Privacy Policy

Last updated: [DATUM]

This Privacy Policy explains what personal data we process when you

• visit our website theclippinghouse.com (the “Website”),
• use Clipping Studio at clips.theclippinghouse.com as a team member (the “Studio”), or
• connect a YouTube, TikTok or Instagram account to the Studio.

Together, we call the Website and the Studio the “Service”.

Clipping Studio is an internal tool for a small team. It turns long videos into short vertical clips. A person reviews every clip before it is published to, or sent as a draft to, a connected social media account. The Studio is not public: only team members enabled by an admin can sign in.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer because we are not legally required to do so (Art. 37 GDPR, Section 38 BDSG).

2. What data we process

2.1 When you visit the Website

When you open the Website, our hosting provider Cloudflare automatically processes technical data sent by your browser. The page cannot be delivered without it:

• IP address,
• date and time of the request,
• page requested,
• browser type and version, operating system,
• referrer (the page you came from).

The Website sets no cookies. It uses no analytics or advertising services and loads no external fonts or content.

2.2 When you use the Studio (team members only)

Access protection by Cloudflare Access. Before the Studio's sign-in page even appears, Cloudflare Access checks that you belong to the team. To do this, Cloudflare processes your [email address – ANMELDEMETHODE PRÜFEN] and sets the strictly necessary cookie CF_Authorization.

User account. For each team member we store:

• username,
• password, only as a hash (a one-way check value, not the password itself),
• role (admin or member),
• optionally, the secret key for two-factor sign-in (authenticator app),
• when the account was created, who created it, and the time of the last sign-in.

Session cookie. After you sign in, the Studio sets the cookie clipping_session. It keeps you signed in and protects forms against misuse (CSRF protection). It is strictly necessary, cannot be read by scripts (HttpOnly) and is only sent to our own site (SameSite=Strict). The session ends after 30 minutes of inactivity, and after 12 hours at the latest.

Security log. To detect misuse and fend off attacks, we log:

• failed sign-in attempts, per username and per IP address, with temporary lockouts,
• important actions in the Studio with time, username and IP address, such as signing in, approving a clip, or changing settings or connected accounts.

Content you submit. When you submit a video, we process:

• the link to the video (e.g. YouTube) or the uploaded video file,
• title, options, and who submitted the video and when,
• the resulting clips and their titles, descriptions, hashtags and per-platform captions,
• the review status (approved, discarded) and who set it,
• scheduled and completed posts and their result,
• optionally, campaign details (name, link, required text) and links to published posts.

Videos may contain the image and voice of people, including third parties. To make clips, the audio is converted to text (transcript). This happens on our own server; no data is sent to third parties for this. Whoever submits a video is responsible for having the necessary rights.

2.3 When you connect a social media account

Team members can connect their YouTube, TikTok or Instagram accounts to the Studio. This uses each platform's official login (OAuth). We never see your password for the platform. You decide on the platform's own page which permissions you grant.

We receive and store from the platform:

• the account ID and display name of the account,
• access tokens (access and refresh token). They are stored encrypted in our database, together with their expiry time,
• the permissions granted and the connection status.

We request exactly these permissions per platform:

Optional: statistics. Only if you also allow “statistics” when connecting do we request additional permissions: TikTok user.info.profile, user.info.stats, video.list; Instagram instagram_business_manage_insights; YouTube youtube.readonly. We use them to fetch figures for your account, such as followers, views and likes, and the list of your videos. We show them to you and your team in the Studio.

Before a direct post to TikTok, we also query your TikTok account's current settings (creator_info). This lets us show only the privacy and interaction options TikTok allows for your account.

We send the platform only what you approve: the video file, title, description or caption, hashtags, and the settings you chose for the post (privacy, comments, Duet/Stitch, commercial content disclosure).

We use this data only to publish your clips to your own account and to show you the statistics. We do not sell it, use it for advertising, or share it with anyone else, except for the technical service providers in section 4 where they are needed to run the Service.

YouTube. The Studio uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service. The Google Privacy Policy also applies. You can revoke the Studio's access at any time in your Google account settings. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect an account at any time in the Studio under Einstellungen → Verknüpfte Accounts (Settings → Linked accounts). We then delete the stored tokens. You can also revoke access directly on the platform:

• TikTok: Settings → Security and permissions → Apps and services
• Instagram: Settings → Apps and websites
• Google/YouTube: see the link above

3. Purposes and legal bases

No automated decisions. An AI suggests moments for clips. A person always decides whether a clip is published. We do not make automated decisions within the meaning of Art. 22 GDPR and do not carry out profiling.

4. Recipients and service providers

We run the Studio on [our own hardware in Germany – PRÜFEN]. The following service providers receive data where needed for their task:

Once a clip is published on a platform, that platform's terms and privacy policy apply to it. Public posts can be seen, shared and saved by anyone there.

Beyond this, we only share data where we are legally required to (e.g. with authorities) or where it is necessary to enforce our rights. We do not sell data.

Transfers outside the EU. Some service providers are based in the USA. The European Commission has issued an adequacy decision for the USA, but only for companies certified under the EU-U.S. Data Privacy Framework. For all others we use the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy.

5. Retention

Statutory retention obligations remain unaffected.

6. Your rights

You have the right to

• access the data we store about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability, i.e. a copy in a common, machine-readable format (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR), e.g. by disconnecting a connected account.

To exercise these rights, email us at kontakt@theclippinghouse.com. To make sure no one requests someone else's data, we may need to verify your identity.

Right to lodge a complaint. You can lodge a complaint with a data protection supervisory authority, e.g. in the country or German state where you live. The authority responsible for us is: [NAME UND ADRESSE DER LANDESDATENSCHUTZBEHÖRDE].

7. Whether you must provide data

You don't have to give us any data to use the Website. You can't use the Studio without a user account. Without a connected account, the Studio can't publish anything for you on that platform.

8. Security

We protect data with technical and organizational measures, including:

• encrypted connections (HTTPS),
• access protection in front of the Studio,
• passwords stored only as hashes, optional two-factor sign-in,
• automatic lockout after failed attempts,
• encrypted storage of access tokens and API keys,
• permission checks: team members only see their own connected accounts.

No system on the internet is completely secure, so we cannot guarantee absolute security.

9. Children

The Service is not intended for anyone under 16. We do not knowingly process children's data. If you believe this has happened, please contact us and we will delete the data.

10. Links to other sites

The Service contains links to sites of other providers, such as YouTube, TikTok and Instagram. Those providers are responsible for how they handle data. Please read their privacy policies.

11. Changes

We update this Privacy Policy when the Service or the law changes. The version published on this page applies. We inform team members of material changes in the Studio.

12. Contact

Questions about privacy? Email us at kontakt@theclippinghouse.com or write to the address in section 1.