ClipstormSign in

Legal

Privacy Policy

Last updated August 25, 2026 · Effective August 25, 2026

This Privacy Policy explains how Green Card Genius LLC (“Clipstorm”, “we”, “us”, or “our”) collects, uses, shares, and protects your information when you access or use our automated short-form video creation, curation, and publishing platform at clipstorm.video(the “Service”).

We have written this policy in plain English. If you have questions about how your data is handled, please contact us at info@greencardgenius.com.

1. Overview & Key Principles

Summary of Data Practices

  • No sale of personal information. We do not sell, rent, or trade your personal information, account details, or creative assets to third-party data brokers or advertisers.
  • No foundational model training. As between you and us, we do not use your private script drafts, uploaded brand assets, or connected social channel data to train public or foundational AI models.
  • Encrypted credentials at rest. We implement technical safeguards, including encrypting third-party platform OAuth credentials and access tokens at rest.
  • Revocable connections.You maintain control over your connected accounts and can disconnect third-party social platforms at any time via the Service or through the platform provider’s security settings.

2. Information We Collect

A. Information You Provide Directly

  • Account & Profile Details: Your name, email address, and account password. Passwords are cryptographically hashed with salt prior to storage; we never see or store plaintext passwords.
  • Workspace & Tenant Settings: Workspace name, tenant slug, brand identity assets (such as brand colors, custom typography, logos, and voice presets), script persona guidelines, and source whitelist URLs and documents.
  • Creative Inputs & Assets: Video topics, ideas, prompts, script drafts, custom audio or b-roll footage you upload, captions, headlines, and call-to-action (CTA) destinations.
  • Feedback & Inquiries: The content of any customer support messages, feedback ratings, bug reports, or communications you send to us.

B. Connected Platform Credentials & Data (OAuth)

When you connect an external social media or messaging platform (such as YouTube, Instagram, Facebook, TikTok, or Slack), the platform provides us with OAuth credentials to act on your behalf:

  • OAuth Access and Refresh Tokens: Cryptographic tokens enabling scheduled and automated video publishing. Stored encrypted at rest (AES-256-GCM). We never receive or store your passwords for those platforms.
  • Channel & Account Metadata: Channel name, account ID, handle, profile avatar, and publishing permission status (used solely to identify connected destinations within the app).
  • Post References & Remote IDs: Post IDs, video URLs, and publication timestamps returned by the platform when a clip is published (used for tracking, analytics, and video retraction).

C. Information Collected Automatically

  • Technical & Device Data: IP address (utilized for security, DDoS protection, rate limiting, and geographic routing), browser type, operating system, and session timestamps.
  • Usage Analytics: Product interaction events (such as script generations, video renders, queue approvals, and schedule adjustments) collected via our PostHog telemetry instance (hosted in the European Union, GDPR-compliant, no third-party ad tracking).
  • Service Diagnostics & Logs: Server-side execution logs, pipeline error traces, and webhook delivery logs retained temporarily to ensure system stability and performance.

D. Cookies and Local Storage

We use only essential, first-party authentication cookies (HttpOnly, Secure, SameSite) to maintain your secure session. We do not use third-party behavioral advertising cookies, tracking pixels, or cross-site fingerprinting technologies.

3. How We Use Your Information

We process the information we collect for the following operational purposes:

  • Operating the Video Pipeline: Sourcing ideas, generating script drafts, synthesizing voiceovers, calculating word-level caption alignment, sourcing and composing b-roll footage, rendering composite video frames, creating cover thumbnails, and formatting output video files.
  • Publishing to Connected Platforms: Delivering approved videos, captions, descriptions, and thumbnails to your connected social channels (YouTube Shorts, Instagram Reels, Facebook Reels, TikTok) according to your configured schedule or immediate approval.
  • Workspace Administration: Maintaining tenant isolation, managing team member roles and invitations, authenticating users, and enforcing security policies.
  • Operational Notifications: Sending status updates regarding completed renders, review queue digests, publishing outcomes, and failure alerts via email or Slack.
  • Platform Security & Abuse Prevention: Enforcing rate limits, preventing automated abuse, securing infrastructure, and meeting legal and regulatory requirements.

