International Data Processing & Transfers

1. Introduction

This document explains how personal data of Clipia.ai users are processed and transferred internationally in connection with the provision of our AI-powered content generation services (the «Service»).

Clipia LLC, a limited liability company organised under the laws of the State of Wyoming, United States (hereinafter — the «Company» or «we»), is the data controller responsible for the personal data processed through the Service.

To operate the Service, personal data is processed by our infrastructure provider located in the Russian Federation and by third-party artificial-intelligence model providers and payment processors that may be located in various countries. By using the Service, you acknowledge that your personal data may be processed in, and transferred to, countries other than your own — including jurisdictions whose data-protection laws may differ from those of your country of residence.

2. Legal grounds for processing and transfer

We process and transfer personal data on one or more of the following legal grounds:

• Performance of a contract — to execute your generation requests and deliver the Service you have signed up for
• Consent — where you have given consent for a specific processing activity, which you may withdraw at any time
• Legitimate interests — to secure the Service, ensure service quality, and prevent abuse and fraud
• Legal obligation — to comply with applicable law, including tax and accounting requirements and lawful requests from public authorities

3. Categories of data processed

We do not intentionally collect special or sensitive categories of personal data (such as race, ethnicity, political or religious beliefs, health, or sexual orientation). If you voluntarily include such information in a prompt or reference media, it will be processed as part of your generation request.

4. Recipients and third-party processors

To provide the Service, we share personal data with third-party processors and sub-processors of the categories listed below, each bound by a Data Processing Agreement (DPA). The identity of the specific vendors we engage is confidential and commercially sensitive; it may be disclosed where required by applicable law or in response to a lawful request from a competent authority.

4.1. Categories of processors

Our primary hosting and media-storage infrastructure is located in the Russian Federation. Full payment card details are never disclosed to the Company by any payment processor — only anonymised customer and transaction identifiers are shared.

For purchases charged in US dollars, Stripe acts as the merchant of record and processes your payment data under its own privacy policy and its own role as a data controller for that processing. The data it receives — your payment details, billing country and the amount — is collected by Stripe directly at checkout and is used to take the payment, calculate the tax due, issue your receipt and handle chargebacks. See the Payment Information page for the full description of that arrangement.

4.2. Transfers to AI generation providers

Access to machine-learning models may be provided directly or through technology partners (infrastructure aggregators) that handle routing, load balancing, failover, and integration security. The identity and details of specific providers and partners are confidential and commercially sensitive.

Transmitted: prompt text, reference media, request parameters (model, resolution, duration), and an anonymised request ID.

Not transmitted: the email address in clear text, username, IP address, payment data, or any account content beyond the specific request.

4.3. Transfers to advertising measurement platforms

When you register and confirm your email address, we send the fact of that conversion to advertising measurement platforms located in the United States, together with a SHA-256 hash of your email address. The hash is used solely to match the conversion to an advertising impression and to assess the performance of advertising campaigns.

This transfer takes place only for users located outside the Russian Federation. For users accessing the Service from the territory of the Russian Federation, the corresponding platform tags are not loaded and no such transfer occurs.

The email address in clear text, the username, prompt content, and generation results are never sent to advertising measurement platforms.

Legal grounds: the consent given by the data subject on registration and acceptance of the Terms of Service, together with our legitimate interest in measuring advertising performance. The data involved is first recorded in a database located in the Russian Federation, which makes this a cross-border transfer of previously collected data rather than a primary collection of data abroad.

5. International transfers and safeguards

Because our processors are located in several countries, your personal data may be transferred to and processed in the United States, the Russian Federation, the European Union, and other jurisdictions. Wherever personal data is transferred across borders, we apply appropriate safeguards designed to protect it:

• Data Processing Agreements (DPAs) with every recipient, including standard contractual clauses where required for transfers out of the European Economic Area or the United Kingdom
• Encryption of data in transit over secure channels (TLS 1.2 or higher)
• Data minimisation — only the data necessary for each purpose is transferred
• Access controls, logging, and audit of data transfers
• Hashing of user identifiers where feasible

6. Retention periods

• Generation content — transit-only, retained by AI providers for no more than 30 days
• Email and account identifiers — until you delete your account or withdraw consent
• Error monitoring technical logs — no more than 30 days
• Web-analytics data — no more than 14 months
• Payment data — as required by PCI DSS and applicable tax and accounting law

7. Your rights

Depending on your jurisdiction and applicable law (such as the California Consumer Privacy Act as amended by the CPRA, or the EU General Data Protection Regulation), you may have the right to:

• Access the personal data we hold about you, and learn how it is processed and to whom it is disclosed
• Correct or delete your personal data
• Restrict or object to certain processing, and opt out of any sale or sharing of personal data (we do not sell your personal data)
• Stop the transfer — transfers required to deliver the Service rest on contract performance, not consent, so they cannot be stopped separately from the Service itself: closing your account ends them. Consents you gave for separate purposes can be withdrawn on their own, without closing the account
• Data portability — receive your data in a portable, machine-readable format
• Non-discrimination for exercising any of these rights

To exercise any right, contact legal@clipia.ai. We respond within the time required by applicable law (generally within 30–45 days). Where a request is governed by Russian Federal Law No. 152-FZ, the Russian operator responds within 10 business days of receiving it; that period may be extended by no more than 5 business days, with notice to you stating the reasons for the extension. If you believe your rights have been violated, you may lodge a complaint with the applicable data protection authority (for example, the California Privacy Protection Agency) or bring a claim before a court of competent jurisdiction.

8. Amendments

We may update this document from time to time. We will communicate material changes (for example, new categories of recipients or new destination jurisdictions) at least 30 calendar days in advance by email and through an in-service notice.

9. Contact

Data controller

Supervisory authority

If you are dissatisfied with how we handle your personal data, you may contact the data protection authority with jurisdiction over you — for example, the California Privacy Protection Agency in the United States, or the relevant supervisory authority in the European Economic Area — or seek relief before a court of competent jurisdiction.

Related documents

• Privacy Policy
• Terms of Service
• Cookie Policy