Last updated 19 October 2026
Data processing agreement
This agreement applies when a business ("Customer") uses Cliprame to process personal data about other people, such as video recipients and viewers. It forms part of the terms of service. To receive a signed copy, email [email protected].
1. Roles
For personal data in the Customer’s videos, share links and viewer analytics, the Customer is the controller (the “data fiduciary” under India’s DPDP Act) and Cliprame is the processor. Cliprame processes it only to provide the service and on the Customer’s documented instructions, which are these terms and the Customer’s use of the product.
2. Data covered
- People: the Customer’s users, people appearing in videos, recipients of personal links, people the Customer adds to campaigns, viewers of share pages and embedded videos, and people who submit the Customer’s forms.
- Data: videos and their audio, transcripts, recipient name, email and company, viewing analytics (random browser identifier, playback and interaction events, device type, country, embedding website and a hashed network address), email addresses confirmed to unlock protected videos, form submissions (the answers the Customer asks for and the hidden values it sets up, such as campaign tags and referring page), campaign recipient lists (name, email and company), lead scores derived from viewing, replies left on share pages, people who introduce themselves on a recipient’s link (name, email and company), and AI-generated company research and follow-up drafts.
- Purpose and duration: hosting, sharing and measuring videos; building personal campaign pages; and, when the Customer uses those features, researching recipients’ companies from their public websites and drafting follow-up emails for the Customer. For as long as the Customer keeps the data in the service.
3. Our commitments
- Staff and contractors with access are bound by confidentiality.
- We maintain appropriate security: private storage with expiring links, encryption in transit, database-level access controls, and abuse limits on analytics.
- We help the Customer respond to requests from individuals (access, correction, deletion) and with impact assessments where reasonably needed.
- We notify the Customer without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting their data.
- When the Customer deletes content or ends the service, we delete the related personal data, except where the law requires us to keep it.
- We make available the information reasonably needed to show compliance with this agreement.
4. Subprocessors
The Customer authorises these subprocessors. We’ll give at least 30 days’ notice of new ones by updating this page; the Customer may object and, if we can’t resolve it, end the affected service.
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase | Accounts, sign-in and the database (profiles, videos, links, campaigns and their recipient lists, analytics, billing records) | Tokyo, Japan |
| Cloudflare R2 | Storage of uploaded videos and poster images | Automatic placement (Asia Pacific for this bucket) |
| Google (Gemini API) | Cliprame AI: transcription, captions, scripts, translation and voiceover; for campaigns, reading a recipient company’s public website to write its “Why {company}” section, and drafting follow-up emails. Only when you use those features | Google data centres, which may be outside your country |
| Google (website icons) | Fetching a recipient company’s logo for campaign pages, using only the company’s web domain (no names or email addresses) | Google data centres |
| Resend | Sending emails: one-time codes for viewers who unlock a protected video, team invitations, hot-lead alerts to senders and payment receipts (when enabled) | United States |
| Dodo Payments | Reseller and merchant of record for paid plans: checkout, subscriptions, invoices, sales tax and VAT. Card details are handled by Dodo Payments, not us | United States and India |
| Razorpay | Payments in rupees, where used; card and bank details are handled by Razorpay, not us | India |
| Vercel | Hosting the website and API | Tokyo, Japan, with static files served from a global network |
| Sentry | Error reports from the app, without IP addresses or cookies (when enabled) | United States or EU |
| Google (Analytics) | Website visit statistics, never on share pages or embedded players. Advertising features off. In the EU, EEA, UK and Switzerland it uses cookies only if you accept them (when enabled) | Google data centres |
5. International transfers
The service’s servers and database are in Tokyo, Japan, which the European Commission and the UK recognise as providing an adequate level of protection. Where personal data is transferred out of the EU, UK or India in a way that requires further safeguards, including to the subprocessors listed above, the parties rely on the applicable standard contractual clauses or other lawful mechanisms.
6. The Customer’s responsibilities
The Customer is responsible for having a lawful basis to record people, to send and measure personal links and to collect form answers, for giving recipients any required notice (including clear consent text on its forms), for having a lawful basis to add people to campaigns and contact them, for reviewing AI-generated research and drafts before using them, and for the accuracy of recipient details it enters. When the Customer connects Slack, HubSpot, Salesforce, lemlist, Instantly, Apollo, a webhook or its own form backend, data sent there is sent on the Customer’s instruction; those services are the Customer’s recipients, not our subprocessors. See the privacy policy for what viewers are told.
Contact
Questions or requests: [email protected]. Complaints about personal data can be sent to our Grievance Officer at the same address; we reply within 30 days.