ClipReceipt Privacy Policy
Effective date: 6 May 2025
ClipReceipt ("we," "us," or "our") provides an online web application and email‑based market‑analysis newsletter for YouTube creators (the "Service"). We operate from Ontario, Canada and market globally. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service, and describes the rights and choices available to you.
At‑a‑glance • We collect only the information needed to deliver the Service—primarily your name, email address, YouTube‑competitor list, and payment details processed by Stripe. • We do not sell personal data. • Operational data is erased within 30 days of account deletion, while tax records are retained for 7 years. • We respect Global Privacy Control (GPC) signals once our cookie‑consent banner launches.
1. Information We Collect
| Category | Data elements | Source | Purpose |
|---|---|---|---|
| Account information | Name, email address | Direct from you (signup form or Google OAuth via Supabase) | Create and maintain your account; send the newsletter. |
| Competitor list | URLs or channel IDs you input | Direct from you | Generate market‑analysis reports. |
| Payment information | Name, email, card details, billing data | Collected and stored by Stripe on our behalf | Process subscription fees; comply with tax & accounting obligations. |
| Technical data (essential) | IP address, browser type, device OS, authentication cookies, server logs | Automated, via Vercel and Supabase | Secure the Service; prevent abuse; generate anonymous usage metrics. |
| Planned analytics (optional) | Page views, feature usage | Cookies or similar; provider TBD | Product improvement; will require consent once implemented. |
We do not intentionally collect sensitive personal data (e.g., health, biometric) or data from children under 18.
2. How We Use Your Information
We use personal data only when we have a valid legal basis:
- Contract necessity – to create your account, deliver market‑analysis emails, provide customer support, and process payments.
- Legitimate interests – to maintain the security and performance of the Service, and to improve core features (we balance these interests with your privacy rights).
- Consent – for any non‑essential analytics or marketing communications beyond the core newsletter; you may withdraw consent at any time.
3. Sharing & Disclosure
We share information strictly as needed with trusted service providers who are bound by confidentiality and data‑processing agreements:
| Provider | Role | Location |
|---|---|---|
| Vercel | Hosting and content delivery | USA (US‑East) |
| Supabase | Authentication and database | USA |
| Stripe | Payment processing | USA & global |
| Resend | Transactional email delivery | USA |
We may also share data to comply with legal obligations or to protect our rights, property, or users.
No sale of personal information. We do not sell or rent your data to third parties.
4. International Transfers
Your information may be transferred to and processed in countries outside of your own, including the United States. Where required, we rely on Standard Contractual Clauses or other lawful mechanisms to protect such transfers.
5. Data Retention
- Operational data (account details, competitor lists, server logs) is deleted within 30 days of confirmed account deletion.
- Database backups are encrypted and stored on a rolling 30‑day retention cycle.
- Payment and invoice data required for tax and accounting is retained for 7 years.
- We may retain anonymized or aggregated data that does not identify you.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access and receive a copy of your personal data.
- Correct inaccurate or incomplete data.
- Delete your data (subject to legal exemptions).
- Object to or restrict processing.
- Withdraw consent at any time.
- Port your data to another service.
How to exercise your rights: Email your request to elijahderyaw (at) gmail (dot) com. We respond within 30 days.
If you reside in the EU/EEA/UK, you may also lodge a complaint with your local supervisory authority. California residents may request information about categories of data disclosed for "business purposes" under the CCPA/CPRA.
7. Security
We employ industry‑standard safeguards, including:
- TLS/HTTPS encryption in transit.
- Encryption at rest for stored data.
- Supabase Row‑Level Security to isolate user records.
- Least‑privilege staff access and mandatory multi‑factor authentication.
- Continuous monitoring and regular vulnerability patching.
No Internet transmission is 100% secure; therefore, we cannot guarantee absolute security.
8. Cookies & Tracking Technologies
We currently use essential cookies only (for authentication and session management). We plan to introduce optional analytics cookies; at that time we will:
- Display a cookie‑consent banner and obtain opt‑in where required.
- Honor Global Privacy Control (GPC) signals to opt‑out of non‑essential tracking.
- Provide detailed cookie descriptions and lifespans in an updated Cookie Policy.
9. Children
The Service is intended for individuals 18 years and older. If we learn that someone under 18 has registered, we will promptly delete the account and refund any payments received.
10. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will email account holders at least 7 days in advance. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.
11. Contact Us
If you have questions or concerns about this Policy or our privacy practices, contact:
elijahderyaw (at) gmail (dot) com - Ontario, Canada
Last updated: 6 May 2025