4. YouTube API Services (Google API Disclosure)

Clipstorm integrates with YouTube API Services to publish videos directly to your connected YouTube channel. By connecting your YouTube account and using these publishing features, you agree to be bound by the YouTube Terms of Service and acknowledge that your data is governed by the Google Privacy Policy.

YouTube Data We Access and Purpose

  • Video Uploads (youtube.upload scope): Used to upload approved short-form videos, titles, descriptions, and tags directly to your YouTube channel as Shorts or videos.
  • Video Management & Retraction (youtube.force-ssl scope): Used to manage videos published through Clipstorm, specifically to update video metadata or retract a published video by setting its privacy status to private when requested by the workspace operator.
  • Channel Identification (youtube.readonly scope): Used to retrieve your channel title and channel ID so you can identify and manage connected accounts within the Settings panel.

YouTube Data Storage and Protection

We store only the encrypted OAuth refresh token required to maintain publishing connectivity, along with the resulting YouTube video ID and URL of published clips. We do not store internal user data from YouTube beyond basic channel identifiers. YouTube credentials and data are encrypted at rest (AES-256-GCM) and are never shared with external advertising networks or data brokers.

Revoking YouTube Access

You can disconnect your YouTube channel at any time from the Connections page inside Clipstorm, which permanently deletes our stored OAuth tokens and terminates publishing access. Additionally, you can revoke Clipstorm’s access directly from your Google Account security settings at myaccount.google.com/permissions or via the Google Security Settings page.

5. Meta Platforms & TikTok API Disclosures

Meta Platforms (Instagram Graph API & Facebook Pages API)

Clipstorm integrates with Meta APIs (Instagram Graph API and Facebook Pages API) to publish short-form Reels and videos to connected Instagram Professional accounts and Facebook Pages.

  • Permissions Requested: instagram_content_publish, pages_manage_posts, pages_read_engagement, and business_management.
  • Purpose: Creating container media, uploading video reels, publishing approved posts, and retrieving publication confirmation.
  • Policies: Use of Meta features is subject to the Meta Privacy Policy.
  • Revocation: Disconnect your account via Clipstorm Connections settings or through your Meta Business Integrations settings.

TikTok Content Posting API

Clipstormintegrates with TikTok’s Content Posting API to stage and post videos to your authorized TikTok profile. Your use is subject to the TikTok Privacy Policy. You can revoke access at any time via Clipstorm settings or through the TikTok application security settings.

6. Third-Party Service Providers & Sub-processors

We engage third-party service providers to deliver hosting, computation, AI synthesis, and delivery. We share only the minimum data necessary for each provider to perform its function:

  • Cloud Hosting & Edge Infrastructure (Vercel Inc.): Web application hosting, serverless edge compute, and routing (United States).
  • Video Rendering & Pipeline Compute (Railway Corp.): Dedicated worker infrastructure running headless browser rendering, HyperFrames engine, and FFmpeg video encoding (United States).
  • Database & Asset Storage (Neon Inc., Vercel Blob): Serverless PostgreSQL database hosting and encrypted cloud blob storage for video masters, audio tracks, and cover assets (United States).
  • AI Script & Ideation Providers (Google Vertex AI, Anthropic PBC, OpenAI LLC, Groq Inc.): AI language models utilized for script drafting, prompt expansion, and content structuring. Prompts sent to these providers do not include your account credentials.
  • Voiceover & Text-to-Speech Providers (ElevenLabs Inc., Groq Inc., Google Cloud TTS): Audio synthesis services used to generate spoken voiceover from approved script text.
  • Speech Recognition & Alignment (Whisper / Alignment Providers): Timestamp alignment tools used to generate precise word-level subtitle timings.
  • B-Roll & Visual Asset Providers (Pexels GmbH, Storyblocks Inc., Fal.ai, Kling AI, Runway AI, Luma AI): Stock video libraries and generative image/video providers used to source background footage and visual elements.
  • Transactional Email & Alerts (Resend Inc., Slack Technologies): Delivery of transactional emails (invites, password resets) and optional workspace notifications.
  • Product Analytics (PostHog Inc.): Anonymous and pseudonymized usage event analytics hosted in the European Union.

