Privacy Policy

Version 2026-08-18 — Last updated: 18 August 2026

This policy explains what personal data Cliply handles, why, and on whose behalf. It applies to the Cliply web application, the Cliply desktop application, public share links, and the Cliply marketing site.

Cliply is operated by ianaya89 LLC, a Wyoming limited liability company, with registered address at 30 North Gould Street, Suite R, Sheridan, WY 82801, United States. Privacy contact: hi@cliply.video.

Cliply is not a law firm and this is not legal advice. Where a term such as "controller", "processor" or "legal basis" is used, it carries the meaning given to it by the applicable data-protection law.

1. The part that matters most: who is responsible for what

Cliply plays two different roles, and the distinction decides who you contact about what.

The club is the controller of its footage and of player data. When a club, academy or federation uploads match video, tags it, tracks players, records voice notes, or creates share links, that organization decides why and how those people's data is processed. Cliply only stores and processes it on the organization's instructions. In data-protection terms the organization is the controller and Cliply is the processor.

That means:

• A player, a parent, or a member of staff who wants footage removed, corrected or explained should contact the club, not Cliply. Cliply will forward such a request to the organization and will help it act, but Cliply will not delete or hand over an organization's content on the request of someone who is not that organization.
• The organization warrants to Cliply that it holds a lawful basis and the necessary consents for every person appearing in the footage it uploads, references or shares — players, opponents, officials, coaching staff and spectators alike — and that it has given those people the privacy information their law requires.
• The organization is responsible for who it admits as a member, what role it gives them, and who it sends share links to.

Cliply is the controller of the account and business data it needs to run as a company. Names and email addresses of the people who hold Cliply accounts, billing records, support conversations, product analytics, security logs and marketing preferences are processed by Cliply for its own purposes, described below.

A Data Processing Agreement is not part of this policy. Clubs that need one — federations and European clubs in particular — should ask at hi@cliply.video.

2. Data Cliply handles

Account and profile

Name, optional surname, email address, password hash, profile image, interface language, time zone from the browser, two-factor status, and the roles held in each organization. Where an account is created with Google, Cliply receives name, email address and profile picture from Google, not the Google password.

Organization and membership

Organization name, logo, sport, teams, invitations sent and accepted, member roles, seat counts, feature flags and plan entitlements, and the audit trail of sensitive actions taken inside the organization — who changed a role, who deleted a video, who created a share link.

Billing

Plan, subscription status, invoices, credit balance, and the identifiers Stripe returns. Cliply never receives or stores full card numbers. Card data is entered on Stripe's own hosted pages and stays with Stripe. Cliply stores the payment method's type and last four digits as Stripe reports them, plus the billing details the organization enters for its invoices.

Footage and everything derived from it

This is the largest category and almost all of it is controlled by the club, not by Cliply:

• Video uploaded to Cliply's storage, or references to video hosted on YouTube, Vimeo, Internet Archive or another direct media address.
• Clips, tags, events, zones, qualifiers, notes and reactions created against that video.
• Telestrations and board animations drawn over frames.
• Player records — name, jersey number, position, team and, where a club fills them in, contact and academic fields on a player profile page.
• Computer-vision output — player detections, tracked markers, segmentation masks and the derived positions and colours. This is biometric-adjacent data about identifiable people; treat it accordingly.
• Voice recordings and their transcripts, from voice tagging and voice notes.
• AI analysis produced over a video's tags and clips.
• Share links and their activity — creation, access-code state, expiry, view counts, and the names entered at a roll-call attendance prompt.

Usage, analytics and telemetry

Product analytics events (which screens are used and which features are reached), error reports including stack traces and the surrounding request context, structured application logs, request metadata such as IP address, user agent, approximate location derived from IP, and rate-limiting counters. This data is Cliply's own, used to keep the service working and to decide what to build.

Communications

Support and contact-form messages, transactional email delivery status including bounces and spam complaints, and product-update campaign preferences including one-click unsubscribes.

