1. Who we are
ClipperOps ("we", "us") is operated by Raviraj Babubhai Gilava (Proprietor). Registered address: Raghuvir Street No.4, Near Shakar Main Road, Rajkot, Gujarat 360002, India. Raviraj Babubhai Gilava (Proprietor) decides how and why your personal data is used for ClipperOps (the data fiduciary, or controller). This policy explains how we handle personal data when you use our website (https://clipperops.com), the ClipperOps Autopilot app (https://app.clipperops.com) and the ClipperOps Store.
2. What we collect
- Account data: email, name, and either a password hash (we never store your password itself) or your Google account ID if you use "Sign in with Google". Plus your plan, time zone, schedules and caption preferences (niche, language, tone, always-add hashtags, call to action, YouTube category).
- Sessions: a secure, HttpOnly sign-in cookie that lasts up to 30 days.
- Content you queue: the Google Drive folder links you give us and, for the video files in them, the file ID, name, type, size and created date. Also the captions, titles, hashtags and tags we generate, your per-clip edits, and post history (status, attempts, error messages with tokens removed, and links to published posts).
- Billing data: plan, billing period, add-ons and post credits, the Paddle customer, subscription and transaction IDs and status, and the date and time you first opened each Store pack you bought (we use it to apply the refund policy). Paddle is our merchant of record: it runs checkout and collects your payment. Card, UPI and bank details are handled by Paddle and never reach us.
- Security and service logs: server logs (such as IP address, browser type, and the requests made) used to keep the service secure and fix problems, plus an internal audit log of account events.
- Waitlist: your email address and the pack you were interested in.
3. Data from Instagram, YouTube and Google Drive
When you connect an account, you authorise access on Meta's or Google's own consent screen. We never see or store your passwords. Access tokens are encrypted before they are stored and are never shown back, even to you.
| Service | What we access | Why |
|---|---|---|
| Instagram (via Facebook Login) | Your Instagram professional account ID and username, the Facebook Page it's linked to, and permission to publish Reels to it | To publish the Reels you schedule, to the account you choose |
| YouTube (Google) | Your channel ID and name, and permission to upload videos | To upload the Shorts you schedule and show which channel is connected |
| Google sign-in (optional) | Your Google account ID, email address, name and profile picture | To create your ClipperOps account and sign you in |
| Google Drive | The files in the folder link you give us (shared as "Anyone with the link"). We list the video files and fetch them only to publish them | To find your clips and publish them. We never change or delete files in your Drive |
Exact permissions we request. Meta: instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement, business_management. Google: openid, email, profile (sign-in only), https://www.googleapis.com/auth/youtube.upload and https://www.googleapis.com/auth/youtube.readonly (to read your channel name). We do not request Google Drive OAuth access. Drive folders are read with an API key, which only works for folders you've shared by link. We do not request insights or analytics permissions, and we do not access private messages.
How publishing touches your files: for Instagram, Instagram fetches the video directly from your shared Drive link, so we don't download it. For YouTube, we download the clip to our server, upload it, and delete our copy immediately afterwards. We do not use platform data for advertising, do not sell it, and do not use it to profile anyone.
4. How we use data
- To provide the service: reading your Drive folder, generating captions, scheduling and publishing your videos, and showing your post history.
- To bill you and meet tax and legal obligations.
- To keep the service secure, prevent abuse and fix problems.
- To send essential service emails and, if you opt in, product updates.
5. Google, YouTube and Limited Use
ClipperOps uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy. You can revoke ClipperOps' access at any time from your Google Account connections page.
ClipperOps' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing features you request. We do not transfer it except as needed to provide those features, for security, or to comply with law, and we do not use it for advertising or to train AI models. When you disconnect YouTube or delete your account, we delete the YouTube data we hold for it straight away.
6. AI caption processing
By default, captions are written by our own template engine on our servers, and nothing leaves ClipperOps. When AI captions are switched on, we send only the clip's file name, the niche, the language and the tone you chose to our AI provider, OpenAI (through its API). No video, frames, audio, account names or tokens are sent. OpenAI's API terms say API data isn't used to train its models by default. If the AI provider fails, we fall back to the template engine.
7. Sub-processors
We share data only with these service providers, under terms that limit how they use it, or when the law requires it:
| Provider | Purpose | Data |
|---|---|---|
| Oracle Cloud Infrastructure | Hosts the ClipperOps app, database and backups in India | All app data listed above |
| Cloudflare | Website hosting (Pages), DNS, CDN, and the secure tunnel to our app server | Website and app traffic (IP address, requests) |
| Paddle (Paddle.com Market Limited and its affiliates) | Merchant of record: runs checkout, takes payment, collects applicable tax and handles invoices and refunds for subscriptions, add-ons, post packs and Store packs. Paddle uses this data as an independent controller under the Paddle Privacy Policy | Name, email, country and postcode, the payment details you enter at checkout, and the order and subscription details |
| OpenAI (only if AI captions are on) | Drafting captions | Clip file name, niche, language, tone |
| Meta and Google | The platforms you connect (Instagram Graph API, YouTube Data API, Drive API, Google sign-in) | What's needed to sign you in and publish |
8. Retention and deletion
We keep account data while your account is active. Temporary video copies (YouTube only) are deleted right after upload, and a cleanup job runs every few hours to remove anything older than 6 hours, so no copy lasts beyond 24 hours. Sign-in sessions expire after 30 days. When you delete your account, your data is removed from our live database immediately and ages out of our nightly backups within 14 days. Paddle, our merchant of record, keeps its own payment and tax records as the law requires. Full details are on the Data deletion page.
9. Cookies and local storage
The Autopilot app uses a secure, HttpOnly sign-in cookie so you stay logged in for up to 30 days. On the marketing website and sign-in pages we also keep a random identifier in the browser's local storage so we can count unique visits without a tracking cookie. That identifier is not a name, email address or account id. On our servers it is stored only as a one-way hash, and we do not store raw IP addresses with it. Country is taken from the Cloudflare request header when present. Browsers that send a Do Not Track or Global Privacy Control signal are not counted. These counts are kept for about 13 months and are used only to understand how the site is used. You can clear local storage in your browser at any time.
10. Security
Access tokens are encrypted at rest with rotating keys and never returned by our API. Passwords are hashed with scrypt. Traffic is encrypted in transit (TLS). Sign-in is rate-limited and protected against cross-site request forgery. Error messages are scrubbed of tokens before they're stored. Access to production data is limited to staff who need it. No system is perfectly secure, so please tell us about any concern.
11. Your rights
Under India's Digital Personal Data Protection Act, 2023 and other laws that apply to you, you can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to act for you. Email [email protected] and we'll respond within 30 days. You can delete your account yourself at any time in Settings → Delete account.
12. Children
ClipperOps is not meant for anyone under 18, and we don't knowingly collect data from children.
13. Contact and grievance officer
Questions or complaints: [email protected]. Grievance officer: Raviraj Babubhai Gilava, [email protected], Raghuvir Street No.4, Near Shakar Main Road, Rajkot, Gujarat 360002, India. We may update this policy and will post the new date at the top. We'll email account holders about significant changes.