Politique de confidentialité

1. The controller

The controller of your personal data is CULOAREA DIN VIAȚA SA S.R.L., registered office Sat Topliceni nr. 214, Com. Topliceni, jud. Buzău, 127630, România, tax ID (CUI) 44820819, Trade Register no. J2021001108100 (“we”). For any question or request about personal data write to contact@postingclips.com. We have not appointed a Data Protection Officer; requests go to the same address.

This policy explains which data we process when you use postingclips.com and the PostingClips app, why, on what legal basis, who receives it, how long we keep it and what your rights are, under Regulation (EU) 2016/679 (“GDPR”).

2. The data we process

• Account data: email address, password (stored only as a bcrypt hash), account creation date, the interface language when the account was created and your choice about tips-and-news emails. If you sign in with Google (Google Ireland Ltd.), we receive from Google the email address of your Google account, confirmation that Google has verified it, your profile name and your Google account identifier; we also record when you confirmed your address (through Google, the confirmation link sent by email or a password reset link). We never receive your Google password or access to any other data in your Google account.
• Emails we send: which emails we sent you (type, date, delivery status and the message identifier at our email provider) and, where applicable, your unsubscribe.
• Payment and billing data: name or company name, billing address, tax ID (for companies), email, products bought, amounts, payment date, Stripe payment identifiers, invoice details and the time of the consent given at checkout (with the version of the Terms). Card details are entered directly with Stripe; we never receive them.
• Your content: the ideas (prompts) for clips and automations, reference images, photos uploaded for presenters (which may show people), videos and photos you upload (including in the editor), footage picked from the library, editor projects (cuts, texts, music, effects, titles) and the written commands given to the AI assistant, generated clips, images and texts, subtitles, post captions, brand names.
• Connected social accounts: the platform, the account identifier at our publishing provider, display name, username and profile picture (where the platform provides them), scheduled and published posts, their links and statistics (views, likes, comments, shares). The platforms’ access tokens stay with our publishing provider (Zernio) and are not stored by us.
• Service usage data: credits and their movements, connections and their subscription (periods, renewal, cancellation), a log of AI feature usage, API keys (we store only their hash and last-used date) and, for welcome credits, when they were given and a one-way fingerprint (SHA-256 hash) of the email address.
• Technical data: IP address, browser and device type, pages requested and errors, in the server logs; the session cookie and the others described in the Cookie Policy.
• Traffic analytics (only with your consent): a random visitor and visit identifier, pages visited, traffic source (referrer, UTM parameters), screen width, the link between a visit and a payment; through Google Analytics 4, aggregated statistics; through Microsoft Clarity, clicks, scrolling and mouse movement on the public pages, with all typed text masked.
• Marketing data (only with marketing consent): the TikTok identifiers (_ttp, ttclid), pages visited and, at payment, the amount, currency and order identifier; from our server, also the hashed (SHA-256) email, phone and account ID, IP address and browser.
• Correspondence you send to contact@postingclips.com.

We do not ask for special categories of data. Please do not put sensitive data about yourself or others in prompts or materials.

3. Purposes and legal bases

Account and billing data are needed to conclude the contract and, for invoices, required by law; without them we cannot create the account or process the order. Analytics and marketing data are optional.

4. Who receives the data

We use the following providers (processors or, where stated, independent controllers), only as far as each purpose requires:

We may disclose data to public authorities where the law requires it. We do not sell personal data. We use it for personalised advertising (retargeting on TikTok) only if you accepted the “Marketing” category.

Transfers outside the EEA. Some providers are in the US or other countries outside the European Economic Area. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework (for certified providers) or on the European Commission’s standard contractual clauses, with supplementary measures where needed. You can ask for a copy of the safeguards at contact@postingclips.com.

5. How long we keep data

• Account data, content, connected accounts and statistics: while the account is active. After the account is closed we delete them within 30 days, except as below.
• Orders, invoices and supporting documents (including proof of checkout consent): 10 years from the end of the financial year, under Accounting Law 82/1991.
• Data held temporarily by AI providers (for example raw clips at Replicate) is kept by them for a short time under their own policies; we copy the result into our own storage.
• Server logs: normally no more than 30 days, unless needed for an incident.
• Traffic analytics: at most 26 months; the visitor identifier in your browser at most 12 months or until you withdraw consent. Microsoft Clarity: session recordings 30 days, heatmaps at most 13 months.
• Marketing data (TikTok): the browser cookies at most 13 months; data received by TikTok, under TikTok’s policy.
• The log of emails sent: while the account is active. Unsubscribed addresses stay on the unsubscribe list after the account is closed, only so that we keep respecting the refusal.
• Welcome credits: we keep a one-way fingerprint (SHA-256 hash) of the email address of the accounts that received them, also after the account is closed, only so that the same person does not get the offer more than once (legitimate interest, art. 6(1)(f) GDPR). The address cannot be recovered from the fingerprint.
• Correspondence: as long as needed to handle the request and at most 3 years afterwards.

6. Your rights

Under the GDPR you have the right:

• of access to your data and to receive a copy (art. 15);
• to rectification of inaccurate data (art. 16);
• to erasure (“right to be forgotten”, art. 17), within the limits of legal retention duties;
• to restriction of processing (art. 18);
• to portability of the data you provided, in a structured format (art. 20);
• to object to processing based on legitimate interest (art. 21);
• to object at any time to tips-and-news emails (direct marketing, art. 21(2)), through the unsubscribe link in every email or by writing to us;
• to withdraw consent at any time, without affecting earlier processing (for example via the “Cookie settings” link in the site footer);
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (art. 22). We make no such decisions; AI content is generated at your request.

To exercise your rights write to contact@postingclips.com. We answer within one month (extendable by two months for complex requests) and may ask for information to confirm your identity.

You have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, sector 1, Bucharest, www.dataprotection.ro, or with the authority of the country where you live.

7. Security

We use encrypted connections (HTTPS), hashed passwords, API keys stored only as hashes, encryption of sensitive fields, restricted database access and providers with appropriate security guarantees. No system is completely secure; we will notify you as the law requires if a breach puts your rights at risk.

8. Children

The Service is not aimed at children under 16 and we do not knowingly collect their data. If you learn that a child under 16 has given us data, write to us and we will delete it.

9. Changes

We may update this policy; the version and effective date appear at the top of the page. Significant changes are announced in the app or by email.