We do not sell personal data to any third party. We disclose information only when legally compelled by a valid subpoena, court order, or applicable law, or in connection with a corporate reorganization or merger with prior notice where permitted.

7. Data Retention & Deletion

Retention Timelines

  • OAuth Tokens: Retained only while the platform connection is active; permanently deleted immediately upon disconnection or revocation.
  • Videos, Scripts & Rendered Masters: Retained while your workspace remains active, or until deleted by a workspace operator.
  • Operational Logs: Server diagnostic logs and pipeline receipts are retained for 30 to 90 days and purged automatically.

Account & Data Deletion Requests

You may request deletion of your account and associated personal data at any time. To submit a deletion request:

  • Email info@greencardgenius.com from your registered account email with the subject line Data Deletion Request.
  • Upon identity verification, we process deletion requests in accordance with applicable statutory requirements and timelines, subject to any data retention necessary to comply with applicable laws, resolve ongoing disputes, maintain security, or enforce our legal agreements.

8. Data Security Safeguards

We implement reasonable technical and organizational measures designed to safeguard your information against unauthorized access, loss, or alteration:

  • Encryption in Transit: Web traffic and API communications are transmitted using TLS / HTTPS.
  • Encryption at Rest: Connected-account tokens and sensitive credentials are encrypted at rest using industry-standard cryptography (AES-256-GCM). Passwords are cryptographically hashed with salt.
  • Multi-Tenant Controls: Access controls designed to isolate workspace data between customer tenants.
  • Security Limitations: While we maintain reasonable security safeguards, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. Where required by applicable law, we will notify affected parties of confirmed data security breaches.

9. Statutory Privacy Rights

To the extent provided by applicable law in your jurisdiction (such as California, Virginia, Colorado, the European Economic Area, or the United Kingdom), you may possess certain statutory rights regarding your personal information:

  • Right to Know / Access: The right to request confirmation of processing and access to the categories and specific pieces of personal data we maintain about you.
  • Right to Rectification: The right to request correction of inaccurate personal records.
  • Right to Erasure / Deletion: The right to request deletion of personal information, subject to statutory exceptions.
  • Right to Restrict or Object: The right to object to or request restriction of certain processing activities under applicable law.
  • Right to Data Portability: The right to obtain a copy of your personal data in a usable format.
  • Non-Discrimination: We do not discriminate against individuals for exercising their statutory privacy rights where prohibited by applicable law.
  • Global Privacy Control (GPC): Where required by applicable law, we recognize Global Privacy Control signals.

To submit a request to exercise available statutory rights, please email info@greencardgenius.com. We may require reasonable identity verification before fulfilling statutory requests.

10. International Data Transfers

Clipstorm is operated from the United States, and data is processed on servers located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where applicable, we rely on Standard Contractual Clauses (SCCs) and equivalent cross-border transfer mechanisms to safeguard personal data.

11. Children’s Privacy

Clipstorm is strictly designed for business and professional use by individuals aged 18 and older. We do not knowingly collect personal information from individuals under 18 years of age. If we learn that personal data of a minor has been collected, we will take immediate steps to delete such data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When changes are made, we will update the “Last updated” date at the top of this page. Material updates will be accompanied by prominent notice within the Service or via email. Your continued use of the Service following the effective date of an update constitutes your acceptance of the revised policy.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Green Card Genius LLC
30 N Gould St Ste N
Sheridan, WY 82801, United States
Email: info@greencardgenius.com

Please also review our Terms of Service.