1. Who we are
In plain words: Everlancer OÜ runs clipbeep and decides what happens to your personal data.
1.1 clipbeep (the app and clipbeep.com) is operated by Everlancer OÜ, a company registered in Estonia (registry code 17590253, Narva mnt 5, 10117 Tallinn) ("clipbeep", "we", "us").
1.2 We are the controller of the personal data described in this policy under the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This includes data we process when we run campaigns we sell to brands. Brands do not decide why or how we process your data and give us no instructions about it.
1.3 Contact us about anything in this policy at hello@clipbeep.com, or by post at the address above, marked "Privacy".
2. Who this policy covers
In plain words: clippers, people who work for brands, visitors to our site and links, and anyone who reports content to us.
2.1 This policy applies to:
(a) clippers: people who create a clipbeep account to make clips for campaigns, including people who post for an entity under section 2.12(b) of the Terms of Service for Clippers ("Clipper Terms");
(b) brand users: people who use clipbeep on behalf of a brand that buys campaigns from us, and the people named in a brand's business verification;
(c) visitors: people who visit clipbeep.com, a clipper's Links page or a public campaign page, or who click a tracked link or use a promo code minted on clipbeep;
(d) reporters and contacts: anyone who reports content under our notice-and-action procedure or writes to us;
(e) waitlist sign-ups: anyone who joins the clipbeep waitlist as a clipper or a brand.
2.2 When a brand republishes or edits a clip on its own channels under the licence of the Clipper Terms, the brand decides how it uses that clip and is responsible for that use under its own privacy terms. When you complete onboarding with a payout partner (section 7), that partner's privacy terms apply to its own checks.
2.3 clipbeep is for adults. We do not knowingly collect data from anyone under 18 (section 16).
3. The personal data we process
In plain words: what you give us, what we read from your connected accounts and your posts, what our systems record, and what our verification and payout partners tell us.
3.1 Clippers.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, sign-in records, public handle, profile settings, the Terms and policy versions you accepted and when | You; our systems |
| Questionnaire and profile | Age confirmation, sanctions self-certification, country of residence, country of tax residence, languages, niches and formats, AI-creator declaration, work status (self-employed, entity or freelancer), listed posting accounts | You (Clipper Terms 2.7, 2.11, 2.12) |
| Entity and business details | Legal name, registration number, VAT number and its VIES validation result, authority to act for the entity | You; the EU VIES system |
| Connected social accounts | Account identifier, your own posts and their public metrics (views, likes, publish date), encrypted access tokens | TikTok and Instagram through your connection; YouTube Data API for public statistics (section 4) |
| Clips and campaign activity | Clips, post links, showcase videos, campaign joins, rules versions accepted, disclosure and AI-use confirmations, amplification opt-ins and music and rights confirmations | You; our systems |
| Performance and ledger | Tracked links and promo codes, clicks and sales attributed to you, verified views, accruals, holds, voided entries, balance, self-billing invoices and correcting documents, payout statements | Our systems; brands (sale reports); platform APIs |
| Identity verification | Outcome (approved, declined, in review), warnings, issuing country of the document, whether the age check passed, whether there was a sanctions or AML hit. Didit holds the document image, the selfie and the data read from the document (section 6) | Didit |
| Payout and tax | Payout recipient name, payout method and partner status. For EU tax residents: legal name, date of birth, address, tax identification number (stored encrypted) and issuing country, or place of birth, and payout account and holder | You; our payment provider; our payout partners |
| Compliance and moderation | Fraud signals and reviews, warnings, strike requests and decisions, statements of reasons, appeals, DSA reports concerning your content | Our systems; brands; reporters; you |
| Device and security | IP address, device and browser data, session logs, signals of VPN, emulator or automated use | Our systems; Didit |
| Communications | Emails and in-app messages with us, and messages with brands through clipbeep's in-app messaging | You; brands |
3.2 Brand users. Name, business email, role, the brand you act for, sign-in and activity records, messages through clipbeep, and the outcome of the business verification Didit runs on the brand, which can include the names of directors and beneficial owners. For billing, we keep the brand's legal name, registry code, address, VAT number and the result of its VIES validation, where we return credit by bank transfer, the account details and our check that the account is in the brand's name, and, from our payment provider, a token for the brand's payment card with the card brand, the last four digits and the expiry date. Our payment provider holds the full card number; we never see it.
