Clipstack
Créer un compte

Privacy Policy

Last updated: October 24, 2026

1. Introduction

This privacy policy describes how Clipstack (hereinafter "we", "our") collects, uses and protects the personal data of users of the clipstack.fr platform and its associated mobile application.

We are committed to complying with applicable personal data protection regulations, in particular the General Data Protection Regulation (GDPR) and the French Data Protection Act.

2. Data controller

The controller of personal data is:

  • Company name: Marketech Adv
  • Legal form: Simplified joint-stock company with a sole shareholder (SASU)
  • Registered office: 35 Rue Jean Ferrat, 34000 Montpellier, France
  • Trade and Companies Register: 103 370 532 R.C.S. Montpellier
  • Legal representative: Alban Huntziger (President)
  • Email: team@clipstack.fr

3. Data collected

3.1 Registration data

  • Email address
  • Password (stored as a hash)
  • Chosen role (Creator, Brand or Agency)

3.2 Profile data

  • First name and last name
  • Biography
  • Profile picture (uploaded image)
  • Phone number (verified via OTP code)

3.3 Connected TikTok account data

When you connect your TikTok account via OAuth 2.0, we access the following data with your consent:

  • Basic profile information (username, avatar, identifier)
  • Profile statistics (number of followers)
  • List of published videos
  • Video statistics (number of views, likes) — synchronized periodically to calculate compensation

TikTok access tokens are stored securely on the server side and automatically renewed (refresh token).

Access to your TikTok account is strictly read-only. Clipstack has no permission allowing it to publish, modify, delete or interact with content on TikTok, YouTube or any other social network belonging to the user. Publishing clips on TikTok is carried out exclusively by the user themselves, outside of the Platform.

3.4 Connected Instagram account data

When you choose to connect your Instagram professional account (Business or Creator) through Instagram Login, we request read access to your profile, Reels and their insights. The permissions are instagram_business_basic and instagram_business_manage_insights.

  • Account identifier, username, display name and profile picture
  • Existing Reels: media identifier, publication date, permalink, media type, thumbnail when available and account ownership
  • Reel insights: views, likes, comments and shares as aggregate counts
  • Access token and expiry date, stored only on our server

We use this information to display your connected account, list Reels available for selection and verify ownership of a submission. We store references to submitted Reels and periodically collect performance snapshots to display campaign progress and calculate compensation under the campaign rules. Instagram statistics can be delayed or unavailable.

Clipstack does not receive your Instagram password. We do not request access to private messages, comment text or the identity of individual viewers. We do not request permissions to publish content, send messages or manage comments. You publish your Reels yourself on Instagram.

You may disconnect Instagram from your Clipstack profile. This clears the connection's stored tokens and stops further collection through that connection. You may also revoke the authorization in Instagram settings. Disconnecting or revoking access does not automatically remove the data already collected by Clipstack; see our Data deletion instructions.

3.5 Connected YouTube channel and Shorts

Where the YouTube integration is enabled, Clipstack uses YouTube API Services. You may authorize read-only access to your own channel through Google OAuth, using the youtube.readonly permission. Google's Privacy Policy applies to Google's processing. We do not receive your Google password or request permission to upload, download, edit or delete your YouTube videos.

  • Channel identifier, channel name, handle and profile image reference
  • Uploaded video identifiers, titles, descriptions, publication dates, thumbnail references and public visibility
  • Duration and owner-only file format information used to check that a selected video is square or vertical and eligible as a Short
  • Aggregate video view, like and comment counts; the Data API does not provide share counts
  • Access and refresh tokens and their expiry dates, stored only on the server

We use this data to connect your channel, list eligible public Shorts, verify ownership of a selected video and show its performance in Clipstack. When you submit a Short to a campaign, you expressly authorize that campaign's Brand and its authorized Agency members to see the selected content and its associated account information and performance counts. They do not receive your Google tokens. Clipstack's campaign compensation is a contractual Clipstack calculation, not YouTube revenue or a metric provided or endorsed by Google or YouTube.

We use Google user data only for these user-facing features, not for targeted advertising, sale of personal data or training generalized AI models. Clipstack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

YouTube account and submitted-video metadata are checked daily while collection is enabled. Data that cannot be refreshed or whose authorization cannot be verified is erased within 30 days. Stored YouTube performance snapshots have a rolling maximum retention of 30 days. We keep image references hosted by Google rather than downloading additional copies. These YouTube rules take precedence over the general campaign retention periods below. Financial amounts and accounting records are kept separately, without retaining the deleted YouTube identifiers or counters.

