Privacy Policy

1. Who is responsible

Evgeney Kirshner, trading as Clador Forge, is responsible for your personal data (the controller). You can contact us at support@cladorforge.com; our postal address is in the Legal Notice.

Our representative in the EU under Article 27 of the EU GDPR is:
Rickert Rechtsanwaltsgesellschaft mbH
– Clador Forge - Evgeney Kirshner –
Colmantstraße 15
53115 Bonn
Germany
art-27-rep-cladorforge@rickert.law

You may contact our EU representative about our processing of your personal data, including to exercise your rights under the EU GDPR.

We are not required to appoint a data protection officer.

2. Summary

• Account: your email address and sign-in details, to run your account (contract).
• Clips and publishing: your clips, their audio, transcripts and suggested texts, and your connected social accounts, to make and publish your shorts (contract).
• Billing: your plan and payment status from Lemon Squeezy, to manage your subscription (contract and legal obligation).
• Support and chat: your messages, to answer you (legitimate interest).
• Security: technical logs, to keep the service safe (legitimate interest).
• Website statistics: the pages you view, counted only if you allow it, to improve our website (consent).
• We do not sell personal data, do not show ads and do not use advertising cookies. Section 10 says how long we keep each kind of data, and section 8 who receives it.

3. What we collect and where it comes from

• Account: your email address, your password (stored only as a secure hash) and sign-in records. If you sign in with Google, we receive your email address and name from Google.
• Clips: the clips you upload from the desktop app, including their audio, and the transcripts, titles, descriptions, hashtags and shorts we make from them. Clips can contain your voice, face, gameplay, chat or usernames.
• Social connections: the names and connection status of the social accounts you connect through UploadPost, and your publishing schedule.
• Billing: your plan, trial and renewal dates, payment status and order references from Lemon Squeezy. We never receive your full card number.
• Support: the messages you send us by email or other channels, and any reason you give when you cancel or ask for a refund.
• Website chat: see section 7.
• Technical data: IP address, browser and device information, error and security logs, and, from the desktop app, installation identifiers and the app version.
• Website statistics: if you allow visit statistics, for each page view included in our analytics we record the page address with query parameters and URL fragments removed, the referring website when this information is available, your approximate location (country, region and city, derived from your IP address), your browser, operating system and device type, and the time of the view. No analytics cookies are used, and your IP address is not included in the page-view statistics; see section 13.

4. Do you have to give us your data?

Giving us your data is voluntary, and there is no legal duty to do so. But we need your email address to create an account, your clips to process them, and your connected accounts to publish. Without them we cannot provide those features. Each form marks the fields that are required.

5. Why we use your data and on what legal basis

• Contract: to provide your account, process clips, publish on your instruction, manage your plan, and handle cancellations and refunds. If automatic processing of a clip fails, we may view that clip only to fix the problem and complete its processing and publication; we do not use it for any other purpose.
• Legal obligation: to keep accounting and tax records and to answer lawful requests from authorities.
• Legitimate interests: to keep the service secure and prevent fraud and abuse, to apply usage limits, to answer visitors and customers, and to fix errors. You can object to this use at any time (section 11).
• Consent: to count page views with Vercel Web Analytics so that we can improve our website, only if you allow it. You can withdraw your consent at any time in our Cookie Policy; this does not affect the lawfulness of processing based on consent before its withdrawal. We would also ask for your consent before sending you advertising or using other optional cookies.

6. AI processing

When you upload a clip, its audio is transcribed by OpenAI, and an OpenAI model suggests a title, a description and five hashtags. We send these requests with OpenAI's storage turned off, and under OpenAI's API terms the data is not used to train its models.

We do not make decisions about you by automated means that have legal or similarly significant effects on you.

7. Website assistant (chat)

The chat on our website is an automated AI assistant that answers questions about Clador Forge. Its answers can be inaccurate; the prices and terms on our pricing page and in our legal documents take precedence.

What we process. The messages you type in the chat (the open chat sends your earlier questions again with each new one, for context), the language of the page you are using, and technical request data such as your IP address and browser information.

Purpose and legal basis. We use this data to answer your questions about the product and to protect the assistant from abuse with a daily question limit. Our legal basis is our legitimate interest in answering questions from visitors and customers and in keeping the service available or, where you ask about a plan or your purchase, taking steps at your request before entering into a contract.

Service provider. To generate answers, the chat text and the page language are sent to OpenAI, which acts as our service provider (processor) through its API. Your IP address is not sent to OpenAI. According to OpenAI's published API data controls, data sent to its API is not used to train OpenAI's models, and OpenAI may keep it in abuse-monitoring logs for up to 30 days unless a longer period is required by law. We send chat requests with OpenAI's response storage turned off.

What we keep. We do not store chat transcripts on our servers. The conversation exists only in the open chat window and is cleared when you close the chat or reload the page. Our server logs record only technical details of chat requests, such as the page language and the number of messages, never what you wrote. If you choose to continue with email from the chat, this browser tab keeps the visible conversation in its session storage for up to 30 minutes so the chat can reopen after you sign in; it is deleted as soon as it is restored.