3.3 Visitors and people who click tracked links. When you click a tracked link, we record a one-way hash of your IP address and browser that changes every day, your country, the time of the click and the tracked link or promo code used. We do not store your IP address. On clipbeep.com we also measure visits as described in section 15. For sales, the brand reports to us an order reference, amount, time and refund or chargeback status.
3.4 Reporters. Your name and email address, the content you report and your explanation.
3.5 Waitlist. Your email address, whether you signed up as a clipper or a brand, the segment you chose and your country.
3.6 We do not ask for, and ask you not to send us, data about health, religion, political opinions or other special categories. The only exception is the biometric check in section 6.
4. Connected social accounts
In plain words: we read your own posts and their public numbers, nothing else, and you can disconnect at any time.
4.1 When you connect a TikTok account or an Instagram professional account, we read only which posts are yours and their public metrics, such as views, likes and publish date. We do not read your messages, followers or any other account's data, and we never post on your behalf. For YouTube we read public video statistics through the YouTube Data API, and no connection is needed.
4.2 Access tokens are encrypted and are not visible in our product or support tools. When you disconnect, we stop reading the account and delete its tokens. We keep the metrics already recorded for clips you submitted, because they support the ledger and payouts.
4.3 Your use of TikTok, Instagram and YouTube remains subject to their own privacy terms. YouTube's use of data is described in the Google Privacy Policy, and you can revoke our access in your Google security settings.
5. Why we process your data and on what legal basis
In plain words: mostly to perform our contract with you, partly because the law requires it, and partly for our legitimate interest in keeping clipbeep free of fraud.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, the questionnaire and your profile | Account, questionnaire, entity details | Contract, Art. 6(1)(b) |
| Admit you to campaigns, mint tracked links, receive and check submissions against the campaign rules | Profile, clips, campaign activity | Contract, Art. 6(1)(b) |
| Count, attribute and verify results, keep the ledger, issue self-billing invoices and payout statements and pay you | Connected accounts, performance and ledger, payout | Contract, Art. 6(1)(b) |
| Show your handle, clips and showcase videos to the brand that bought the campaign, and on public campaign pages and your Links page | Handle, clips, post performance, warnings and strikes | Contract, Art. 6(1)(b) |
| Use your clip in clipbeep's showcase and marketing (Grant A) | Clip, handle, metrics | Legitimate interest in promoting clipbeep, Art. 6(1)(f). You can opt out of paid advertising use (Clipper Terms 6.2) |
| Verify your identity and age before the first payout | Identity verification | Contract, Art. 6(1)(b), and legitimate interest in preventing payout fraud, Art. 6(1)(f). For the biometric match, see section 6 |
| Screen against EU sanctions | Identity verification, questionnaire, country checks | Legal obligation under the International Sanctions Act and EU sanctions regulations, Art. 6(1)(c) |
| Screen against US (OFAC) and UK sanctions and other watch lists | Same | Legitimate interest in not dealing with sanctioned persons and in keeping access to our payout partners, Art. 6(1)(f) |
| Validate tax residence and VAT numbers, and report under DAC7 to the Estonian Tax and Customs Board | Payout and tax, entity details, ledger | Legal obligation under the Taxation Act implementing Directive (EU) 2021/514, Art. 6(1)(c) |
| Keep accounting records | Ledger, payout statements | Legal obligation under the Accounting Act, Art. 6(1)(c) |
| Detect and investigate fraud, enforce the Terms, handle holds, strikes and appeals | Performance, device and security, compliance | Legitimate interest in the integrity of results and payouts, Art. 6(1)(f), and contract, Art. 6(1)(b) |
| Handle notices of illegal content, statements of reasons and complaints | Reports, content, account | Legal obligation under the Digital Services Act, Art. 6(1)(c) |
| Attribute clicks and sales from tracked links, and filter invalid traffic | Visitor and click data | Legitimate interest in measuring the results we pay for, Art. 6(1)(f) |
