PRIVACY POLICY

TABLE OF CONTENTS

1. CONTROLLER
2. REGISTRATION AND USE OF THE PLATFORM
3. AUTOMATED ABUSE DETECTION (FRAUD SCORING)
4. PAYMENT PROCESSING
5. TAX PROCESSING AND REPORTING OBLIGATIONS
6. HOSTING, LOG FILES AND TECHNICAL OPERATION
7. RECIPIENTS AND THIRD-COUNTRY TRANSFERS
8. COOKIES
9. YOUR RIGHTS
10. CHANGES TO THIS POLICY

1. CONTROLLER

No data protection officer has been appointed; according to our documented assessment, the appointment obligations under Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act) do not apply.

2. REGISTRATION AND USE OF THE PLATFORM

We do not host the published clips themselves; they remain on the platform on which the Clipper published them. Of the clips, we store the link, metadata, a preview image and the performance data required to calculate the remuneration. Insofar as these records document which remuneration claims have arisen, they form part of the accounting records and are subject to the statutory retention periods set out in Section 5.3; they are erased once those periods have expired.

Source of the performance data (Art. 14(2)(f) GDPR): We do not collect the performance data from you but retrieve it via the interfaces of TikTok, Instagram and YouTube. What is retrieved are view and interaction figures as well as metadata of the clip and of the publishing profile.

Account deletion: If your account is deleted, the account is deactivated, pending processes are completed, the data is pseudonymised and erased once the retention periods set out in Section 5.3 have expired.

3. AUTOMATED ABUSE DETECTION (FRAUD SCORING)

In order to protect against automated or manipulated interactions, submitted clips are assessed by machine. Abuse detection is a mandatory platform minimum and cannot be deactivated; group operators may only set stricter thresholds. If the anomaly score exceeds the applicable threshold, the clip is blocked and initially does not trigger any further remuneration claims.

Legal basis: Art. 6(1)(b) and (f) GDPR: performance of the contract (determination of legitimate remuneration claims) and our legitimate interest in protecting the platform against manipulation.

Automated individual decision-making (Art. 22 GDPR): The blocking constitutes an automated individual decision within the meaning of Art. 22(1) GDPR. It is necessary for the performance of the contract between you and us (Art. 22(2)(a) GDPR), because remuneration claims can only arise for non-manipulated interactions and the review of the submitted clips must be carried out by machine due to their volume. As safeguards under Art. 22(3) GDPR, you have the right to obtain human intervention, to express your own point of view and to contest the decision. A final forfeiture of the remuneration only occurs after human review.

Logic involved, significance and consequences (Art. 13(2)(f) GDPR): The assessment covers interaction and history data of the submitted clip – the distribution of views over time, the ratio of views to interactions, repetition patterns and deviations from the average of the respective group – as well as public history data of the publishing social profile, such as posting frequency and profile category. We retrieve this data via the interfaces of the respective platform (Art. 14(2)(f) GDPR). An anomaly score is derived from this. Consequence: If the threshold is exceeded, the clip is blocked; initially no further remuneration claims arise for it. No profiling for other purposes takes place; the account is not blocked automatically.

Retention period: Scores and blocking decisions are retained for 24 months after completion of the respective process, or, where an objection is pending, until its conclusion. Thereafter they are erased, unless they are subject, as part of accounting records, to the periods set out in Section 5.3.

Your right to review: You may object to any blocking. The blocking will then be reviewed by a human being; you may express your point of view and contest the decision. Contact: contact@clipnity.com.

4. PAYMENT PROCESSING

Payouts are processed via Stripe Connect. We ourselves collect the KYC, identity and bank data required for payouts (name, date of birth, address, bank details, identity document where applicable) within our application and transfer it to Stripe Payments Europe, Ltd. (Ireland). Stripe processes this data in part as an independent controller, in particular in order to fulfil its own statutory verification and due diligence obligations, in accordance with its own privacy policy available at stripe.com/privacy.

Stripe transfers personal data within the group to Stripe, Inc. (USA). Stripe, Inc. is certified under the EU-US Data Privacy Framework; in addition, EU standard contractual clauses are in place.