Disconnect YouTube from your Clipstack profile to revoke Google access and erase the stored channel information, submitted-video references and performance snapshots. The same erasure applies when you delete your Clipstack account. You may also revoke access through Google security settings; our daily authorization check detects withdrawn access, including accounts without active campaigns. Erasure stops tracking and YouTube participation in those same campaigns cannot resume. It never deletes videos on YouTube. See Data deletion instructions or contact team@clipstack.fr for questions or complaints.

3.6 Financial data

  • Wallet balances and the ledger of transactions
  • Status of the identity verification and of the payout account held with our payment providers
  • Bank details (IBAN, BIC, beneficiary name), only for Campaigns paid directly by a Brand or Agency
  • Invoicing details of Brands and Agencies (company name, address, VAT number)

Card payments and withdrawals are processed by our payment providers (Whop, and Stripe for historical operations): card details and the bank details used for withdrawals are entered directly with them and are not stored by Clipstack. The bank details used for direct payment are stored encrypted and shown only to the payer of the Campaign.

3.7 Campaign and content data

  • YouTube video URLs and associated metadata (title, thumbnail, duration, channel name)
  • Campaign cover images, logos
  • Campaign rules and parameters
  • References to submitted TikTok clips, YouTube Shorts and Instagram Reels (URL, video identifier, thumbnail)

3.8 Messaging data

  • Messages and their history of edits, voice messages, photos, videos, files and reactions exchanged in conversations and groups
  • Conversation metadata: participants, dates, read receipts, presence and typing indicators (real time only)
  • Blocks and reports, including a copy of the reported message and its attachments

Messages are visible only to the participants of the conversation. Clipstack staff do not read conversations, except for reported messages and the few messages surrounding them, where required by law, or to protect the security of users. Before publication, message texts are automatically checked against a list of prohibited terms; this check takes place on our servers and does not involve any third party.

3.9 Technical data

  • Authentication token (JWT) stored locally on your device
  • Theme preferences (light / dark)
  • Push notification token of your device
  • IP address and browsing data (server logs)

4. Access to device features

The mobile application may request access to the following features. Each access is requested by the operating system the first time it is needed, is used only following your action, and can be withdrawn at any time in your device settings:

  • Photo library: to select images and videos (profile picture, logo, campaign cover, group image, content sent in a conversation). No background access.
  • Camera: to take a photo or record a video sent in a conversation.
  • Microphone: to record voice messages and the sound of videos recorded from the application.
  • Files: to select a document sent in a conversation.
  • Push notifications: to notify you of new messages and of activity on your campaigns.
  • Clipboard: to copy share links at your request.
  • In-app browser: for TikTok, YouTube and Instagram OAuth authentication via a secure session.

The application does not access your location, contacts or calendar.

5. Purposes of processing

Your data is collected for the following purposes:

  • Managing your user account and authentication
  • Connecting Creators with Brands / Agencies
  • Providing the messaging service (delivering messages, notifications and attachments)
  • Moderating content: automatic filtering of prohibited terms, processing of reports and blocks, sanctions against abusive users
  • Tracking clip performance (synchronization of TikTok, YouTube and Instagram statistics)
  • Calculating and paying out compensation via our payment providers
  • Displaying YouTube metadata in campaigns
  • Storing uploaded images on secure cloud infrastructure
  • Sending notifications related to your activity and to campaigns
  • Improving our services (anonymized analysis)
  • Complying with our legal obligations (accounting, taxation)

6. Legal basis

The processing of your data is based on:

  • Performance of the contract: for the provision of our services (account management, campaign submissions, performance tracking and payments).
  • Consent: for connecting your TikTok, YouTube or Instagram account (OAuth), access to your photo library, camera and microphone, and push notifications.
  • Legitimate interest: for improving our services, preventing fraud, moderating content and ensuring the security of the platform.
  • Legal obligation: for the retention of accounting and tax data.

