Privacy Policy
1. Commitment
GeniusClip is designed to be GDPR-native: personal data protection is built into the technical architecture of the Service from the start (privacy by design and by default, within the meaning of Article 25 of the GDPR).
This Policy explains in plain language what data we collect, why, who we share it with, how long we keep it and how you can exercise your rights.
2. Data controller
- Controller
- Denis Du, sole proprietor (SIREN 995 343 266), France. Controller contact: privacy@geniusclip.eu.
- Postal address
- Rue du 9 Novembre 1989, 93700 Drancy, France.
- Data protection contact
privacy@geniusclip.eu- Data Protection Officer
- Not required under Article 37 of the GDPR, given the size of the business and its activity. Denis Du acts directly as the data protection contact.
3. Data we collect
We distinguish the following categories of data:
| Category | Data concerned | Legal basis |
|---|---|---|
| Identification | Email address | Performance of the contract Art. 6(1)(b) |
| Authentication | One-time sign-in codes, email address provided by Google when you sign in with Google, gc_session session cookie, IP address at sign-in |
Legitimate interest (security) Art. 6(1)(f) |
| Payment | Stripe Customer ID, subscribed plan, status, invoices (amount, VAT, date) | Contract and legal accounting obligation Art. 6(1)(b)/(c) |
| Content | Uploaded source videos, transcripts, generated clips, editorial metadata (hook, title, score) | Performance of the contract Art. 6(1)(b) |
| Usage | Job history, credits used, sign-in dates | Performance of the contract and legitimate interest (debugging, quality) |
| Technical | Error stack traces (Sentry, anonymized), user agent | Legitimate interest (security, quality) |
| Audience measurement | Pages viewed on the public site, referring site, browser and device type, country and approximate city (see 9.1) | Legitimate interest Art. 6(1)(f) |
| Connected social accounts | Encrypted access and refresh tokens, account ID, public username and avatar, posting settings allowed by the platform | Performance of the contract Art. 6(1)(b), at your explicit request to connect |
| Model data collection (opt-in) | Feedback and edits on clips, imported statistics, with identifiers replaced by hashes | Explicit consent Art. 6(1)(a) (see Consent) |
3.1 Connecting a TikTok account
If you connect a TikTok account to post from the calendar, TikTok sends us, with your authorization:
- an access token and a refresh token, encrypted before storage and never displayed;
- your public username, display name and avatar, shown on the confirmation screen so that you know which account the video goes to;
- the settings your account allows: available privacy levels, whether comments, duets and stitches are enabled, maximum video length.
We do not read your existing videos, your messages, your follower list or your statistics. This information is used only to post the clip you scheduled, with the settings you chose yourself.
Removing access: delete the connection from the GeniusClip Accounts page, which erases the tokens from our database, or revoke GeniusClip directly in your TikTok account settings, under “Manage app permissions”. In both cases, posts already scheduled fail instead of going out.
We do not collect any sensitive data within the meaning of Article 9 of the GDPR (ethnic origin, political opinions, health data, etc.). If your videos contain such data, you remain responsible for its processing in accordance with clause 7 of the Terms.
4. Purposes of processing
We use your data only for the following purposes:
- Providing the Service: transcription, clip selection, editorial generation, video rendering, delivery.
- Account management and billing: authentication, payment, invoicing, technical support.
- Security: abuse detection, fraud prevention, time-limited retention of access logs.
- Legal obligations: keeping invoices for 10 years (French Commercial Code Art. L123-22), responding to judicial requests.
- Improving the Service: anonymized statistical analysis of errors (Sentry), tracking of processing times, cookie-free audience measurement of the public site (see 9.1).
- Preparing a future proprietary model: only with explicit consent, see Consent.
We do not use your data for advertising, we do not sell it to third parties, and we carry out no automated profiling producing legal effects within the meaning of Article 22 of the GDPR.
5. Technical subprocessors
To run the Service, we use technical subprocessors that process your data on our behalf. Each one is bound to GeniusClip by a data processing agreement (DPA) and provides compliance guarantees.
| Subprocessor | Location | Purpose | Safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Germany (Nuremberg) | Hosting of the site, the database, source videos and clip rendering | Data processing agreement (DPA), hosting in the European Union |
| Artificial intelligence providers | United States (transcription), Singapore (analysis) | Transcription of the audio of Source Videos, then analysis of the transcript text to choose the moments and write titles and hooks | Providers' processing terms. The provider located in Singapore may use the content it receives to improve its services and models. Named list available on request |
| Stripe Payments Europe Ltd. | Ireland | Payment processing | DPA, PCI-DSS Level 1 certification, GDPR compliance |
| Cloudflare R2 (Cloudflare Inc.) | European Union (Frankfurt) | Storage of the Clips produced | DPA, encryption at rest, EU data residency configured |
| Resend Inc. | United States (EU option under review) | Sending transactional emails (sign-in codes, notifications) | DPA, EU Standard Contractual Clauses |
| Sentry (Functional Software Inc.) | United States | Monitoring of technical errors | DPA, active PII filtering, Standard Contractual Clauses |
The up-to-date list of subprocessors is published on this page. Any addition will be notified by email, with a 30-day objection period.