5. TAX PROCESSING AND REPORTING OBLIGATIONS

5.1 Reports under the Platform Tax Transparency Act (PStTG / DAC7)

Insofar as we meet the requirements of a reporting platform operator within the meaning of the Plattformen-Steuertransparenzgesetz (PStTG – German Platform Tax Transparency Act), we are obliged to report information on Clipper remuneration to the Bundeszentralamt für Steuern (BZSt – German Federal Central Tax Office). We continuously assess whether these requirements are met and only report where the reporting obligation has been established. We collect the data required for this purpose irrespective of that, because it is also needed for other tax obligations.

• Data: Name, address, date of birth, state of residence, tax identification number, VAT identification number (where available), identifier of the financial account (e.g. IBAN) as well as the name of the account holder, insofar as this differs from the name of the Clipper and is available to us, amount of the remuneration, number of transactions, fees withheld.
• Legal basis: Art. 6(1)(c) GDPR: legal obligation (PStTG, Directive (EU) 2021/514).
• Recipient: the BZSt; it may forward the information to the tax authorities of your state of residence.
• Frequency: annually, by 31 January of the following year.
• Necessity: required by law. Without this data, no payouts are possible.
• Information: We will inform you about the data reported in relation to you.

Note: Amounts which have been set off against a slot purchase price (see the set-off provision in the Terms of Use) also count as remuneration, even if no payout has been made. The reporting obligation continues to apply even after an account has been deleted for the year of deletion.

5.2 VAT assessment

• Purpose: Determination of the VAT treatment, in particular application of the small business regulation (§ 19 UStG (German VAT Act)), assessment of the reverse charge liability of the recipient of the service (§ 13b UStG) for services obtained from abroad, as well as determination of the place of supply.
• Data: State of residence, entrepreneur status, VAT identification number.
• Legal basis: Art. 6(1)(c) GDPR.
• VIES check: In the current pilot operation we settle exclusively with users resident in Germany and applying the small business regulation (§ 19 UStG); no verification of VAT identification numbers currently takes place. Should we in future settle across borders with a reverse charge, we will verify VAT identification numbers via the VIES system of the European Commission and store the verification result with a timestamp as evidence.

5.3 Retention and limits of the right to erasure

Invoices, settlements, set-off records and the associated master data are subject to statutory retention periods:

The periods begin at the end of the calendar year in which the accounting voucher was created, the commercial or business letter was received or sent, or the invoice was issued (§ 147 Abs. 4 AO, § 14b Abs. 1 Satz 3 UStG). They do not expire insofar as and for as long as the documents are relevant to taxes for which the assessment period has not yet expired (§ 147 Abs. 3 Satz 5 AO). Once the periods have expired, the data is erased.

Deleting your user account does not erase this data. If an account is deleted, the account is deactivated, pending processes are completed and the remaining data is pseudonymised; settlements, set-off records and invoice data remain stored for the periods stated and are only erased once those periods have expired. The right to erasure does not apply in this respect, because the processing is necessary for compliance with a legal obligation (Art. 17(3)(b) GDPR). Within those periods, the processing of this data is restricted (Art. 18 GDPR); it is used exclusively for the fulfilment of tax obligations.

6. HOSTING, LOG FILES AND TECHNICAL OPERATION

6.1 Hosting

This website and the application backend run on a virtual server operated by

A further server, operated by Contabo GmbH, is located in the United States of America. It is addressed via geographically routed DNS, holds a copy of the user data, forwards changes to the German server and additionally serves as an API endpoint. Regarding the associated third-country transfer, see Section 7.

Legal basis: Art. 6(1)(b) GDPR for the operation of the service requested by you, as well as Art. 6(1)(f) GDPR: our legitimate interest in secure and reliable operation.

6.2 Log files

Log data is generated during the operation of the service. Depending on the component, it contains personal data:

Purpose: Operation and stabilisation of the service, error diagnosis as well as detection and investigation of attacks and abuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the service.

Retention period: Log data is erased after 30 days, unless an individual entry is required for longer in order to investigate a specific security incident.

6.3 E-mail

Transactional e-mails (registration, invoices, settlements, confirmations) are sent from our own mail server and delivered via Amazon Simple Email Service in the Europe (Frankfurt) region. The recipient address and the content of the message are processed for this purpose.

Legal basis: Art. 6(1)(b) GDPR.

6.4 Contact enquiries

If you write to us, by e-mail or via the form on our contact page, we process the details you provide in order to handle your enquiry.

The provision of this data is neither required by law nor by contract. Without it, however, we cannot reply to you.

