- Role-based access control (Creator, Brand, Admin)
Rate Limiting & Abuse Prevention
- Login: 5 attempts per minute
- API requests: 100 per minute
- Payout requests: 3 per hour
- Clip submissions: 10 per hour
Financial Security
- Distributed locks on payout operations
- Prevents concurrent financial transactions
- Admin review required for payouts
- Payout details captured at request time
Account Verification
- Social account verification via bio codes
- Verification attempt limits with lockout periods
- Expiring verification codes
- Verification hash tracking
4. Data Retention
Persistent Data
- Account data retained while account is active
- Application data retained for review purposes
- Payout records retained for financial auditing
- Rejected video URLs retained to prevent resubmission
Temporary Data
- Session cache: 5-minute TTL
- Rate limit data: sliding windows (1 min to 1 hr)
- Distributed locks: 30-second TTL
- General cache: configurable TTL (default 5 min)
5. Data Deletion
Cascade Deletion
When a user account is deleted, the following data is permanently removed via cascade deletion:
- All clip submissions and daily statistics
- All payout records
- All social account connections
- All notifications
- All support tickets and messages
- All bug reports and feature requests
- All auth sessions and accounts
6. Data Subject Rights
Your Rights
- Access: Request a copy of your data
- Rectification: Correct inaccurate data
- Erasure: Request account and data deletion
- Portability: Receive data in a portable format
- Objection: Object to specific processing
How to Exercise Rights
- Email support@clippo.media with your request
- We will respond within 30 days
- Identity verification may be required
- Requests are handled on a case-by-case basis
7. Contact
Get in Touch
For questions about this Data Processing Agreement or to exercise your data rights:
Email: support@clippo.media