Privacy policy

This policy explains what data Mustafa Esti ("we") processes in the Cliveo service, why and how. Data controller: Mustafa Esti, North Macedonia. Contact for privacy questions: [email protected].

Data we collect

• Account: email, optional name and a hash of your password (the password itself is never stored).
• Project content: the company and product details you enter, Company memory, logos, fonts, music, screenshots, Director chats and the videos produced.
• Websites you give us: when you enter a website address, we load its public pages to take screenshots and read text, colors, logos and photos. Do not enter sites you are not allowed to use.
• Payments: Paddle processes payments on the web and Apple processes purchases in the iOS app; your card details never reach us. We receive a customer ID, subscription status and a transaction summary (amount, currency, date).
• Technical: server logs (IP address, request time) for security and debugging. To give the welcome credits only once per person, we store a one-way hash of the network address used to sign up, never the address itself.
• Usage: which pages you visit and which buttons you click, to understand how the product is used and improve it. We use PostHog for this. It is linked to your account ID, never to the text you type, and session recording is off.

Why we process it

• To produce your videos and manage your account (performance of a contract).
• To track payments and credits (legal obligation and contract).
• To keep the service secure and prevent abuse, including repeated welcome credits (legitimate interest).
• To measure and improve the product (legitimate interest). You can object at any time by writing to us.
• To send emails you need: confirming your address, resetting your password and telling you a video is ready (you can turn the last one off in your account settings). We don't send marketing emails.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Service providers

We share data only with the providers needed to run the service, who process it on our behalf, and when required by law. We don't sell your data.

• Hosting and database: Railway (United States).
• Network and security: Cloudflare (United States).
• File storage: Amazon Web Services, servers in Frankfurt, Germany.
• AI: Anthropic and OpenAI (United States). When you use AI features, your project details and Company memory are sent to write scripts and suggestions; for voiceovers, the script text is sent to create the voice and time the captions. Only the information needed for that request is sent.
• Product analytics: PostHog, servers in the United States.
• Email: our email hosting provider, to send and receive email.
• Payments: Paddle (web) and Apple (iOS app) act as resellers and are responsible for the payment data they collect under their own privacy policies.

International transfers

Some providers are located outside your country, including in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework.

Retention

• We keep your data while your account is open. Deleting a project also deletes its screens and videos.
• When you close your account, your account, projects, files, videos, chats and credit history are deleted.
• We keep records of completed payments (transaction ID, amount, date) as long as tax and accounting law requires, and the one-way hash of your sign-up network so the welcome credits can't be claimed again.
• Security counters (for example, sign-in attempts) are deleted within a few hours; server logs are kept for a limited period.

Your rights

You have the right to access, correct, delete and port your data, to restrict or object to its processing, and to withdraw any consent you gave. You can delete your account yourself in your account settings. For any other request, write to [email protected]; we answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. In North Macedonia, this is the Personal Data Protection Agency.

Children

The Service is for people aged 18 and over. We don't knowingly collect data from children; if you believe a child has given us data, write to us and we will delete it.

Cookies

We only use cookies needed to keep you signed in. We don't use advertising or tracking cookies, and our product analytics stores nothing on your device. The checkout is provided by Paddle and may use its own cookies.

Changes

If we change this policy in a way that matters, we will tell you by email or within the Service before the change takes effect.