Messages sent via the form are transmitted to our own API and forwarded from there to our mailbox. No third-party form service is involved.

6.5 Telephone number verification

For the verification of telephone numbers we use the service Prelude (prelude.so). The telephone number you provide, the verification status as well as device signals of the verification process (device platform, signals identifier) are processed.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR: our legitimate interest in preventing duplicate and fraudulent accounts.

7. RECIPIENTS AND THIRD-COUNTRY TRANSFERS

Personal data is disclosed to:

• the hosting provider (Section 6.1),
• the payment service provider (Section 4),
• the e-mail delivery service (Section 6.3),
• the telephone verification service (Section 6.5),
• the Bundeszentralamt für Steuern (German Federal Central Tax Office) (Section 5.1),
• other users of the platform, insofar as profile, statistics, leaderboards and messages are visible to them as intended (Section 2),
• rights holders and public authorities only after examination of a legal basis (Section 7.1).

Beyond that, we only pass on data where we are legally obliged to do so or where this is necessary for the establishment, exercise or defence of legal claims.

7.1 No disclosure of the Clipper's identity to Creators

The identity of individual Clippers is not disclosed to Creators. Clipnity provides the campaign service to the Creator in its own name and for its own account and commissions Clippers in its own name and for its own account; there is no contract between Creator and Clipper. The invoice issued to the Creator sets out exclusively the service provided by Clipnity in a single line item and contains no names, addresses or tax numbers of Clippers.

Settlement with the Clipper is carried out by means of a self-billed credit note from Clipnity to the Clipper (§ 14 Abs. 2 Satz 5 UStG). It is transmitted to the Clipper, not to the Creator.

Exception. If a third party asserts a statutory right to information or a public authority requests information, we examine the legal basis and scope, limit the disclosure to what is necessary, record every disclosure and inform the data subject insofar as this is legally permissible. Legal basis: Art. 6(1)(c) GDPR in the case of a legal obligation, otherwise Art. 6(1)(f) GDPR (establishment, exercise or defence of legal claims).

7.2 Transfer to the USA (server copy)

The server described in Section 6.1 and operated by Contabo GmbH is located in the United States of America and holds a copy of the user data. This therefore constitutes a transfer to a third country within the meaning of Chapter V GDPR.

An adequacy decision of the European Commission (EU-US Data Privacy Framework) has been in place for the USA since 10.07.2023. However, it applies only to US companies certified under that framework and does not cover this transfer. The transfer therefore takes place on the basis of the EU standard contractual clauses (Implementing Decision (EU) 2021/914) together with supplementary measures (encryption in transit, encryption at rest). In addition, a data processing agreement (Art. 28 GDPR) is in place with the provider. You may obtain a copy of the standard contractual clauses via contact@clipnity.com.

Notwithstanding the above, data on the US server may be subject to access by US authorities; the legal remedies available there do not fully correspond to those under Union law.

Regarding the intra-group transfer by Stripe to Stripe, Inc. (USA), see Section 4.

8. COOKIES

We use exclusively technically necessary cookies and storage techniques. A consent banner is not required, because the storage and access are strictly necessary in order to provide the digital service expressly requested by you (§ 25 Abs. 2 Nr. 2 TDDDG (German Digital Services Data Protection Act)). Details are set out in our Cookie Policy.

9. YOUR RIGHTS

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17; restricted insofar as statutory retention obligations exist, see Section 5.3), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) as well as the right to withdraw consent given with effect for the future (Art. 7(3) GDPR). In connection with the automated decision under Section 3, you additionally have the rights under Art. 22(3) GDPR (human intervention, expression of your own point of view, contestation).

Contact: contact@clipnity.com

Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). This concerns in particular the log data under Section 6.2 as well as those parts of the abuse detection which are based on our legitimate interest under Section 3; insofar as the abuse detection is necessary for the performance of the contract (Art. 6(1)(b) GDPR), it cannot be switched off, and in that respect you have the rights under Art. 22(3) GDPR. We will then no longer process the data based on Art. 6(1)(f) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The objection may be submitted without any particular form to: contact@clipnity.com

This notice is given expressly and separately from the other information in accordance with Art. 21(4) GDPR.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

10. CHANGES TO THIS POLICY

We will amend this policy if the legal situation or our processing changes. The version published on this website applies.

Version: 09.08.2026