Privacy Policy

1. Who we are

Kliplot is operated by Juan Manuel Gauna (doing business as Korvel), based in Buenos Aires, Argentina, who is the controller of your personal data. For privacy requests, contact korvelglobal@gmail.com.

2. Information we collect

Information you provide

• Account data: email address and password (via Supabase Auth) if you register; profile fields such as plan status stored in our database.
• URLs you submit: links you paste for download are sent to our servers and may be forwarded to third-party extraction services to fulfill your request. Do not submit links you are not authorized to process.
• Payment data: subscriptions are handled by PayPal. We do not store full card numbers; we receive subscription identifiers and plan metadata from PayPal.

Information collected automatically

• Usage limits: to enforce batch limits, we store usage counters linked to your account or, for anonymous use, a keyed hash of your IP address (never the address itself) in our database (usage_limits).
• Batch history: each batch you run stores the submitted links, their status and the resulting media URLs (never the media itself), linked to your account or, for anonymous use, a truncated IP. It powers re-downloads, refunds of failed links and abuse prevention, and is deleted automatically after 30 days. Usage records (downloads consumed/refunded, source and API key) are kept for billing.
• Technical data: browser type, approximate region, request metadata and diagnostics. Our hosting, network and security providers (Vercel, Cloudflare) process your IP address to deliver the site and keep it in their own short-lived access logs; our application database never stores it in raw form.
• Cookies and local storage: authentication session cookies (Supabase), theme preferences, and language selection may be stored in your browser.

Analytics consent

When you first visit Kliplot, a cookie consent banner lets you Accept or Decline analytics cookies. Your choice is stored in your browser (local storage) so we do not ask again on every visit. Google Analytics loads only if you Accept. You can change your mind later by clearing site data for Kliplot in your browser settings.

You may use some features without creating an account; usage limits may still apply by IP.

3. How we use information

• Provide, operate, and improve the download service.
• Enforce plan limits, cooldowns, and prevent abuse.
• Process subscriptions and respond to billing events.
• Authenticate users and secure the service.
• Comply with law and respond to lawful requests.

We do not sell your personal information. We do not use your data to train AI models.

Legal bases (EU/UK users):

• Contract: account, downloads, plan limits and billing — needed to provide the service you asked for.
• Legitimate interest: security, abuse and fraud prevention, error monitoring and keeping the service running.
• Consent: analytics and advertising cookies, only if you accept them in the banner (you can withdraw it at any time).
• Legal obligation: tax and accounting records, and responses to lawful requests.

4. Third-party services and platforms

Kliplot relies on third parties. Their privacy practices apply in addition to this policy:

• Supabase — authentication and database hosting.
• Vercel — application hosting, edge network, and performance analytics.
• PayPal — subscription checkout and webhooks.
• Google (Analytics and Ads) — usage statistics and ad conversion measurement. Analytics and advertising cookies are set only if you accept them in our consent banner (Google Consent Mode); until then Google receives only cookieless signals. We do not show ads on the site.
• Media extraction providers — RapidAPI endpoints, the open-source fxtwitter resolver (for X/Twitter) and our own extraction servers hosted on Railway. They receive the URLs you submit, nothing else about you.
• Social platforms — Instagram, TikTok, Pinterest, X, and their CDNs host the underlying media. We are not responsible for their data practices.
• Cloudflare — bot protection (Turnstile) on sign-up and login, and privacy-focused web analytics.
• Upstash — rate limiting and short-lived caching; stores hashed identifiers, never raw IP addresses.
• Sentry — error monitoring: technical diagnostics when something breaks. Configured not to collect IP addresses or other personal data.

We are not affiliated with Meta, Instagram, TikTok, Pinterest, or X. When you submit a link, you interact with those platforms' terms and policies independently of us.

5. Retention

Batch history (links, status and result URLs) is deleted automatically after 30 days. API keys are stored only as irreversible hashes. Account data (email, plan) is kept while your account is active and deleted within 30 days after you delete the account or ask us to. Payment and refund records are kept as long as tax and consumer-protection law requires (up to 10 years in Argentina). Error diagnostics are kept for up to 90 days.

6. Security

We use industry-standard measures (HTTPS, access controls, server-side secrets, signed proxy tokens) to protect data. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location, you may have rights to:

• Access, correct, or delete personal data we hold about you.
• Object to or restrict certain processing.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with a supervisory authority.

To exercise these rights, email korvelglobal@gmail.com. Decline analytics in our cookie banner, or clear site data later; authentication cookies are required for logged-in features.

If you are in Argentina: you may exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest to do so sooner (Ley 25.326, art. 14.3). The Agencia de Acceso a la Información Pública, as the supervisory authority of Ley 25.326, handles complaints from anyone whose rights are affected by non-compliance with personal data protection rules.

8. Children

Kliplot is not directed at children under 13, and we do not knowingly collect their personal information. You must be 18 or older (or have a parent or guardian's consent where the law allows it) to buy a paid plan. If you believe a child has provided data, contact us and we will delete it.

9. International transfers

Our service providers (Supabase, Vercel, Cloudflare, Sentry, Google, PayPal, Upstash, Railway) may process data in the United States and other countries that may not offer the same level of protection as yours. Each of them processes data under a data processing agreement that includes the European Commission's Standard Contractual Clauses (or an equivalent safeguard), which we rely on for these transfers. You can ask us for details at the contact address above.

10. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change. Material changes may be communicated via the site or email where appropriate. Continued use after changes means you accept the updated policy.