Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy governs and explains how we collect and process your personal information when you ("you" or "User") use our website, located at clipyard.ai ("Site"), services and products accessible through the Site ("Services"), and the associated web-based software provided by Clipyard ("Software"). The Site, the Services, and the Software are jointly referred to as the "Platform". If you are a purchaser of our Services, you are a "Customer". If you are authorized by a Customer to use our Services, or you are a Site visitor you are an "Authorized User".

We are Clipyard Limited, a company located at 3rd Floor 86-90 Paul Street, London, England, EC2A 4NE, United Kingdom, and we are the controller of your personal data processed in connection with this Privacy Policy. If you have any questions or concerns regarding your privacy, you can contact us at support@clipyard.ai. Our Data Protection Officer can be contacted at dpo@clipyard.ai.

A separate agreement may govern the provision, access and use of the Services ("Agreement"), including the processing of (a) any content or information that an Authorized User submits to the Services, such as text and scripts used to prompt Avatars to speak and perform, and image and audio files uploaded to the Services; and (b) any videos created by Authorized Users using the Services (collectively, "Customer Data"). Customer Data excludes the Services, any content that Clipyard makes generally available to Customers through the Services ("Clipyard Content") and Non-Clipyard Products. The Customer (e.g., your employer or another entity or person) that entered into the Agreement with Clipyard for the purchase of Services controls its instance of the Services and any associated Customer Data. If you have any questions about specific settings and privacy practices, please contact the Customer whose Service you use.

2. Identifying the Data Controller and Data Processor

Certain jurisdictions distinguish between a "controller" or "processor" of personal data. A controller is the decision-maker and exercises overall control over how and why personal data is collected and used. In general, the Customer is the controller of Customer Data. A processor acts on behalf of, and only on the instructions of, the relevant controller. In general, Clipyard is the processor of Customer Data and the controller of Other Information (which is described in the 'Personal data that we process' section below).

Clipyard is the controller of Other Information and a processor of Customer Data.

In addition to the definitions provided for in the Agreement, the following words and abbreviations have the meaning provided below:

• "personal data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• "processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of Clipyard.

3. Personal data that we process

Clipyard collects and receives the following information through the Platform and your other interactions with Clipyard.

Customer Data

Customers or Authorized Users submit Customer Data to Clipyard when they use the Platform.

Other Information

Clipyard also collects, generates and/or receives the following categories of personal data ("Other Information"):

• Contact information: When you contact us or otherwise communicate with us, we will process your name, email address, phone number, and any additional information which you may provide such as your title and employer.
• Financial data: When you purchase our Services, we will collect the following transaction information: payment card details if payment is done using a payment card, bank account details is payment is done using a wire transfer or ACH, details of the amounts paid or refunded, dates of payments and the services purchased.
• Account information: When you create an account on our services or Customer creates an account for you, we will process your email address, first and last name and depending on the log-in method, your password. You may also customize your user profile by adding a profile picture and changing the account settings.
• Usage information: During your interactions with the Platform, we will collect and process information about how Users use or interact with the Site and features and functionality of the Services and Software. For example, we will collect information about the most frequently visited pages, used functionalities, preferred voices and avatars, preferred voice performances and similar information relating to use and interaction, and performance and quality of the Platform.
• Technical data: As with most websites and technology services delivered over the internet, our servers automatically collect information when you access or use our Platform and record it in log files. This log data may include your internet protocol (IP) address, the address of the web page you visited before using the Platform, browser type and settings, the date and time the Platform was used, information about browser configuration and plugins, and your language preferences.
• Avatar submissions: During the process of creating an Avatar you will be asked to provide two different submissions: (i) a sample (either an image, a video, an audio or a combination) which will serve as a basis for the creation of an Avatar ("Sample") and (ii) an avatar creation acknowledgment and verification recording ("Verification Recording"). Sample is considered Customer Data and a separate agreement may govern its use and processing.
• Cookie information: We use a variety of cookies and similar technologies in our Websites and Services to help us collect Other Information.
• Other information you choose to provide: We also receive Other Information when submitted to our Platform or in other ways, such as responses or opinions you provide if you participate in a focus group, contest, activity or event, feedback you provide about our products or services, information you provide if you apply for a job with Clipyard.

Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information (collectively, "Information"). However, certain Information is collected automatically and, if some Information, such as Account information, is not provided, we may be unable to provide the Services.

4. Purposes and legal basis for the processing of personal data

Customer Data will be processed by Clipyard in accordance with Customer's instructions, including any applicable terms in the Agreement, and as required by applicable law. As explained above, in general, Clipyard is a processor of Customer Data and the Customer is the controller.

Clipyard uses Other Information to operate our Platform and business. More specifically, Clipyard uses Other Information for the following purposes and under the following legal bases:

Performing our contract with you

We process personal data as necessary to conclude and perform our contract with you or the Customer. The categories of personal data used and why and how they are processed are set out below:

Legitimate interests

We rely on our legitimate interests or the legitimate interests of a third party, where they are not outweighed by your interests or fundamental rights and freedoms.

Compliance with a legal obligation

We process personal data to comply with a legal obligation including, for example, to access, preserve, or disclose certain personal data if there is a valid legal request.

Consent

We process personal data as described below when you have given us your consent to do so, which we may ask through in-product experiences, to enable particular features or to enable device-based settings.

5. Avatar submissions and Biometric Data

Sample and Verification Recording by their very nature include unique information relating to the physical characteristics of a natural person, such as facial images and voice data. Avatar creation features require processing of the facial geometry and/or voiceprint from each of the Sample and Verification Recording. Certain steps in creating an Avatar involve the processing of data considered "biometric data", "biometric information", "biometric identifier", "sensitive personal data", or "special category of personal data" under applicable data protection laws in certain jurisdictions (including but not limited to the Illinois Biometric Privacy Act and GDPR). We will refer to this information throughout this Privacy Policy as "Biometric Data" for consistency.