3. Why Cliply processes it, and on what basis

| Purpose | Data | Legal basis | | --- | --- | --- | | Provide the service — store footage, render clips, run share links | Account, organization, footage and derived data | Performance of the contract; for footage, the club's own basis as controller | | Authenticate, secure sessions, stop abuse | Account, session, IP, rate-limit counters | Legitimate interest in a secure service; legal obligation where security law applies | | Bill and collect payment | Billing data | Performance of the contract; legal obligation for invoices and tax records | | Send transactional email — verification, password reset, invoices, expiry notices | Account and organization data | Performance of the contract | | Send product-update campaigns | Account email, marketing preference | Consent where required, otherwise legitimate interest in updating existing customers; one-click unsubscribe in every message | | Fix errors, measure reliability, understand feature use | Telemetry, analytics, logs | Legitimate interest in maintaining and improving the service | | Run optional AI features on request | The specific footage, audio or tags the feature is invoked on | Performance of the contract, on the club's instruction as controller | | Defend legal claims, comply with orders | Whatever the claim or order concerns | Legal obligation; legitimate interest in defending claims |

Cliply does not sell personal data, does not share it with advertising networks, and does not run advertising profiling. Cliply does not use customer footage or its derived data to train models offered to anyone else.

4. Minors

Cliply is used by clubs and academies with youth teams. Footage on the platform routinely contains children. That reality shapes several rules:

• Cliply accounts are for adults. A person must be at least 16 to hold one. Cliply does not knowingly create accounts for children.
• Children appear as subjects in a club's footage, never as account holders. The club is the controller of that footage and is responsible for the legal basis — in most jurisdictions, consent from a parent or legal guardian — before it is recorded, uploaded, tagged or shared.
• The club is responsible for narrowing the audience. Cliply provides the tools: access codes on share links, expiry dates, pausing a link, restricting a link to selected clips, and read-only viewer roles. Publishing footage of an identifiable minor beyond the team and the consenting families is the club's decision and the club's liability.
• Computer-vision tracking, voice transcripts and AI analysis applied to footage of minors produce data about children. Enable those features on youth footage only where the consent obtained covers them.
• A parent or guardian who wants a child's footage removed should contact the club. If they cannot reach it, they may write to hi@cliply.video and Cliply will pass the request on, identify the controlling organization, and support its response.

If Cliply learns that an account has been created by a child, that account is closed.

5. Who Cliply shares data with

Inside an organization

Content is visible to the members of the organization that owns it, according to their role. Owners and admins see the organization's audit trail. Nothing is shared with a different organization: data is scoped per organization at the query level.

Through share links

A share link exposes exactly what its creator selected to whoever holds the link. Cliply cannot know who that is. Where the link carries a roll-call prompt, the names entered are shown to the creating organization.

Subprocessors

Cliply uses the vendors below to run the service. Each is bound by a contract limiting it to processing on Cliply's instructions. This list is maintained against what the code actually calls; it changes as the product changes.

| Subprocessor | What it does | Data it sees | | --- | --- | --- | | Neon | Managed PostgreSQL — the primary database | All structured data: accounts, organizations, clips, tags, players, share links | | Vercel | Application hosting, edge network, cron | Requests, IP addresses, request logs | | Cloudflare (R2) | Object storage for video, images and reports | Uploaded footage, thumbnails, exported clips, match reports | | Cloudflare (Turnstile) | Bot check on signup and public forms | IP address, browser signals | | Cloudflare (Stream) | Video delivery, where a club has it enabled | Video files and playback requests | | Amazon Web Services | Object storage for the XML library and desktop releases; the queue and compute that render server-side exports | Video segments during a render, XML files, job metadata | | Stripe | Payments, subscriptions, invoices | Billing contact, card data entered on Stripe's pages, payment history | | Resend | Transactional and product-update email | Recipient email address, name, message content, delivery events | | OpenAI | Voice transcription, voice-tag extraction, match analysis, natural-language clip-list parsing | The audio clip or the tag and clip text the feature is invoked on | | Hugging Face | Hosts the model weights the browser downloads for in-browser segmentation and detection | Only the download request. Frames analysed this way stay on the device | | PostHog | Product analytics | Pseudonymous event stream, account identifier, IP address | | Sentry | Error monitoring | Stack traces, request context, account identifier | | Axiom | Structured log storage | Application logs, request metadata | | Upstash | Redis counters for rate limiting | IP address and request keys, short-lived |

Where a club references video hosted on YouTube, Vimeo or Internet Archive, the viewer's browser contacts that host directly and it receives the viewer's IP address and its own cookies under its own privacy policy. Cliply does not control that.

