LEGAL

Privacy Policy

This policy covers the Clipaist website, the free tools and the AI Agent workspace — including website knowledge, customer chats, leads, social messages and Paddle billing. Last updated November 3, 2026.

1. Scope and who we are

This Privacy Policy explains how Muddassir Shaikh, trading as Clipaist (“Clipaist”, “we”, “us”), of Baldia Town, 3 No, Karachi 75760, Sindh, Pakistan, handles personal information when you visit clipaist.com, use our free AI tools, create a Clipaist account, or use Clipaist Agent (the “Agent”).
Clipaist is the controller of account, billing and website-visitor data described below. When a business uses the Agent to talk to its own customers, the business is normally the controller of those conversations and leads, and Clipaist acts as its processor. The business decides what knowledge to upload, what to ask customers for, and how long to keep chats. We provide the infrastructure and follow the business’s instructions.
Privacy questions and requests: hello@clipaist.com. Put “Privacy request” in the subject line.

2. Information we collect

Account and login data: name, email address, password hash and salt (never the plain password), phone number and country if you provide them, email-verification status, login and security events, and session information.
Agent workspace data: business name, website address, agent name, greeting, tone, persona and instructions, key facts, questions and answers, uploaded text and files, crawled website pages and knowledge chunks, allowed website origins, retention settings, connected channel IDs and handles, and notification preferences.
Customer conversations: messages sent through the website widget or connected social channels, timestamps, session identifiers, AI replies, the sources or facts used, confidence and handoff information, ratings, and delivery status. If the Agent is switched off, the workspace may still receive and store messages for its owner.
Leads and handoffs: the name, email address, phone number and message a customer chooses to provide, plus the conversation and status needed to follow up. Businesses must collect only what they need and give their customers any notice required by law.
Social channels: account identifiers, handles, platform metadata, message content and delivery status when you connect Instagram, Facebook Messenger, Telegram, Slack or another supported channel. The platform and our messaging provider process data under their own terms.
Billing data: plan, subscription status, transaction and invoice identifiers, country and tax information, and the email address used for receipts. Payments are processed by Paddle as merchant of record. We do not receive or store full card numbers or payment credentials.
Technical and security data: IP address, browser and device information, pages visited, timestamps, cookies, rate-limit and abuse signals, and error logs. This is used to run and protect the service, not to build advertising profiles of signed-in businesses.
Communications: emails and support messages you send us, and our replies.

3. AI Agent: roles, content and model use

A business that creates an Agent controls its knowledge, instructions and channels. It is responsible for making sure its website content, uploaded files, customer notices and consent are lawful and accurate, and for having a lawful basis to contact leads or send messages.
Do not use the Agent to collect sensitive information such as health records, legal case files, financial account numbers, government IDs, biometric data or children’s data unless you have a lawful basis and appropriate safeguards. The Agent is a customer-service assistant, not a secure records system.
We process Agent content to crawl and index your website, build the knowledge base, retrieve relevant answers, operate the widget and channels, capture leads, send notifications, provide support, prevent abuse and keep the service reliable. We do not sell your content or your end-customer data.
We do not use your private Agent content to train Clipaist’s own public models. Our AI infrastructure providers process prompts and relevant content only to generate the requested answer and under their contracts with us. Some providers may process data outside your country; see Section 9.
Aggregated or de-identified information that cannot reasonably identify a person or business may be used for security, capacity planning and product improvement.

4. How we use information

To create and secure accounts, verify email addresses, sign you in and prevent fraud or abuse.
To build, run and improve an Agent: crawl the website you provide, store its knowledge, answer customer questions, capture leads and hand conversations to your team.
To connect channels, deliver messages and show delivery or health information.
To process subscriptions, invoices, taxes and refunds through Paddle.
To provide support, send service notices and respond to privacy or takedown requests.
To monitor errors, capacity and security, and to enforce our Terms and acceptable-use rules.
To comply with law and respond to valid legal requests.
We do not sell personal information. We do not use signed-in Agent workspace data or conversations to target advertising.

5. Legal bases (EEA and UK)

Where data-protection law requires a legal basis, we rely on: performance of our contract with you; our legitimate interests in securing, operating and improving the service; your consent where we ask for it; and compliance with legal obligations.
For end-customer conversations, the business using the Agent is normally responsible for choosing the legal basis and providing notices. We process that data on the business’s documented instructions.