7. Subprocessors and data sharing

Your data may be shared with the following third parties, in strict compliance with our obligations:

  • Whop: card payments of Advertising Credit, identity verification of beneficiaries and withdrawals
  • Stripe: historical payment processing, bank transfers and management of beneficiary profiles (banking data)
  • Cloudflare (R2): hosting of uploaded images (profile pictures, logos, covers) and, in private storage, of messaging attachments
  • Customer.io: sending of transactional emails and push notifications. A notification of a new message may contain a short excerpt of it; Customer.io never receives the contact details of other users
  • TikTok (Open Platform): OAuth authentication and retrieval of video statistics
  • Google (YouTube Data API): Google OAuth authentication, retrieval of public campaign metadata and authorized channel/video data
  • Meta (Instagram Platform): Instagram Login and retrieval of your connected account's profile, Reels and insights. Your use of Instagram is also governed by Meta's privacy policy.
  • Vercel / Railway: hosting of the application and API

Your data may also be disclosed to the competent authorities upon legal request.

We never sell your personal data to third parties.

When you submit a Reel to a campaign, the Brand and its authorized Agency members can see the submitted content, your associated creator/account information and the campaign performance statistics needed to review and manage the submission. They do not receive your Instagram access tokens.

8. Transfers outside the European Union

Some of your data may be transferred to countries located outside the European Union, in particular the United States, as part of our use of technical providers (Vercel, Cloudflare, Stripe, Whop, Customer.io, TikTok, Google, Meta).

These transfers are governed by appropriate safeguards in accordance with the GDPR, in particular:

  • Standard Contractual Clauses (SCCs) adopted by the European Commission.
  • The use of providers holding certifications or recognized as offering an adequate level of protection.

You may obtain a copy of these safeguards by contacting us at team@clipstack.fr.

9. Storage and security

We implement appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure or destruction:

  • Encryption of sensitive data: passwords are hashed before storage; communications are encrypted over HTTPS.
  • Secure authentication: JWT tokens transmitted via HTTP header (Bearer token). No authentication cookie is used.
  • Restricted access: access to data is limited to authorized personnel only, following the principle of least privilege.
  • Secure token storage: TikTok, YouTube and Instagram tokens are stored server-side only and are not included in account responses sent to your browser or mobile application.
  • Secure cloud infrastructure: images are stored on Cloudflare R2 (S3-compatible, encrypted at rest).
  • Monitoring and regular audits: we carry out regular security checks on our systems.

Client-side session data (JWT token, theme preferences) is stored in the device's local storage (AsyncStorage on mobile, localStorage on web).

10. Retention period

Your data is kept for the following periods. The separate maximum 30-day YouTube API data rules in section 3.5 override these general periods:

  • Instagram access tokens: while the connection is active; cleared when you disconnect Instagram or delete your Clipstack account. Tokens may be renewed to maintain the connection until you withdraw it.
  • Account data: for the duration of your registration + 3 years after deletion of your account.
  • Financial data: 10 years (accounting and tax obligations).
  • Messages and attachments: for the lifetime of the conversation and of the accounts of its participants. A message deleted by its author is no longer shown to anyone, together with its attachments, edit history and reactions.
  • Reports: the copy of a reported message is kept for as long as necessary to process the report and to meet our legal obligations.
  • Submitted content and performance snapshots, including Instagram Reel references and insights: for the duration of the campaign + 5 years, subject to applicable erasure rights and legal obligations.
  • Browsing data: 13 months maximum.

11. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

  • Right of access: to obtain a copy of your personal data.
  • Right of rectification: to correct inaccurate data.
  • Right to erasure: to request the deletion of your data ("right to be forgotten").
  • Right to restriction: to limit the processing of your data.
  • Right to portability: to receive your data in a structured and readable format.
  • Right to object: to object to the processing of your data.
  • Right to withdraw consent: at any time, in particular for TikTok, YouTube and Instagram connections.

To exercise these rights, contact us at: team@clipstack.fr. For Instagram requests, follow our Data deletion instructions.

12. Cookies and trackers

The clipstack.fr showcase website and the mobile application use no tracking cookies and no third-party analytics tools (no Google Analytics, Firebase, Segment, etc.).

Only technical session data (JWT token, theme preference) is stored locally on your device via native application storage.

13. Complaint

If you believe that the processing of your personal data constitutes a violation of your rights, you may file a complaint with the CNIL (French Data Protection Authority):

  • CNIL
  • 3 Place de Fontenoy, TSA 80715
  • 75334 Paris Cedex 07, France
  • Website: www.cnil.fr

14. Modification of the policy

We reserve the right to modify this policy at any time. In the event of a material change, we will inform you by email or by notification on the Platform. Changes will be published on this page with an update date.

15. Contact

For any question regarding this privacy policy or your personal data, contact us at: team@clipstack.fr