Privacy Policy

1. Who is responsible

The data controller is NETCLIPS (legal entity in formation, Amsterdam, the Netherlands — KvK and VAT numbers will be published here upon registration). For any privacy request, use the contact form on this site — we respond within one month as the GDPR requires.

2. What we collect

• Account data: email address, password (stored as a cryptographic hash by our authentication provider), or your Google account identity if you sign in with Google, plus your chosen role (clipper or brand).
• Profile data: display name, country, and an optional avatar.
• Connected social accounts (clippers): platform, handle, channel ID, and the verification code used to prove the channel is yours.
• Submissions: the clip URLs you submit, their review status, and the reason for any rejection.
• View statistics: timestamped view, like, and comment counts for submitted clips, retrieved from the platforms' official APIs (YouTube first). These are kept as an immutable history because they are the basis on which earnings are calculated.
• Money records (clippers): accrued earnings, payout requests, payout status, and — once payouts run through Stripe — the identifiers Stripe assigns you. We never see or store card numbers or full bank details; Stripe processes those.
• Campaign data (brands): company/brand name, campaign briefs, budgets, and funding records.
• Waitlist: your email address and audience choice, only with your consent.
• Technical data: server logs (IP address, timestamps, user agent) kept briefly for security and abuse prevention.

3. Why we use it (legal bases)

• To run the service you signed up for — accounts, campaigns, submissions, view verification, earnings, payouts (performance of a contract).
• To keep the platform honest — fraud detection, review of suspicious view patterns, enforcement of campaign rules (legitimate interest).
• To show rankings — leaderboards rank clippers by verified views, clips, and recognition tier. Individual earnings are never shown on shared leaderboards.
• To send you what you asked for — waitlist and product updates (consent, withdrawable any time).
• To meet legal obligations — bookkeeping and tax retention rules, and, once thresholds apply, reporting of seller data to the Dutch tax administration under DAC7 (EU Directive 2021/514).

4. YouTube and other platform APIs

NETCLIPS uses YouTube API Services to read public statistics of submitted clips and to verify channel ownership. By connecting a YouTube channel or submitting a YouTube clip you also agree to the YouTube Terms of Service. Google's Privacy Policy (policies.google.com/privacy) applies to the data Google processes. You can revoke NETCLIPS' access at any time via your Google security settings; verification data we hold is deleted with your account.

5. Payments

Campaign funding and clipper payouts are processed by Stripe. Stripe acts as its own controller for the payment data it collects (including the identity data it needs for its know-your-customer obligations) under the Stripe Privacy Policy.

6. Where your data lives

Our database and file storage are hosted in the EU (Frankfurt, Germany). Where a processor is established outside the EEA (for example Stripe or Google), transfers rely on adequacy decisions or Standard Contractual Clauses.

7. How long we keep it

• Account and profile data: while your account exists, then deleted or anonymised.
• Financial records (ledger entries, payout records, view snapshots that earnings were based on): retained for the statutory Dutch retention period (currently 7 years) as bookkeeping evidence, even after account deletion.
• Waitlist emails: until launch communications end or you unsubscribe.
• Security logs: up to 12 months.

8. Who sees what

• Brands see, for their own campaigns: your display name, your submitted clips, their view statistics, and what those clips earned from their budget.
• Other clippers see shared leaderboards: display name, avatar, recognition tier, approved clips, and verified views — never your earnings.
• Processors that run the service for us: Supabase (EU hosting), Stripe (payments), Google (sign-in and YouTube API), and our email provider for transactional mail. Each is bound by a data processing agreement.
• Authorities, only where the law requires it (for example tax reporting).
• We do not sell personal data and we do not run third-party advertising trackers.

9. Your rights

You can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Where processing rests on consent you can withdraw it at any time. Use the contact form to exercise any right. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Note: deletion cannot remove records we must keep by law (see retention) — those are locked away from active use instead.

10. Security

Every table in our database enforces row-level access rules; money movements are append-only records that cannot be silently edited; secrets and payment logic live server-side only; fonts are self-hosted and no needless third-party scripts run on this site.

11. Changes

We will update this policy as the platform evolves (for example when TikTok/Instagram tracking or DAC7 collection go live) and note the date at the top. Material changes are announced in-app.