| Count visits to clipbeep.com and learn which sources bring sign-ups | Visit counts, attribution cookies (section 15) | Legitimate interest in understanding how people find and use clipbeep, Art. 6(1)(f). Section 15 explains when we ask for your consent to cookies |
| Secure clipbeep and keep logs | Device and security | Legitimate interest in security, Art. 6(1)(f) |
| Send service messages (campaign notices, holds, payout updates, changes to the Terms) | Account, communications | Contract, Art. 6(1)(b) |
| Send news about clipbeep features and campaigns | Legitimate interest, Art. 6(1)(f), for clippers and brand users we already work with, with an opt-out in every message; consent, Art. 6(1)(a), for anyone else | |
| Keep you on our waitlist and tell you when clipbeep opens to you | Waitlist sign-up | Steps you ask us to take before entering into a contract, Art. 6(1)(b) |
| Establish, exercise or defend legal claims, and answer authorities | Any relevant data | Legitimate interest, Art. 6(1)(f), or legal obligation, Art. 6(1)(c) |
| Run brand accounts and business verification of brands | Brand user data | Contract with the brand and our legitimate interest in knowing our customers, Art. 6(1)(f) |
| Invoice brands, charge their saved card and validate their VAT number | Brand billing details, card token | Legitimate interest in performing our contract with the brand, Art. 6(1)(f), and legal obligations under the Accounting Act and the VAT Act, Art. 6(1)(c) |
6. Identity verification and biometric data
In plain words: before your first payout, you prove who you are with your ID and a live selfie. The selfie is compared only with your own ID photo, and we never keep the images ourselves.
6.1 What the check is. Before your first payout, our identity verification provider Didit (didit.me) checks a government-issued identity document captured live with your phone camera. It runs an active liveness check and a one-to-one comparison of your selfie with the photo on that document. It also reads your age from the document, checks the document's issuing country and your device and location signals, and screens you against sanctions and watch lists, with ongoing monitoring after approval. For EU documents you also confirm your email with a one-time code.
6.2 Why we need it. It is the only automated way for us to confirm that the person we pay is the person on the identity document. We need that to prevent payout fraud and account takeover, to enforce one person, one account, to confirm you are 18 or over, and to apply sanctions screening and DAC7 due diligence to the right person. The check is a condition for receiving payouts. You can use clipbeep and earn accruals without it, but we cannot pay you until it is approved, and what you earned stays on your balance.
6.3 Legal basis for the biometric match. The selfie comparison uses biometric data, which is special category data. We process it only on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give in a separate step by ticking an unticked box before the check starts. We record the consent text version and the time. We ask for it because the match is necessary to perform our contract with you, in particular the payouts, and to protect you and us against someone else being paid in your name. You can withdraw consent at any time. Withdrawal does not affect checks already completed, but until a new check is approved we cannot release payouts. The rest of the check (document, age, sanctions, device and location) rests on the bases in section 5.
6.4 What we never do. We never compare your selfie with other people's faces or with any database of faces. We do not use biometric data for anything other than this one-to-one check.
6.5 Who holds what. Didit carries out the check for us as our processor, under a data processing agreement. It processes and stores verification data in the European Union (on AWS in Ireland), encrypted at rest and in transit. We do not allow Didit to use our verification data to train or improve its models. Didit holds the document image, the selfie, the biometric template and the data read from the document. Our own database keeps only a minimised summary: status, warnings, the document's issuing country, whether the age check passed and whether there was a sanctions or AML hit. Didit also processes some data as an independent controller, for its own fraud-prevention network and to meet its own legal obligations, under its own privacy notice at didit.me.