5.1 Recipients on your instruction
The social platforms you connect act as independent controllers: they do not process your data on our behalf, so they are not subprocessors. We send them a clip and its caption only when you have scheduled a post and approved the settings on the confirmation screen.
| Recipient | What is sent | Their own policy |
|---|---|---|
| TikTok (TikTok Technology Limited, Ireland) | The clip's video file, its caption, and the settings you chose (privacy, interactions, commercial content disclosure) | TikTok Privacy Policy |
| YouTube (Google Ireland Ltd.) | The clip's video file, its title and its description | Google Privacy Policy |
Once the video is published, its processing falls under the platform concerned and its own terms. We no longer control it at that point: deleting it is done from the platform.
6. Transfers outside the EU
The site, the database, clip rendering and video storage stay in the European Union. Some subprocessors, however, process data elsewhere:
- in the United States: transcription of video audio, Resend (email address and content of transactional emails) and Sentry (error reports);
- in Singapore: analysis of the transcript text.
Transfers to the United States rely on an adequacy decision of the European Commission or on its Standard Contractual Clauses (SCCs). Singapore does not benefit from an adequacy decision: this transfer, which the Service needs in order to work, relies on the provider's terms. Technical measures applied:
- encryption in transit (TLS 1.3);
- data minimization: artificial intelligence providers receive the audio or the text of a video, never your email address;
- automatic filtering of sensitive data before sending to Sentry.
Do not upload a video that contains confidential information (trade secrets, health data, bank details, personal information about third parties): its content is transcribed and analyzed outside the European Union, and the provider located in Singapore may use it to improve its models.
The named list of these providers and their processing terms are available on request at privacy@geniusclip.eu.
7. Retention periods
| Data | Period | Justification |
|---|---|---|
| Active account (email, settings) | Lifetime of the account | Performance of the contract |
| Account you ask us to delete | Deleted no later than 30 days after the request | Response time set by the GDPR (Art. 12(3)) |
| Projects (source video, clips, thumbnails), Free plan | 3 days after creation | Free plan |
| Unsaved projects, active subscription | 30 days after creation | Subscribed plan |
| Saved projects, active subscription | Kept, 90 days maximum | Explicit user action |
| Transcripts | Lifetime of the account | Functional need |
| Invoices and accounting records | 10 years | French Commercial Code Art. L123-22 |
| Access and security logs | 12 months maximum | CNIL recommendation |
gc_session session cookie |
14 days | Security, automatic sign-out |
| Visit statistics (Umami) | 25 months | CNIL recommendation on audience measurement |
| Opt-in dataset data | Until consent is withdrawn, which erases it immediately | Consent |
8. Your rights
Under the GDPR, you have the following rights:
- Access Art. 15
- Obtain a copy of the data concerning you.
- Rectification Art. 16
- Correct inaccurate or incomplete data.
- Erasure Art. 17
- Ask for your data to be deleted. See Data Deletion.
- Restriction Art. 18
- Ask for processing to be suspended while a dispute is examined.
- Portability Art. 20
- Receive your data in a structured, commonly used format (JSON).
- Objection Art. 21
- Object to processing based on legitimate interest.
- Withdrawal of consent Art. 7
- Withdraw at any time a consent you gave (in particular for model data collection).
- Complaint Art. 77
- Lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés,
cnil.fr), the French data protection authority.
To exercise any of these rights, write to privacy@geniusclip.eu. We will reply within 30 days at most, in accordance with Art. 12(3) of the GDPR. Proof of identity may be requested in case of reasonable doubt.
9. Cookies
GeniusClip uses only cookies that are strictly necessary for the Service to work:
gc_session: HTTP-only, secure session cookie used for authentication. Duration: 14 days.gc-lang: remembers the language chosen with the site's “English” or “Français” link. It is set only after that click. Duration: 12 months.
We set no third-party cookies (Google Analytics, Facebook Pixel, etc.) and no advertising cookies. In line with CNIL recommendations and the ePrivacy Directive, these strictly necessary cookies do not require prior consent.
If a future feature required cookies that are not strictly necessary, an explicit consent banner would be put in place in accordance with the regulations.
9.1 Audience measurement
To know which pages of the public site are read, we use Umami, an audience measurement tool installed on our own server, in Germany. It sets no cookie and does not record your IP address: each visitor is counted with a fingerprint computed from the IP address and the browser, from which the address cannot be recovered. This fingerprint changes every month and cannot be used to follow anyone from one site to another. These statistics are not shared with any third party.
Only the public site is measured: the Studio and your account pages are not. To stop being counted, use the button below: this browser will no longer appear in the statistics, as long as you do not clear the site's data. Umami also respects the “Do Not Track” setting of the browsers that offer it.
10. Security
Technical and organizational measures in place:
- passwordless authentication (one-time code sent by email, or a Google account): no password is stored;
- TLS 1.3 encryption on all communications;
- encryption of data at rest (Cloudflare R2 SSE);
- short-lived signed URLs for access to videos and clips;
- logging of administrative access;
- daily backup of the database;
- regular security updates of dependencies.
11. Data breach
In the event of a personal data breach likely to result in a risk to Users' rights and freedoms, GeniusClip undertakes to:
- notify the CNIL within 72 hours (Article 33 GDPR);
- notify the Users concerned without undue delay if the risk is high (Article 34 GDPR);
- document the breach, its effects and the corrective measures.
12. Contact
For any question about your personal data or the exercise of your rights, write to privacy@geniusclip.eu. For general questions, see the Terms.