International Data Processing & Transfers

1. Introduction

This document explains how personal data of Clipia.ai users are processed and transferred internationally in connection with the provision of our AI-powered content generation services (the «Service»).

Clipia LLC, a limited liability company organised under the laws of the State of Wyoming, United States (hereinafter — the «Company» or «we»), is the data controller responsible for the personal data processed through the Service.

To operate the Service, personal data is processed by our infrastructure provider located in the Russian Federation and by third-party artificial-intelligence model providers and payment processors that may be located in various countries. By using the Service, you acknowledge that your personal data may be processed in, and transferred to, countries other than your own — including jurisdictions whose data-protection laws may differ from those of your country of residence.

2. Legal grounds for processing and transfer

We process and transfer personal data on one or more of the following legal grounds:

• Performance of a contract — to execute your generation requests and deliver the Service you have signed up for
• Consent — where you have given consent for a specific processing activity, which you may withdraw at any time
• Legitimate interests — to secure the Service, ensure service quality, and prevent abuse and fraud
• Legal obligation — to comply with applicable law, including tax and accounting requirements and lawful requests from public authorities

3. Categories of data processed

We do not intentionally collect special or sensitive categories of personal data (such as race, ethnicity, political or religious beliefs, health, or sexual orientation). If you voluntarily include such information in a prompt or reference media, it will be processed as part of your generation request.

4. Recipients and third-party processors

To provide the Service, we share personal data with third-party processors and sub-processors of the categories listed below, each bound by a Data Processing Agreement (DPA). The identity of the specific vendors we engage is confidential and commercially sensitive; it may be disclosed where required by applicable law or in response to a lawful request from a competent authority.

4.1. Categories of processors

Our primary hosting and media-storage infrastructure is located in the Russian Federation. Full payment card details are never disclosed to the Company by any payment processor — only anonymised tokens and transaction identifiers are shared.

4.2. Transfers to AI generation providers

Access to machine-learning models may be provided directly or through technology partners (infrastructure aggregators) that handle routing, load balancing, failover, and integration security. The identity and details of specific providers and partners are confidential and commercially sensitive.

Transmitted: prompt text, reference media, request parameters (model, resolution, duration), and an anonymised request ID.

Not transmitted: email, username, IP address, payment data, or any account content beyond the specific request.

5. International transfers and safeguards

Because our processors are located in several countries, your personal data may be transferred to and processed in the United States, the Russian Federation, the European Union, and other jurisdictions. Wherever personal data is transferred across borders, we apply appropriate safeguards designed to protect it:

• Data Processing Agreements (DPAs) with every recipient, including standard contractual clauses where required for transfers out of the European Economic Area or the United Kingdom
• Encryption of data in transit over secure channels (TLS 1.2 or higher)
• Data minimisation — only the data necessary for each purpose is transferred
• Access controls, logging, and audit of data transfers
• Hashing of user identifiers where feasible

6. Retention periods

• Generation content — transit-only, retained by AI providers for no more than 30 days
• Email and account identifiers — until you delete your account or withdraw consent
• Error monitoring technical logs — no more than 30 days
• Web-analytics data — no more than 14 months
• Payment data — as required by PCI DSS and applicable tax and accounting law

7. Your rights

Depending on your jurisdiction and applicable law (such as the California Consumer Privacy Act as amended by the CPRA, or the EU General Data Protection Regulation), you may have the right to:

• Access the personal data we hold about you, and learn how it is processed and to whom it is disclosed
• Correct or delete your personal data
• Restrict or object to certain processing, and opt out of any sale or sharing of personal data (we do not sell your personal data)
• Withdraw consent — note that use of the Service may become impossible, as generation requires sending requests to AI providers
• Data portability — receive your data in a portable, machine-readable format
• Non-discrimination for exercising any of these rights

To exercise any right, contact legal@clipia.ai. We respond within the time required by applicable law (generally within 30–45 days). If you believe your rights have been violated, you may lodge a complaint with the applicable data protection authority (for example, the California Privacy Protection Agency) or bring a claim before a court of competent jurisdiction.

8. Amendments

We may update this document from time to time. We will communicate material changes (for example, new categories of recipients or new destination jurisdictions) at least 30 calendar days in advance by email and through an in-service notice.

9. Contact

Data controller

Supervisory authority

If you are dissatisfied with how we handle your personal data, you may contact the data protection authority with jurisdiction over you — for example, the California Privacy Protection Agency in the United States, or the relevant supervisory authority in the European Economic Area — or seek relief before a court of competent jurisdiction.

Related documents

• Privacy Policy
• Terms of Service
• Cookie Policy