Daily question limit. We count questions per day (UTC). For visitors who are not signed in, the count is linked to a salted one-way hash of the IP address; the IP address itself is not stored. For signed-in visitors, it is linked to a salted hash of the account ID, and our server checks the sign-in and the plan with our own account service. These counters are stored by Upstash, Inc., acting as our service provider (processor), in its Frankfurt (Germany) region and are deleted automatically after 48 hours. We also keep the day's total usage cost of the assistant, which contains no personal data.

International transfer. OpenAI may process this data in the United States, outside your country, including outside the EU/EEA and the UK.

Please do not share sensitive data. Do not enter passwords, payment details, health information, or other sensitive personal information in the chat. For questions about your account or a payment, contact support@cladorforge.com.

8. Who receives your data

We share data only with the providers we need, each for its own purpose:

• Railway Corporation (processor): our API, worker, database and rendering. Servers in the Netherlands (EU); a US company.
• Cloudflare, Inc. (processor): video storage, network proxy and downloads. The storage location is chosen by Cloudflare and may be outside the EU, for example in the United States.
• Vercel Inc. (processor): website hosting, the visit statistics you allow, and the chat function in Frankfurt. United States and the EU.
• OpenAI (processor): transcription, suggested titles, descriptions and hashtags, and the website assistant. United States.
• Upstash, Inc. (processor): the assistant's daily counters, stored in Frankfurt for 48 hours. EU region of a US company.
• Postmark (ActiveCampaign) (processor): account emails such as verification, password reset and billing notices. United States.
• UploadPost (TONVI TECH SL) (processor): social account connections, publishing and scheduling. Spain (EU).
• Lemon Squeezy (Link, LLC): checkout, billing, taxes and refunds. It is an independent controller for payment, tax and fraud data, and our processor where it acts on our instructions. United States.
• Google: only if you choose to sign in with Google; an independent controller. United States.
• YouTube, TikTok, Instagram and Facebook: the accounts you connect; each is an independent controller.
• Zoho Mail (Zoho Corporation) (processor): our support mailbox, which holds the emails you send us. United States.

We do not sell personal data. We disclose data to authorities only where the law requires it.

9. International transfers

We are based in Israel. The European Commission and the United Kingdom recognise Israel as providing adequate protection, so data from the EU and the UK can come to us on that basis. Providers outside Israel, the EU and the UK receive data under the EU Standard Contractual Clauses (and the UK Addendum) in our providers’ data processing agreements. You can ask us for a copy of the relevant safeguards.

10. How long we keep data

• The uploaded video of a clip you cancel: deleted at once.
• The video of a published clip: deleted from our storage 7 days after publication. The post stays on the social network.
• Scheduled posts that are not yet published when your access ends: removed when access ends.
• Your other videos, your publishing profile and your social connections after your access ends: deleted within 30 days.
• Your account record (email address, sign-in and plan history): while your account exists and for 30 days after it is deleted.
• Payment, invoice and tax records: Lemon Squeezy keeps its own; we keep our accounting records for 7 years, as Israeli tax law requires.
• The assistant's daily counters: 48 hours.
• The chat copy kept in your browser tab when you continue with email: up to 30 minutes.
• The sign-in cookie: 7 days without use, 30 days at most.
• Support emails and the reasons you give when you cancel or ask for a refund: 2 years.
• Server and security logs: 30 days.
• Visit statistics, if you allow them: our current Vercel plan provides a 12-month reporting window. This is not a deletion deadline: Vercel may retain analytics data for longer. Under our data processing agreement, Vercel must delete Customer Data within a commercially reasonable time after the agreement ends, unless retention is required by law.
• Your saved choice about visit statistics applies for 6 months. After that, we ask again when you next visit.

11. Your rights

• Everyone may see the data we hold about them and ask us to correct it.
• In the EU and the UK you may also ask us to delete your data or restrict its processing, receive it in a portable format, object to our use based on legitimate interests, and withdraw any consent.
• To use a right, email support@cladorforge.com from the address linked to your account. We may confirm the request with that address; we never ask for identity documents. We reply within 30 days.
• You may complain to the Israel Privacy Protection Authority, to the data protection authority in your EU country, or to the UK Information Commissioner's Office. If you are in the UK, we acknowledge a complaint to us within 30 days.

12. Emails we send

We send only service emails: about your account, security, the end of your trial, billing, refunds, cancellation and the end of your access. We do not send advertising unless you agree to it separately, and every advertising email would have a one-click unsubscribe link.

13. Cookies and similar storage

We use one sign-in cookie and four browser storage entries for website features and to remember your choices. We do not use advertising, tracking or analytics cookies. If you allow visit statistics, the page-view analytics script sets no cookies and writes no entries to localStorage or sessionStorage. It checks localStorage for an entry named __va_attribution, which our website does not create. Our Cookie Policy lists the entries, describes the statistics and lets you change your choice at any time.

14. Children

Clador Forge is not for children under 16. If we learn that a child under 16 has an account, we close it and delete the data. To make a purchase, you must be 18 or older; otherwise, a parent or guardian must make it for you.

15. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections. No method of transmission or storage is completely secure.

16. Changes

We may update this policy when the service changes. The date at the top shows the latest version. We tell account holders about material changes by email. You can ask us for earlier versions.

17. Contact

For privacy questions or requests, contact support@cladorforge.com.