Verification Recording will be processed for the purpose of matching the data from the Verification Recording with the data from the Sample in order to authenticate the avatar submission to prevent misuse and abuse of our technology. We will extract, compare and match certain data points from the provided submissions such as face geometry, voice properties or other measurements; in order to confirm the Verification Recording and the Sample are provided by the same person on whom the Avatar will be based on.

Specifically, your Biometric Data is processed for:

• Generating your own Avatar;
• Fine-tuning the AI model to enable it to generate new videos with your Avatar based on the Sample performing a user-provided input;
• Verifying your identity by comparing Biometric Data extracted from the Sample, to Biometric Data extracted from the Verification Recording;
• Evaluating the authenticity of the recordings, including detecting whether there is a genuine live human performance or signs of tampering;
• For security and fraud prevention.

We and our vendors will store and use the Biometric Data described above only until it is no longer needed for the achievement of the above listed purposes. For the creation of an Avatar, Biometric Data is stored and used as long as the Avatar is available on the Platform or as otherwise instructed by our Customer. For authenticating the Avatar submission, Biometric Data is stored and used only until we confirm the results of the samples comparison which usually occurs within few minutes of the submission.

We will not sell, lease, trade, or otherwise profit from Biometric Data and will not permit its vendor(s) to sell, lease, trade, or otherwise profit from the Biometric Data.

6. Security

We have implemented security procedures and measures to ensure appropriate protection of the personal data we process against any misuse, unauthorised access, disclosure, or modification. More detailed information about our security is available on the Security Practices page on our Site.

7. Children's privacy

Our Services are intended for a general audience and are not targeted at children under the age of 16 ("minors"). We do not knowingly collect or ask for information from minors and do not knowingly allow minors to use the Platform.

8. Sharing/Disclosure of personal data

The policies and practices for sharing and/or disclosure of Customer Data to third parties is determined by the Customer. Clipyard has no control over the Customer's or any other third parties' choice to share and/or disclose Customer Data. Clipyard may share and disclose Customer Data in accordance with a Customer's instructions, including any applicable terms in the Master Subscription Agreement and Data Processing Addendum.

In certain circumstances we may share and/or disclose the personal data described in this Privacy Policy.

• Our affiliated companies - we will share your information with our affiliated companies in order to facilitate company business and as part of our regular reporting activities.
• Our service providers - we will share your information with affiliated and unaffiliated service providers which assist us in carrying out the processing activities described in this Privacy Policy.
• Regulators, law enforcement, public or government authorities, or courts - we will share your information if and to the extent we are required or permitted to do so by law.
• Other entities as part of a business transfer - if Clipyard undertakes or is involved in any merger, acquisition, reorganisation, sale of assets, bankruptcy, or insolvency event.

9. International Data Transfers

We may transfer your personal data to recipients located outside of the United Kingdom ("UK") and European Economic Area ("EEA").

When we transfer your personal data outside of the UK or EEA, we ensure it benefits from an adequate level of data protection by relying on:

• Adequacy decisions. These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) which recognise that a country outside of the EEA offers an adequate level of data protection.
• Standard contractual clauses. The European Commission has approved contractual clauses under Article 46 GDPR that allow companies in the EEA to transfer data outside the EEA.

You may obtain a copy of these adequacy decisions or standard contractual clauses by contacting us at support@clipyard.ai.

10. Data retention

We retain Customer Data in accordance with a Customer's instructions, including any applicable terms in the Agreement and as required by applicable law. We may also retain Customer Data if required by applicable law.

For Other Information, we retain the personal data we collect where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

11. Your rights

You have the following rights under applicable data protection laws:

• Access: You have the right to know whether we process your personal data and, if we do, to access data we hold about you and certain information about how we use it and who we share it with.
• Portability: You have the right to receive a subset of the personal data you provide us if we process it on the legal bases of consent or performance of a contract with you, in a structured, commonly used and machine-readable format and a right to request that we transfer such personal data to another party.
• Correction: You have the right to require us to correct any personal data held about you that is inaccurate and have incomplete data completed.
• Erasure: You have the right to request that we erase the personal data held about you in the following circumstances: where you believe it is no longer necessary for us to hold the personal data; where we are processing it on the basis of your consent and you wish to withdraw your consent; where we are processing your data on the basis of our legitimate interest and you object to such processing; where you no longer wish us to use your data to send you marketing; or where you believe we are unlawfully processing your data.
• Restriction of Processing: You have the right to ask us to restrict how we process your personal data in certain circumstances.
• Objection: You have the right to object to our processing of your personal data where we are relying on our legitimate interests as the legal basis for processing.
• Marketing: You have the right to ask us not to process your personal data for marketing purposes.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. For example, we may refuse a request for erasure where the personal data is required for in connection with claims.

If you would like to exercise any of these rights, please email us at support@clipyard.ai. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

12. Complaints

We hope that we can resolve any query or concern you raise about our use of your information.

If you are not satisfied with our response to any complaint or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner's Office (ICO) using the following contact details: Website: https://ico.org.uk/concerns/ or telephone: 0303 123 1113.

13. Changes to this Privacy Policy

We may change this Privacy Policy from time to time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law.

By continuing to use our Platform or providing us with personal data after we have posted an updated Privacy Policy, or notified you by other means if applicable, you consent to the revised Privacy Policy and practices described in it.

14. Contact Information

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Clipyard Limited
3rd Floor 86-90 Paul Street
London, England, EC2A 4NE
United Kingdom

Email: support@clipyard.ai (for general inquiries)
Email: dpo@clipyard.ai (for data protection matters)
Website: https://clipyard.ai