Legal

Vibe Clip privacy policy

Last updated: October 20, 2026

1. Who we are

Vibe Clip ("we", "us") is the controller of the personal data described here.

Privacy questions and requests: support@vibeclip.io.

This policy covers the Vibe Clip website, our Discord bot and the emails we send. It applies to Creators (who fund campaigns) and Clippers (who post clips and get paid). It tells you what we keep, why we keep it, who else sees it, how long we keep it, and what you can ask us to do with it.

2. The short version

We keep what we need to run campaigns, check who owns which social account, count views, pay people correctly and stop fraud.
Money records are kept for as long as accounting, tax and anti-fraud rules require. Our product never deletes them on its own.
We do not sell personal data. We do not show ads. We use no analytics or tracking cookies. We send no marketing email.
Creators see a lot about the Clippers in their Discord server, including country and VPN result, but never a Clipper's email address. Section 5 lists exactly what.
You can download your data and close your account yourself: Settings → Your data on the website (/export-data in Discord downloads it too). Closing takes your password and a code we email you (section 8).

3. What we keep and why

Each part below says what we keep, where it comes from, why we need it, our legal basis, and how long we keep it. Section 5 says who else receives it. Section 7 lists every retention period in one place.

3.1 Account details

What: email address, password (stored only as an argon2 hash, never in readable form), first and last name, display name, role (Creator, Clipper or admin), country, whether your email is confirmed, whether the account is active, when it was created, and when you confirmed that you are 18 or over and accept the terms and this policy (and which version).
Signup code: while you confirm your email we keep a keyed hash of the 6-digit code, when it expires (10 minutes) and how many wrong guesses were made. All three are cleared once your email is confirmed.
Where from: you. Creators sign up on the website and choose their country. Clippers register through our Discord bot. Both confirm, at signup, that they are 18 or over and accept the terms and this policy; we record when, and ask again when the documents change. A Clipper's name is their Discord display name, and their country comes from the location check (3.8).
Why: to create and secure your account, sign you in, and contact you about your account and your money.
Legal basis: contract (we need it to provide the service you signed up for).
Note: an email address that was never confirmed can be claimed by someone else who confirms it. The unconfirmed account then loses the address.

3.2 Creator billing details

What: billing company name, postal address and tax ID (VAT, GST, EIN or similar). All optional.
Where from: you, under Settings.
Why: they are printed on your invoices, receipts and statements.
Legal basis: contract, and legal obligation (accounting and tax records).

3.3 Discord details

What: your Discord user ID, your Discord username, your display name, and which Creators' Discord servers you registered in. For Creators: the ID of the server you connected, and the category, channels and role our bot created there.
Where from: Discord, when you use our bot.
What we don't collect: the bot does not read messages in your server. It only receives what you send it directly: button taps, slash commands, and the forms you fill in (email, wallet address, clip links, codes).
Why: to identify you in Discord, show each Creator the Clippers who joined their server, and send you direct messages about your clips and payouts.
Legal basis: contract.

What: for each TikTok, Instagram or X account you add: the platform, the handle, the platform's ID for the account, its follower count, the one-time verification code, whether it is verified, and when.
How the check works: you put the code in your public bio, and we read your public profile to find it. We read the bio text to look for the code. We do not store the bio text.
Why: to prove you control the account before it can earn, so nobody can claim someone else's views. A verified handle can belong to only one Clipper.
Legal basis: contract, and legitimate interests (preventing fraud and impersonation).

3.5 Clips, views and reviews

What: the link to each clip you submit, the campaign and platform, a normalized ID of the post (to stop the same post earning twice), its status (pending, tracking, flagged or rejected), total views, qualified views, likes, comments and shares, earnings per clip, a time series of its view count, a fraud risk score from 0 to 100, whether the platform confirmed the poster matches your verified account, when it was last read, and how many reads failed.
Reviews: Creators approve, reject or flag clips, and we keep the outcome. When a Creator clears a flag we keep when, and the score they cleared.
Where from: you (the link), the platforms (public post data, read for us by the providers in section 5), and Creators (review decisions).
What we don't collect: we never download or store the video itself.
Why: to calculate what you earn, rank leaderboards, confirm the clip is yours, detect bought or botted views, and keep an audit trail behind every payout.
Legal basis: contract, and legitimate interests (preventing fraud and being able to show why a payout was made).
Section 4 explains the automated checks.