6.6 Decisions. Didit returns approved, declined or in review. A person on our side decides every session that goes to review. If you are declined, you can start a new verification after 7 days, and you can ask us to explain the decision and to have a person look at it (section 9).
7. Who sees your data
In plain words: brands see your handle and your work for their campaign, never your identity, tax or payout details. We do not sell personal data.
7.1 Brands. A brand that has bought a campaign from us sees only what it needs to review the work it bought: your public handle, the clips and post links you submit to its campaign, your showcase videos, the performance of those posts, our warnings and strike decisions on them, and messages you exchange with it through clipbeep. Brands never receive your legal name, contact details, identity or tax information, payout details, balance or earnings, or anything we read from your connected accounts beyond the public metrics of posts in its campaign. Brands cannot export clipper data, and our contracts with them forbid them to use what they see to contact you outside clipbeep, profile you or keep their own records about you. A brand receives this data as a recipient. It is not a controller or joint controller of our processing.
7.2 The public. Your public handle and the clips you submitted to a campaign appear on public campaign pages and on your Links page while the campaign runs. Your earnings, balance and payouts never appear publicly.
7.3 Our processors. Service providers process data for us under data processing agreements and only on our instructions:
| Provider | Service | Location |
|---|---|---|
| Didit | Identity and business verification (section 6) | EU (Ireland) |
| Vercel | Application servers, content delivery, runtime logs and cookieless web analytics | EU (Frankfurt); US for logs and edge delivery (Data Privacy Framework) |
| Resend | Sign-in links and service emails | Sent from the EU (Ireland); stored in the US (Data Privacy Framework and standard contractual clauses) |
| Supabase | Database, sign-in and file storage | EU (Frankfurt, on AWS); support access from the US and Singapore (standard contractual clauses) |
| Google Workspace | Support email | EU and US (Data Privacy Framework) |
| GitHub | Daily database backups, kept for 30 days | US (Data Privacy Framework) |
7.4 Independent controllers. These recipients decide for themselves how they process the data they receive, under their own privacy terms:
(a) payout partners: a licensed payment institution for card and bank payouts and, where needed, an additional licensed payout provider. Each runs its own checks and onboarding, and receives your name, payout details and the amount;
(b) Didit, for its own fraud-prevention network and legal obligations (section 6.5);
(c) TikTok, Instagram (Meta) and YouTube (Google), which provide the API data in section 4;
(d) the Estonian Tax and Customs Board, for DAC7 reports, which it may share with the tax authority of your country of residence;
(e) authorities, courts and law enforcement, where the law requires it;
(f) professional advisers (lawyers, auditors, accountants), under a duty of confidentiality;
(g) a buyer or successor of our business, if clipbeep is sold or merged, under this policy.
7.5 We do not sell personal data, and we do not share it for advertising by third parties.
8. Transfers outside the EU
In plain words: we keep data in the EU where we can. When it leaves, we use the safeguards the GDPR requires.
8.1 We store our database and files in Frankfurt, Germany, and our application runs in the Frankfurt region of our hosting provider, Vercel. Some of our providers are US companies, so some data does leave the EEA: Vercel's global delivery network and service logs process technical data, such as IP addresses and request details, in the United States; Resend sends our emails from Ireland but stores them and their delivery records in the United States; our daily database backups are kept on GitHub in the United States for 30 days; and Supabase may access our database from the United States or Singapore to support and maintain it. Other recipients are outside the EEA, notably one of our payout partners, in the United States, and the social platforms in section 4, and payouts to clippers outside the EEA necessarily go to the clipper's country.
8.2 Where personal data leaves the EEA, we rely on one of the following: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified US recipients; the Commission's standard contractual clauses, with supplementary measures where needed; or, for a payout to you in your own country, the necessity of the transfer to perform our contract with you (Art. 49(1)(b) GDPR). Ask us for a copy of the relevant safeguards at hello@clipbeep.com.
