Encryption
Clipaist is served over HTTPS/TLS. Cloudflare D1 and R2 encrypt data at rest. Secrets and provider tokens stay server-side and are never placed in the browser bundle.
TRUST CENTER
Clipaist Agent handles business knowledge, customer questions and leads. This page explains the controls we use, where data goes, how long we keep it, and how to reach us about security. Last reviewed November 3, 2026.
Data Processing Agreement · Privacy Policy · Terms · Refund Policy
Access control
Passwords are stored as salted hashes, never plain text. The owner admin panel requires email + password + a fresh email one-time code on every login, with 12-hour HttpOnly, Secure, SameSite=Strict sessions.
Tenant isolation
Agent, knowledge, conversation, lead and usage queries are scoped to the signed-in owner. The public widget uses a per-agent public key, and one business cannot read another business’s data.
AI data handling
Prompts and relevant business knowledge are sent to AI providers only to produce the requested answer or media. We do not use private Agent content to train Clipaist’s own public models, and we do not sell customer data.
Retention controls
Chat transcripts follow the workspace retention setting: 7 to 365 days, default 90. Leads stay until the owner deletes them or the account is deleted. Generated media is normally kept up to 30 days in private storage.
Backups & recovery
Cloudflare D1 Time Travel provides point-in-time recovery, and we take exports before schema migrations. R2 media has a 30-day lifecycle rule. Business owners should also export leads and keep their own copy of important content.
Who processes what
For account and billing data, Clipaist is the controller. When a business uses Agent to talk to its customers, the business is normally the controller of those conversations and leads, and Clipaist is its processor under the DPA. The business decides what knowledge to upload, what to ask customers for, and how long to keep chats.
Do not use Agent as a records system for health, legal, financial, biometric, government-ID or children’s data unless you have a lawful basis and suitable safeguards.
Subprocessors
These providers help us run the service. The list is updated when a provider materially changes. Current as of November 3, 2026.
ProviderPurposeRegion
CloudflareHosting, CDN, security, D1 database, R2 storage and email routingGlobal edge / United States
AI inference providersGenerate answers, image edits and media from the request and relevant knowledgeUnited States / European Union / other provider regions
ZernioConnect social accounts, send and receive supported social messages, publish approved postsUnited States
Meta / Instagram / MessengerProcess connected social account messages and permissionsGlobal
Telegram / SlackProcess connected channel messages and delivery statusGlobal
ResendDeliver verification, password-reset, lead and handoff notification emailsUnited States
PaddleMerchant of record for paid plans: payment, tax, receipts and refundsUnited Kingdom / European Union / United States
SupabaseTemporary storage for reference images used by the free toolsUnited States
How we operate
- We keep the smallest practical amount of data: account details, business knowledge, conversations, leads and billing status.
- We redact obvious secrets and personal identifiers from error logs where possible, and restrict error access to the operator.
- We use rate limits, Turnstile where enabled, origin allowlists for the widget, and per-IP daily caps on expensive media tools.
- We review dependencies and provider access regularly. Only the owner can access the admin panel.
- We do not claim SOC 2, ISO 27001 or a certification we do not hold. If your procurement team needs a security questionnaire, email us.
- If you need a signed Data Processing Agreement, use the DPA page or email [email protected] with “DPA” in the subject.
Incident response & responsible disclosure
- Email [email protected] with “Security” in the subject. Include the affected URL, a clear description, and reproduction steps. Do not include passwords, customer data or live tokens.
- Give us a reasonable opportunity to investigate and fix the issue before public disclosure. We will acknowledge a good-faith report within two business days.
- Do not access, modify or delete another person’s data; do not disrupt the service, run automated load tests, or test third-party accounts you do not own.
- We do not currently run a paid bug-bounty programme. We will credit responsible researchers only with permission.
Security contact: [email protected] · security.txt
Need a DPA or security questionnaire?
We provide a standard Data Processing Agreement and can answer procurement questions about data flows, subprocessors, retention and access controls.
Read the DPA →