3.6 Bans and payout freezes

What: when a Creator removes you from their campaigns (a ban) or puts your earnings from their campaigns on hold (a freeze): which Creator, when, and the reason they gave. A freeze always has a reason, and our bot sends it to you. When the Creator lifts a ban or a freeze we keep the record, marked with when it was lifted.
Where from: the Creator.
Why: to block new submissions to that Creator's campaigns, or hold earnings from them, while a problem is sorted out.
Legal basis: legitimate interests (letting Creators protect their campaigns from fraud), and contract.

3.7 Campaigns and pause requests

What: for each campaign: title, brief and structured brief, banner image, platforms, rate, budget, prize tiers, rules, dates, status and totals. For pause requests: the reason you gave, and our decision with any note.
Public by design: once a campaign is live, its brief is a public page anyone with the link can open, and its banner image is publicly hosted.
Screened before it is stored: every banner image is checked by Amazon Rekognition, an automated image-moderation service (section 4). The image is sent for that check only and is not kept by it.
Why: to run the campaign and show it to Clippers.
Legal basis: contract.

3.8 Location and VPN check (Clippers)

When: after you register in Discord, the bot sends you a setup link. Opening it runs the check.
What we read: your IP address (from the connection), your device's time zone and your browser's language settings.
What we send out: your IP address goes to vpnapi.io, which tells us the country it belongs to and whether it is a VPN, proxy or Tor exit.
What we store: your best-guess country, how we got it (from the IP, or inferred from time zone and language when a VPN hides the IP), the country your IP pointed to, whether a VPN was detected, and when the check ran. We do not store your IP address, time zone or languages.
What it changes: nothing on its own. VPN use is recorded and shown to Creators and our team. It never blocks you.
Why: to spot duplicate accounts and view farms, and to meet tax and sanctions obligations that depend on where people are.
Legal basis: legitimate interests (fraud prevention), and legal obligation where tax or sanctions rules apply.

3.9 Wallets, deposits, payouts and the ledger

What:
- Your USDT (TRC-20) payout wallet address.
- Deposits (Creators): amount, status, the payment ID from our payment processor, the address and exact amount to pay, when the payment window closes, and how much has been credited.
- Withdrawals and cash-outs: amount, destination wallet, the processor's payout ID, status, and for Clipper cash-outs our team's review decision, note and time.
- The ledger: every movement of money between balances, escrow and fees, as double-entry records.
- Invoices, receipts and statements (Creators): number, line items, totals and the billing details printed on them.
What we never hold: the private keys to your wallet.
Public by nature: transfers to and from your wallet are recorded on the Tron blockchain. Anyone can see them there, permanently. Nobody, including us, can delete them.
Sanctions screening: we check your payout wallet, and the wallets a deposit was paid from, against the US Treasury's sanctions list (OFAC). We keep our own copy of the list, so your wallet address is not sent anywhere for the check. To see which wallets paid a deposit, we read the public Tron record through TronGrid. If a wallet is on the list, we freeze the account: payouts stop and sign-in is blocked while we do what the law requires.
Why: to pay you correctly, keep every balance accurate, keep the accounting and tax records we must keep, prevent money laundering and fraud, and settle disputes.
Legal basis: contract, legal obligation (bookkeeping and tax records), and legitimate interests (fraud and dispute handling).
Note: when you change your payout wallet we email you, so you know if someone else did it.

3.10 Emails and direct messages

Emails we send: your signup code, email confirmation links, password reset and set-password links, notices when your password or payout wallet changes, and (Creators) receipts, invoices and statements. No marketing email, ever. Because every email we send is about your account or your money, there is nothing to unsubscribe from.
Copies: we keep a copy of each receipt, invoice, statement and account notice we queue (recipient, subject, content, delivery status and attempts) so we can retry and resend it.
Discord messages: our bot sends you direct messages about your clips (for example why one was rejected), freezes, bans and cash-out decisions. Those messages are stored by Discord.
Legal basis: contract.

3.11 Security and technical data

Sign-in: your session is two signed tokens kept in cookies (section 9). We don't keep a server-side list of them. Changing your password ends every session.
Rate limits: to stop password guessing and abuse we count recent attempts by IP address, account or email address. These counts live only in server memory, for minutes, and are lost when the server restarts.
Logs: our servers log requests and errors. Log lines can include IP addresses, account IDs and email addresses. Errors are also posted to a private channel our team watches on Discord.
Why: to keep the service secure and running, and to investigate problems.
Legal basis: legitimate interests (security and reliability).

4. Automated checks

Some decisions are made by software, not by a person. Here is each one.