Cliply also discloses data where a law, a court or a regulator compels it, and to a successor entity in a merger or sale of the business, in which case this policy continues to apply until it is replaced with notice.

6. International transfers

Cliply is operated from the United States, and most of its subprocessors are based there. Personal data an organization puts into Cliply is therefore processed in the United States, and in the European Union where a subprocessor's region is set that way.

For personal data originating in the European Economic Area, the United Kingdom or Switzerland, that is an international transfer. Cliply relies on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved, together with the supplementary technical measures described under Security below. Cliply is not certified under the EU–US Data Privacy Framework and does not claim its protections.

Transfers from Argentina rely on the equivalent contractual mechanism under Argentine data-protection law.

A club that needs the signed clauses as part of a Data Processing Agreement should write to hi@cliply.video.

7. Retention

• Account data is kept while the account exists. Deleting an account removes the account record and its personal fields.
• Organization content — footage, clips, tags, players, drawings, tracking output, transcripts — is kept while the organization exists, and is deleted when the organization is deleted or the content is deleted inside it.
• Deletion propagates to backups within 35 days. Until then a copy can exist in a backup that has not yet rotated out.
• Billing records — invoices, payments, tax data — are kept for the period accounting and tax law requires, typically 10 years, even after an account closes.
• Security and application logs are kept up to 90 days.
• Product analytics are kept up to 12 months.
• Audit-trail entries inside an organization are kept while the organization exists; they are the record of who did what and are not editable.
• Suppression records — a bounced or unsubscribed email address — are kept indefinitely, because forgetting them would mean mailing that address again.

A lapsed plan does not delete anything. Dropping to the Free plan restricts features and makes over-limit content read-only; it does not erase content.

8. Your rights

Subject to the applicable law, you may ask to access the personal data held about you, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw a consent you gave, and complain to a supervisory authority.

Where to send the request depends on the role Cliply plays:

• About footage, clips, tracking output or player records — contact the club, academy or federation that owns the organization. It is the controller. Cliply will route a request it receives to that organization and support it.
• About your Cliply account, billing, marketing email or support history — write to hi@cliply.video. Cliply is the controller and will answer within the period the applicable law sets, and in any case within 30 days.

Cliply may ask for enough information to confirm identity before acting, so an account is not handed to someone impersonating its owner. Account deletion and organization deletion are also available directly in the application's settings.

Cliply does not take decisions producing legal effects about a person by automated means. The AI features produce suggestions a human accepts or discards.

9. Security

Data is encrypted in transit and at rest with the subprocessors above. Access to production data is limited to the people who need it. Passwords are stored hashed, never in clear text, and never received by Cliply when Google sign-in is used. Sessions can carry two-factor authentication. Uploads and downloads use short-lived signed URLs rather than public buckets, and every database query for organization content is scoped to the requesting organization.

No service is perfectly secure. Cliply makes no claim to any certification or audit standard — it holds none. Where a breach affects personal data, Cliply notifies affected organizations and the relevant authority within the deadline the applicable law sets.

Report a suspected vulnerability or breach to hi@cliply.video.

10. Cookies

Cliply uses cookies for authentication, preferences and analytics. What each one does, how long it lasts and how to control it is set out in the Cookie Policy.

11. Changes to this policy

This policy carries a version identifier, shown at the top of the page. For a material change, Cliply gives notice by email to account owners or in the application at least 30 days before it takes effect. Clarifications and a new subprocessor of the same kind take effect when published.

Contact

Email: hi@cliply.video

Entity: ianaya89 LLC, a Wyoming limited liability company

Address: 30 North Gould Street, Suite R, Sheridan, WY 82801, United States

Data protection contact: TODO(legal): ianaya89 LLC has no establishment in the EU or the UK, so offering the service to clubs there triggers the Article 27 GDPR representative requirement (and its UK equivalent). Appoint one and name them here before selling into Europe. A DPO is unlikely to be required at this scale.