9. Automated monitoring and decisions
In plain words: software counts results and flags fraud. A person makes every decision that closes your account, confirms a strike, voids a result for cause or claws money back.
9.1 What we monitor. The posts you submit and their public metrics (views, publish date, whether the post is still public), clicks and sales through your tracked links and promo codes, your submissions against the campaign card (including the disclosure confirmation), and fraud signals of the kinds listed in section 11 of the Clipper Terms, such as unusual view patterns, duplicate content and refund or chargeback rates.
9.2 What automated systems decide or support. Whether a view or sale is counted and attributed to you, whether an accrual is held for review, fraud flags (a signal that a social account may belong to someone else does not place a hold by itself: a person reviews it first), automatic admission filters a brand sets for a campaign, and, where our pricing model sets it, the rate we offer within our rate card bands. These decisions are necessary to perform our contract with you at scale (Art. 22(2)(a) GDPR). The factors that matter most are those named in the corresponding sections of the Clipper Terms.
9.3 What a person always decides. A person at clipbeep makes or confirms every decision to restrict, suspend or close your account, to confirm a strike, to void an accrual for fraud, a rule breach, a strike or a private account, to recover an amount already paid to you, and to decide an identity verification session in review.
9.4 What we never do. We do not use automated systems to process data about your emotional or psychological state, your private messages or conversations, anything you do while you are not working on clipbeep, or your collective activity.
9.5 Your rights. You can ask us at any time to explain a decision an automated system took or supported that affects you, to express your point of view, and to have a person review it. We reply in writing within 10 business days. Where the decision was wrong, we correct it and restore what it affected. We tell you before we make a significant change to these systems.
10. Reports of illegal content and moderation
10.1 When you report content under our notice-and-action procedure, we use your name, email address and report to review it, to tell you our decision and how to challenge it, and to keep a record. We do not tell the clipper or brand concerned who reported them, unless the law requires it or the report concerns their intellectual property rights and naming you is necessary.
10.2 When we restrict content or an account, we keep the statement of reasons and any appeal. Where the law requires it, we submit statements of reasons, without personal data, to the European Commission's DSA Transparency Database.
11. Tax reporting (DAC7)
11.1 For DAC7, Estonian law treats us as a reporting platform operator for the services clippers provide to us. For each clipper who is resident in, or has an address in, an EU member state, we collect and verify the details in section 3.1 under Payout and tax, and we report them once a year to the Estonian Tax and Customs Board. The report includes the amounts paid, the number of paid results and any fees or taxes withheld, broken down by quarter. We report by 31 January for the previous calendar year, and by the same date we send you a copy of what we reported about you. No minimum threshold applies to services.
11.2 If you live outside the EU, we do not report you under DAC7 and do not collect DAC7 details. We ask only what we need to confirm your residence and to issue payout statements.
12. How long we keep data
In plain words: as long as your account is open, then only what the law or a possible dispute requires.