6. Cookies and the panel

On this site (app.clipaist.com) we use only essential cookies and similar storage for login sessions, security, load balancing, preferences and checkout. We do not set advertising or analytics cookies and we do not show ads. Blocking essential cookies can prevent sign-in or checkout from working.
Billing and social-connect flows may load Paddle, Cloudflare or platform scripts needed to complete the action.
Our free tools on clipaist.com may show advertising and use additional cookies; that is described in the Privacy Policy on clipaist.com.
If you email hello@clipaist.com, we will help with any cookie or privacy question.

7. Third-party services

Cloudflare: hosting, CDN, security, D1 database, R2 storage and email/network infrastructure.
AI inference providers: process the prompt, relevant website knowledge and context needed to generate an answer or media output. They do not receive more than the request requires.
Zernio and connected platforms: process account connections, social messages and publishing. Connected platforms include Instagram/Facebook (Meta), Telegram, Slack or Messenger where enabled.
Resend: delivers verification, password-reset and account emails.
Paddle: acts as merchant of record for paid plans, handles card payments and tax, and sends receipts. Paddle’s own privacy policy applies to payment data.
Supabase and Cloudflare R2: temporary storage for uploaded reference images or media used by the free tools.
We disclose data to authorities only when required by law or when necessary to protect rights, safety and the service.

8. How long we keep data

Account and workspace data is kept while the account is active and for a reasonable period afterwards for backup, dispute and legal needs, then deleted or anonymized.
Agent chat transcripts are kept for the retention period set in the workspace, which is 7 to 365 days and defaults to 90 days. Leads are kept until the business deletes them or the account is deleted, unless a longer period is required by law or a dispute.
Crawled website content and knowledge stay until replaced, deleted or the Agent is deleted. Removing a source does not automatically remove derived copies held in backups until the backup cycle ends.
Generated media and temporary uploads are normally kept for up to 30 days in private storage for preview, abuse review and cleanup, then deleted by a retention rule.
Billing and tax records are kept for the period required by law. Security and error logs are kept only as long as needed for investigation and service operation.
Deletion requests: contact hello@clipaist.com. We may need to verify your authority. Some data may remain in backups for a limited period, or be retained where law requires it.

9. Security and international transfers

We use TLS, access controls, hashed passwords, least-privilege administration, rate limits and vendor review. No internet service can promise absolute security; you should use a strong unique password and protect your email account.
Our providers may process data in the United States, the European Union and other countries. Where required, we use contractual safeguards or another lawful transfer mechanism. Contact us for more information about the safeguards relevant to your data.
If we become aware of a personal-data breach that legally requires notice, we will notify affected customers and authorities without undue delay.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export personal data, object to or restrict certain processing, withdraw consent, or appeal a decision. You may also have the right not to be discriminated against for exercising a privacy right.
Email hello@clipaist.com with “Privacy request” in the subject. We may ask for information to verify identity and authority. We aim to respond within 30 days, or the shorter period required by local law.
If you are a customer of a business that uses Clipaist Agent, contact that business first. It controls the conversation and lead data. We will assist the business with valid requests.
You can opt out of marketing email using the unsubscribe link or by emailing us. We may still send transactional messages about your account, security, billing or the service.
California residents: we do not sell or share personal information for cross-context behavioral advertising in the signed-in Agent panel. Public-site advertising is described in Section 6.

11. Children

Clipaist is not directed at children under 13, and we do not knowingly collect their personal data. Businesses must not deploy the Agent to collect children’s data without appropriate parental consent and legal safeguards.
If you believe a child has submitted personal data, email hello@clipaist.com and we will take appropriate action.

12. Changes to this policy

We may update this policy as the service changes. We will update the date above and, for material changes, provide a notice on the site or by email where appropriate. Continued use after the effective date means you accept the updated policy, to the extent permitted by law.

13. Contact

Privacy, data-protection, security and takedown questions: hello@clipaist.com. See also the Contact page for response times and what to include. For billing or refund questions, see the Refund & Cancellation Policy or contact Paddle using the details on your receipt.

Privacy questions?

Data requests, deletion, security or anything unclear above — write to us. We reply to privacy requests within the period required by law.