Your content and account data, explained.

Effective date: October 14, 2026. Controller: Riccardo De Romeri, an individual based in Italy. Contact: hello@cliphabit.com.

Invite list

When you request an invite, we store your email address, selected plan and billing period, the first and latest call to action (CTA), campaign source, medium, and campaign (UTM) when provided, request count, and request dates. We use this information to send your invite and updates about opening access, and to understand interest in plans and prices. We retain invite-list data until access opens or until you request deletion at hello@cliphabit.com. Invite-list records and aggregate daily opening and submission counts contain no IP address or user agent. Our security rate limiter uses a hashed IP-derived key separately from the invite list.

What we collect

• Account data: your email address, login records, workspace membership, plan, and account settings.
• TikTok connection: account identifier, nickname, avatar, OAuth access and refresh tokens, and permissions you grant through TikTok Login Kit. We do not collect your TikTok password.
• Content and schedule: uploaded videos and photos, their SHA-256 file hashes to detect identical media between owners and prevent identical Remix uploads, captions, hashtags, templates, schedule, publishing choices, AI-generated content flag, client approval decisions, and post status. If you use the video builder, this includes scene text and the URLs of images, clips, or audio you supply.
• Performance data: If you grant the optional video.list permission, ClipHabit reads your public TikTok videos (ID, publication time, title, description, share link, and duration) and their views, likes, comments, and shares. It refreshes these data about every hour and keeps dated snapshots (hourly during a video's first 7 days, then at most daily) for up to 90 days to measure how each video performs over time. ClipHabit does not store cover images and deletes all these data when you disconnect the TikTok account or delete your ClipHabit account.
• Billing and support: subscription status, Stripe customer and payment identifiers, invoices, and messages you send to support. Stripe handles payment card details; ClipHabit does not store full card numbers.
• Technical data: IP address, browser and device information, security and error logs needed to operate and protect the service.

Free signup and abuse prevention

At Free signup, we store keyed hashes of your IP address and network (/24 for IPv4 or /48 for IPv6), not the raw signup IP. We use these hashes to limit signups and help an operator investigate account farms, and delete them after 90 days. We normalize email addresses to prevent multiple Free workspaces for the same email identity and retain a history of TikTok account connections to enforce Free lifetime limits. We compare SHA-256 file hashes across owners to reject identical files already published or queued by another ClipHabit account. Agency client workspaces with the same owner are exempt. Publication fingerprints remain while the owner has a ClipHabit account, including after a post or its media is removed. Publishing and safety logs are kept for up to 90 days. A TikTok safety signal can pause a queue for operator review. Suspended workspace data is deleted after 30 days unless reinstated.

Why we use it

We use account, TikTok, media, and scheduling data to provide the service you request, including OAuth connection, queue management, direct publishing or sending to TikTok drafts, video rendering, account alerts, billing, and support. We use necessary technical data for security, reliability, and fraud prevention. We use payment records for accounting and legal obligations. Where required, we request consent for optional analytics.

TikTok and AI assistant connections

When you connect TikTok, TikTok provides the data permitted by the scopes you approve. ClipHabit sends your selected media and settings to TikTok through its official Content Posting API. TikTok handles data under its own privacy terms. If you connect an AI assistant through MCP, that client can receive data and perform the tools you authorize. Review the assistant provider's privacy terms before connecting. Posts created through MCP wait for your approval in ClipHabit before scheduling.

Video builder processing

If you use the video builder through an AI assistant or API, ClipHabit downloads the images, clips, and optional audio from the URLs you provide. We process those files and your scene text on our servers to validate the media, create previews, and render a vertical video with ffmpeg. The resulting video is stored as ClipHabit media and marked AI-generated by default. Your assistant provider may also process the instructions and content you share with it under its own privacy terms.

Storage and retention

The static website is served by Caddy on a Hetzner VPS in Germany. The app, database, and media run on the same VPS, with MinIO for media storage. Cloudflare R2 is a future option, not an active service. Uploaded media stays available while needed for your queue. ClipHabit deletes media files from its storage 7 days after publication on Free and 30 days on paid plans, unless still needed by a queued post. Unpublished media remains until you remove it or delete your account. Account and workspace data remain while your account is active. When you delete your account in the app, we delete associated service data, subject to records we must retain for tax, payment disputes, security, or other legal obligations. Such records are kept only for the applicable required period. Backup copies may take additional time to expire. TikTok may retain content published on its platform under its own rules.

Service providers and transfers

The static website is served by Caddy on a Hetzner VPS in Germany. The app, database, and media run on the same VPS, with MinIO for media storage. Cloudflare R2 is a future option, not an active service. Stripe processes subscription payments and billing. Resend delivers sign-in, queue, and failure emails. TikTok provides account authorization, publishing, and metrics. Plausible may provide optional cookieless website analytics if enabled. Media validation, previews, and video builder rendering run on our server, using ffmpeg for rendering. These providers process data only for the relevant service, subject to their own terms and locations. Data may be processed outside the EEA or UK. Where required, we use applicable adequacy decisions or safeguards such as Standard Contractual Clauses. Contact us for details of the safeguards in use.

Cookies and analytics

The public website does not use advertising cookies. If enabled, Plausible provides cookieless aggregate analytics without cross-site tracking. The ClipHabit app and Stripe Checkout may use essential storage or cookies needed for login, security, and billing. See their privacy notices for their own processing.

Your rights and choices

You can disconnect TikTok, cancel billing through Stripe Customer Portal, and delete your ClipHabit account and data from your account settings. You can also email hello@cliphabit.com to request access, correction, deletion, export, or restriction of personal data, or to object to certain processing. EEA and UK users may lodge a complaint with their data protection authority. California residents may request to know, access, correct, or delete personal information, and may exercise any applicable opt-out rights. We do not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising privacy rights. We may need to verify your request and may retain information where law permits.

Children and changes

ClipHabit is intended for adults and businesses, not children under 18. If you believe a child provided personal data, contact us. We may update this policy and will post the revised version with a new effective date; material changes will be communicated through the service or email when appropriate.

Contact

Riccardo De Romeri, an individual based in Italy. Email hello@cliphabit.com.