| Data | How long |
|---|---|
| Accounting and payout records: ledger, self-billing invoices and correcting documents, payout statements, payout recipient name, brand invoices and billing details | 7 years from the end of the financial year (Accounting Act) |
| DAC7 records and reports | 7 years from the end of the reporting period, as the Taxation Act requires |
| Identity verification summary held by us | While your account is open and 3 years after the business relationship ends |
| Identity verification images, biometric template and document data held by Didit | 3 years from the verification, after which Didit deletes them. The biometric template is deleted together with the session. Didit's own legal retention applies to its controller processing |
| Fraud investigations and decisions | 3 years from the decision |
| Warnings, strike requests and strike decisions | 12 months; 3 years where the decision led to termination |
| Account, questionnaire and profile | While your account is open, then up to 3 years for possible claims |
| Waitlist sign-ups | Until you create an account or leave the waitlist, and at most 2 years after you signed up |
| Clips, post links and metrics behind accruals | As long as the ledger entry they support |
| Showcase videos | Until you delete them or your account is erased |
| Social account access tokens | Until you disconnect or close your account |
| Notices of illegal content, statements of reasons and appeals | 3 years |
| Tracked-link clicks (daily hash of IP address and browser, country, time) | Clicks that led to a paid sale: as long as the accounting record of that sale. All other clicks: 90 days, or the campaign's attribution window plus three days where that is longer, after which we keep only counts |
| Technical logs at our hosting provider (Vercel) | 1 hour |
| Audit log of admin actions and money movements | As long as the records it explains, up to 7 years |
| Support emails and messages | 3 years from the last message |
| Brand user data | While the brand's account is open, then 3 years. The card token is deleted when the card is removed or the account closes |
| Database backups | 30 days |
When a period ends, we delete the data or make it anonymous. If data is needed for an ongoing dispute, investigation or a request from an authority, we keep it until that is closed.
13. Your rights
In plain words: you can see, correct, delete, move and object to the use of your data. Email us and we answer within a month.
13.1 Under the GDPR you have the right to:
(a) access your personal data and get a copy (Art. 15);
(b) have inaccurate data corrected (Art. 16). Most profile data you can correct yourself in your profile;
(c) have data erased (Art. 17), except where we must keep it under section 12;
(d) restrict processing while a dispute about accuracy or an objection is open (Art. 18);
(e) receive data you gave us in a portable format (Art. 20);
(f) object to processing based on legitimate interest (Art. 21), and at any time to direct marketing;
(g) not be subject to a decision based solely on automated processing with legal or similarly significant effects, except as section 9 describes, and to obtain human review of such a decision (Art. 22);
(h) withdraw consent at any time, without affecting processing before withdrawal (Art. 7(3)).
13.2 Write to hello@clipbeep.com from the email on your account. We may ask for more information to confirm it is you. We answer within one month. Where a request is complex, we may extend that by two more months and will tell you why within the first month. Requests are free unless they are manifestly unfounded or excessive.
13.3 If you think we have not handled your data properly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or to the supervisory authority where you live or work. We would appreciate the chance to fix it first.
14. Security
14.1 We protect personal data with technical and organisational measures suited to the risk. These include encryption in transit, encryption of access tokens and tax identification numbers, signed and verified webhooks from our verification provider, access restricted to staff who need it, and logging of access to sensitive records.
14.2 If a personal data breach is likely to result in a high risk to you, we tell you without undue delay, as well as the Data Protection Inspectorate where required.
15. Cookies and similar technologies
15.1 We use cookies and similar technologies that are strictly necessary to sign you in, keep clipbeep secure and run tracked links. These do not need consent.
15.2 We measure visits with Vercel Web Analytics, which sets no cookies and recognises a visit only by a hash of the request that is discarded after 24 hours. With your consent, we also set two first-party cookies to learn where sign-ups come from: a random anonymous identifier, kept for 400 days, and the campaign source of your first visit (its UTM parameters) and the page you came from, kept for 30 days and set only when you arrive through a link that carries them. You give and withdraw consent through the cookie banner and settings on clipbeep.com. We use no third-party cookies or trackers.
15.3 When a visitor clicks a tracked link and arrives at a brand's site, the brand's own cookies and privacy policy apply there.
16. Under-18s
16.1 clipbeep is not for anyone under 18. We verify age before the first payout. If we learn that an account belongs to someone under 18, we close it and delete their data, except what we must keep under section 12.
17. Changes to this policy
17.1 We update this policy when our processing changes. We tell you about material changes by email and in the app before they take effect, and show the version and date at the top. Earlier versions are available on request.
18. Contact
Everlancer OÜ, registry code 17590253, Narva mnt 5, 10117 Tallinn, Estonia. Email: hello@clipbeep.com.