Fraud score. Every time we read a clip's numbers we score it from 0 to 100, mainly from how engagement (likes, comments, shares) compares with views, and whether the platform removed views. At 70 or above the clip is flagged: it stops earning until the Creator reviews it. Earnings already credited are not taken back automatically.
Wrong poster or unreadable post (Instagram). Before review, we check who the platform says posted the clip. If it isn't your verified account, or the post can't be read, the clip is rejected automatically and our bot tells you why. A clip rejected this way can be submitted again. On any platform, if a later read shows a different poster, that read doesn't count and the clip is flagged with the top score.
Old posts. A post made more than one day before the campaign went live is flagged, and earns nothing unless the Creator approves it. An Instagram clip not yet reviewed is rejected instead.
Unreachable posts. If a clip can't be read 10 times in a row (usually deleted or made private), it is flagged and stops being read.
TikTok and X links. The handle in the link must match your verified account, or the submission is refused.
Banner images. Every campaign banner a Creator uploads is checked by Amazon Rekognition before it is stored. Images it rates as explicit or suggestive nudity, violence, visually disturbing content, hate symbols or rude gestures are refused; the Creator sees only that the image can't be used. We keep the reason in our logs for up to 180 days. A refused image is never stored.

Clipper cash-outs are always reviewed by a person. The VPN result never blocks anything. If you think an automated decision is wrong, email support@vibeclip.io and a person will review it.

5. Who receives your data

Service providers

They process data for us, under our instructions.

Provider	What they receive	Why
Amazon Web Services	Everything we store (hosting and database), and campaign banner images, including a copy of each sent to Amazon Rekognition for the moderation check	Running the service and screening banners, in the United Kingdom (London); pages and files pass through its worldwide CloudFront network on the way to you
NOWPayments	Deposit amounts and a reference containing the Creator's account ID; payout wallet addresses and amounts	Taking deposits and sending payouts
TronGrid and the Tron network	Wallet addresses and amounts, if we send from our own Tron wallet instead of NOWPayments; the address a deposit was paid to	Sending payouts; seeing which wallets paid a deposit, for sanctions screening
vpnapi.io	Your IP address, during the location check	Country and VPN detection
Apify	Social handles and clip links	Reading public profiles and post numbers
twitterapi.io	X post links	Reading post numbers on X
HikerAPI	Instagram post links	Reading post numbers and the poster on Instagram
TikTok, Instagram and X	The handle or link we look up	We read some public profiles from the platform directly
Resend	Your email address and the email content	Delivering our emails
Discord	Everything you do with our bot	The bot runs on Discord, under Discord's own privacy policy
Discord (our team's alert channel)	Error messages, which can include an account ID or email address	Alerting our team to problems

Creators

A Creator sees the following about every Clipper who registered in their Discord server, even before that Clipper submits a clip:

name, and Discord user ID and username (never the Clipper's email address);
country, how it was determined, the country of the IP address, and whether a VPN was detected;
verified and pending social accounts, with follower counts and profile links;
clips submitted to their campaigns, with views, likes, comments, shares, fraud score and earnings;
whether they have banned the Clipper or frozen their payouts;
cash-out requests that draw on money earned from their campaigns (amount and status);
whether the Clipper has a payout wallet set. Never the address itself.

Creators use this to review clips and protect their campaigns.

Clippers

Clippers see campaign details and the public brief. They don't see a Creator's email, billing details or balances.

Our team

Our admins see account, clip and payout details to review cash-outs and pause requests, and to investigate fraud.

Others

We disclose data when the law requires it. If Vibe Clip is merged or sold, your data moves with it and we will tell you first.

6. International transfers

We host in the United Kingdom (Amazon Web Services, London), and pages reach you through Amazon CloudFront, which serves them from the location nearest you. Several providers above are in the United States or elsewhere, so your data may be processed outside your country.

7. How long we keep it

A cleanup runs once a day and applies every period below that has a number.

