Privacy Policy

We use information to:

• To provide the Service: store your projects, run the generations and agent tasks you request, sync real-time collaboration, and show your content to the people your workspace allows.
• To bill you: manage subscriptions, credits, invoices, and taxes.
• To keep the Service secure: authenticate you, prevent fraud and abuse, enforce our Acceptable Use Policy, and investigate incidents.
• To support you: answer requests and fix problems, which may require looking at the content involved when you ask us to.
• To communicate: send service, security, and billing messages. We send marketing email only with your consent and every one lets you unsubscribe.
• To improve the Service: understand, in aggregate, which features are used and where errors occur.
• To meet legal obligations: keep records the law requires and respond to lawful requests.

Where the GDPR or similar laws apply, our legal bases are performance of our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and compliance with legal obligations.

When you run a generation, the agent, or another AI feature, the prompt, the references attached to it, and the settings are sent to the provider that operates the model you (or the agent on your instruction) selected, so that it can produce the result. Those providers process that data as our sub-processors or under their own API terms, which generally prohibit using API data to train their models. Which provider receives a request depends on the model you pick; the model is shown in the product before you run it.

We do not use your prompts, uploads, or generations to train AI models, and we do not allow our service providers to do so with the data we send them on your behalf, to the extent their terms allow us to control it.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• With the members of your workspace, according to its roles and project access.
• With service providers that host and run the Service for us — cloud hosting and databases, object storage and content delivery (Cloudflare), email delivery, error monitoring, payments (Stripe), sign-in (Google, if you use it), and the AI model providers described above — under contracts that limit their use of it to providing services to us. The current list, with what each provider does and where, is on our Trust Center.
• When you ask us to, for example when you share a project link or connect a third-party tool.
• If required by law, or to protect the rights, safety, and property of our users, the public, or ClipTap.
• As part of a merger, acquisition, or sale of assets, subject to this Policy.

We keep account information while your account exists. Workspace content stays until someone with permission deletes it or the workspace is deleted.

When you delete a project or your account, it disappears from your view immediately. We keep the data for 30 days, then permanently delete it from our active systems; copies in backups expire on their normal schedule, typically within a further 30 days. During the 30 days you cannot restore a deleted project or account yourself, but you can ask us to recover it by emailing [email protected].

Billing records are kept for as long as tax and accounting law requires (usually up to 7 years). Security and access logs are kept for a limited period, generally no more than 12 months.

You can delete your account from your account settings or by writing to [email protected]. If you own a workspace with other members, transfer or delete it first.

Connections to ClipTap are encrypted in transit with TLS. Files are stored with a storage provider that encrypts data at rest. Access to workspaces is controlled by roles and per-project permissions, and access to production systems is limited to staff who need it. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and regulators as the law requires. More on our Security page.

We and our providers may process data in the United States and other countries whose data protection laws differ from yours. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses for these transfers.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• object to or restrict certain processing, and withdraw consent where processing relies on it;
• receive your information in a portable format;
• know what categories of personal information we collect and disclose, and opt out of any sale or sharing (we do neither) under California and other US state laws;
• not be discriminated against for exercising these rights;
• complain to your local data protection authority.

To exercise a right, email [email protected] from the address on your account. We may need to verify your identity, and we respond within the time the law requires (generally 30 days). For content that belongs to a workspace, we may refer your request to the workspace owner, who controls that content.

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact [email protected] and we will delete it.

We will post any changes to this Policy here and update the date above. If a change materially affects how we use personal information, we will notify you by email or in the product before it takes effect.

Privacy questions and requests: [email protected]. BLENDDUCK LLC is the controller of the personal data described in this Policy, except for workspace content, which the workspace controls.