1. Who is responsible
GAAI, the operator of Clone Cut AI at clonecutai.net, is responsible for the service data described here. Privacy contact: [email protected]. This policy is separate from our Terms of Service.
2. Information we collect
Account data: your email, authentication identifier and session information through Clerk. Creative data: descriptions, messages, selected generation settings, reference images/videos, task status and delivered outputs. Transaction data: provider order/payment identifiers, plan, currency, amount, credit ledger, subscription periods and refund facts. Support data: correspondence and information you voluntarily include in requests or reports. Technical data: IP/network and request metadata processed by hosting/security providers for delivery and abuse prevention.
We do not receive full payment-card numbers or CVV codes, and do not ask you to send them to support. Please do not upload unnecessary sensitive personal data, private documents, passwords or other people’s media without authorization.
3. Purposes and legal bases
We use data to authenticate your account, process your requested planning/generation, store and deliver results, reconcile payments and credits, provide support, prevent abuse and meet legal obligations. Where the law requires a legal basis, these purposes rely on performance of the service agreement, legitimate interests in operating a secure service, legal obligations, or consent where applicable. We do not sell personal information or use your content for unrelated advertising.
4. Processors and disclosures
Clerk provides authentication and necessary verification messages. Cloudflare provides hosting, D1 databases, R2 storage, delivery and security logging. OpenRouter and the configured DeepSeek V4.1 Flash planning model process messages needed for planning. KIE and the selected Seedance video model process the approved creative brief and reference media for generation. Waffo Pancake and payment processors handle hosted checkout and payment/refund processing when purchasing is available. Waffo Prompt Sift and its processors receive submitted text and final generation briefs to make content-safety decisions before a request proceeds. The service operator handles support, with the existing support-email routing infrastructure used to deliver requests.
Only information needed for the relevant operation is shared. Providers’ own privacy, retention and safety rules may also apply. Processing may take place outside your country. We assess relevant safeguards and applicable transfer requirements; contact us for information about your particular request. We may disclose limited records when required by law or to investigate fraud and protect lawful rights.
5. Retention
Under the current backend policy, uploaded and generated media normally become unavailable after 30 days. This is not a promise that all provider copies or legally required records are erased at the same moment. Account/conversation metadata remains while your account is active unless removed through supported functions or a verified request. Financial/audit facts may be retained longer where needed for reconciliation, disputes, fraud prevention or legal obligations. Expired media does not automatically erase its task or billing history.
Local browser preferences and task-recovery identifiers remain until you clear site data or the browser removes them. Your own downloaded/shared copies and third-party recipients’ copies are outside our direct deletion control. We limit retained records to the purpose and review deletion requests individually.
7. Your data rights and withdrawal
Depending on applicable law, you may request confirmation/access and a copy of your account data, correction of inaccurate data, deletion of your account or personal data, portability, restriction or objection to certain processing, and withdrawal of consent where consent is the basis. Send the request to [email protected] from your account email and state the action and account concerned. You may also use Contact & support. We may ask for proportionate account-ownership verification, not your password or sign-in code.
We aim to respond within 30 days, or sooner where law requires. If a permitted extension is necessary, we will explain it. Deletion may exclude limited financial/legal/security records; we will explain relevant exceptions. Withdrawing consent affects future consent-based processing and does not make earlier lawful processing unlawful. Some processing is necessary to provide the requested account or generation service; you can stop that processing by stopping the activity and requesting deletion, subject to the explained exceptions. You may complain to a competent data-protection authority without losing other remedies.
8. Security and private delivery
Private media is tied to an authenticated account, and access/processor-reference links are scoped and time limited. We use transport security, service credentials and account-based authorization. No service can guarantee absolute security. Keep sign-in codes private and notify support of suspected misuse. Do not rely on the Library as your only permanent backup.
9. Age and changes
The service is for adults 18 and older. We do not intentionally provide accounts or generation services to children; report suspected child data or unsafe content immediately to [email protected]. We may update this policy and publish the new date here, with additional notice for material changes where required.