Data	How long
Account details (3.1)	While your account exists. Closing it removes your email, name, display name, password, Discord link, wallet address, billing details, country and location result at once (section 8). The anonymised account record stays as long as the money records linked to it (3.9)
Signup code data	Until your email is confirmed or a new code replaces it (each code works for 10 minutes)
Billing details (3.2)	As long as the invoices they appear on
Discord details (3.3)	While your account exists; removed when you close it. A server link and its member list are kept for 90 days after the bot is removed, so reconnecting restores them, then deleted
Social accounts (3.4)	While your account exists. When you close it, the handles, platform IDs and codes are replaced with placeholders at once; a row still linked to a clip stays, anonymised, with the clip, and the rest are deleted by the daily cleanup
Clips, views, scores and reviews (3.5)	As long as the money records they back (3.9). A clip's view-count time series is deleted 180 days after its campaign ends; the clip's final totals stay
Bans and freezes (3.6)	Kept after the Creator lifts them, marked as lifted, with the clip and payout records they explain
Campaigns and pause requests (3.7)	As long as the money records they back (3.9). Drafts you delete are gone at once
Location and VPN result (3.8)	Your country: while your account exists. The IP country, the VPN result and how we determined your country: 365 days after the check (replaced if you run it again), unless you still have money on your balance or a withdrawal in flight, in which case until you don't. All of it is removed at once when you close your account
Wallets, deposits, payouts, ledger, invoices (3.9)	As long as accounting and tax laws require. The product never deletes them on its own
Email copies (3.10)	365 days. Account notices queued to your address are deleted when you close your account; receipt and invoice copies stay with the invoice
Rate-limit counts (3.11)	Minutes, in memory only
Server logs (3.11)	Up to 180 days (load-balancer access logs: 90 days)
Sign-in cookies (section 9)	29 minutes and 30 days
Blockchain transfers	Permanent, and outside anyone's control

8. Your rights

Depending on where you live (for example under the EU or UK GDPR), you have the rights below.

Right	What it means	How to use it
Access	Get a copy of your data	Download it yourself: Settings → Your data → Download my data on the website, or `/export-data` in Discord (the bot sends you the file by DM). Invoices are also available as PDF under Billing. Or email us
Rectification	Fix wrong data	Change your name, display name, country and billing details in Settings, and your wallet in the app or with `/wallet` in Discord. Your Discord username updates when you tap Register. To change your email address, email us
Erasure	Have your data deleted	Close your account yourself: Settings → Your data → Close account on the website (`/delete-account` in Discord points there). It asks for your password and a code we email you. If money is left on your balance, it first sends it to the wallet you choose, confirmed by a code of its own. It works once your balance is zero, no withdrawal is in flight and, for Creators, no campaign is live or paused. We remove your email, name, display name, password, billing details, Discord link, social handles, wallet address and location result at once, and anonymize what must stay: the money records we are legally required to keep (3.9) and the clip records behind payouts, with no name on them. Blockchain transfers can't be deleted by anyone. For anything else, email us
Restriction	Have us pause using your data	Email us
Objection	Object to what we do on legitimate interests, including fraud checks	Email us. We stop unless we have compelling reasons, such as preventing fraud, or need the data for a legal claim
Portability	Get the data you gave us in a machine-readable file	The download above is JSON
Human review	Have a person review an automated decision (section 4)	Email support@vibeclip.io
Complaint	Complain to a data protection authority	Contact the authority where you live or work, for example the ICO in the UK or your national authority in the EU.

Email support@vibeclip.io for any of these. We answer within one month. We may ask you to confirm the request from your account's email address or Discord account, so nobody else can ask for your data.

We don't rely on consent for anything in this policy, so there is no consent to withdraw. If that changes we will ask first.

9. Cookies

We use three cookies. None of them track you or are shared with anyone.

Cookie	What it does	How long
`vc_access`	Keeps you signed in (sign-in token, not readable by page scripts)	29 minutes
`vc_refresh`	Renews your sign-in without asking for your password (not readable by page scripts)	30 days
`sidebar_state`	Remembers whether you opened or closed the console sidebar. Set only when you toggle it	7 days

All three are needed for features you use, so we don't ask for consent. We use no analytics, advertising or tracking cookies, and we load no third-party scripts. Our fonts are served from our own site. Discord and NOWPayments pages we link to set their own cookies under their own policies.

10. Security

Passwords are hashed with argon2. Sign-in tokens live in cookies that page scripts can't read, and a password change ends every session. Sign-in and cash-outs are rate limited. Every money movement is a balanced double-entry ledger record. Payouts through NOWPayments need a two-factor code. Access to production systems is limited to our team. No system is perfectly secure. Report vulnerabilities to support@vibeclip.io.

11. Children

Vibe Clip is not for anyone under 18. Every signup confirms being 18 or over (the box on the website form, the button before Register in Discord); we don't verify it otherwise. If we learn we hold data about someone under 18, we delete it, except money records we must keep by law.

12. Changes

When we change this policy in a way that matters, we tell you by email or on the site before the change takes effect, and we may ask you to confirm the new version the next time you sign in or use the bot. The date at the top shows the latest version.

13. Contact

Vibe Clip · support@vibeclip.io