Privacy Policy

This Privacy Policy explains how ClipVision, Ltd. (“ClipVision”, “we”, “us”, “our”), the company that operates the Inoue AI platform, processes personal data when you visit our websites, create an account, and use our AI generation, virtual-influencer, content-scheduling, social-publishing, creator-CRM and billing services (together, the “Services”). It also describes the rights you have over your personal data and how to exercise them.

This policy should be read together with our Cookie Policy, our Terms of Service and, for business customers, our Data Processing Addendum. Capitalised terms not defined here have the meaning given in the Terms of Service.

1. Who we are

ClipVision, Ltd. is the data controller responsible for your personal data processed through the Services. ClipVision is a Delaware (United States) C-corporation whose principal place of business and centre of activities is in Italy. Because our central administration is established in the European Union, our lead supervisory authority under the GDPR is the Italian Garante per la protezione dei dati personali (the “Garante”). As an EU-established controller, we are not required to appoint a representative under Article 27 of the GDPR.

We have not appointed a statutory Data Protection Officer, as we are not required to under Article 37 of the GDPR. You may direct all privacy enquiries to [email protected].

2. Scope of this policy

This policy applies to personal data we process about: visitors to our public websites; individuals who register for and use an Inoue AI account (“users”); members of organisations and workspaces that subscribe to the Services; and individuals who contact us for support or other enquiries. It covers both consumer (self-serve) and business use of the Services.

Where an Inoue AI customer uses the Services to process the personal data of third parties — for example, when a creator connects a Fanvue account and exchanges direct messages with their fans through our CRM features — the customer is the controller of that third-party data and we act as their processor. Our processing of that data is governed by our agreement with the customer (including our Data Processing Addendum), and this policy describes it only at a high level (see section 10).

Our Services are not designed for, and we do not knowingly process, the personal data of children (see section 11). The Services may link to third-party websites and platforms (for example the social networks you connect); their processing is governed by their own privacy policies, not this one.

3. Personal data we collect

We collect personal data in three ways: data you provide to us directly, data we collect automatically when you use the Services, and data we receive from third parties (chiefly the platforms you choose to connect and our payment processor). The tables below group the categories of personal data by source.

3.1 Data you provide to us

3.2 Data we collect automatically

3.3 Data we receive from third parties

4. How we use personal data

We use personal data only for the purposes set out below. Each purpose is matched to a lawful basis in section 5.

• Provide and operate the Services — create and authenticate your account, run AI image, video, voice, transcription and caption generation, manage virtual-influencer models, schedule and publish content, and deliver the results to you.
• Process payments and manage credits — handle subscriptions, one-off credit bundles, usage metering, refunds and credit reversals, and meet our tax and accounting obligations.
• Connect and operate third-party integrations — connect the social and creator platforms you authorise, publish on your behalf, retrieve analytics on your own accounts, and power creator-CRM messaging.
• Communicate with you — send transactional and service emails (email verification, password resets, security and billing notices) and respond to your support requests. These are not marketing emails.
• Keep the Services secure and reliable — authenticate sessions, rate-limit and detect abuse and fraud, maintain audit logs, monitor errors and performance, and protect the integrity of the platform.
• Comply with the law and enforce our terms — meet legal, regulatory and tax obligations, respond to lawful requests, and enforce our Terms of Service and Acceptable Use Policy.

5. Legal bases for processing (GDPR Article 6)

Where the GDPR applies, we rely on the following lawful bases for each processing purpose. Where we rely on our legitimate interests, we have balanced those interests against your rights and freedoms and will provide details of that assessment on request.

Today, no processing relies on consent under Article 6(1)(a), because we operate no marketing, advertising or analytics technologies. Should we introduce any in future, we will ask for your consent first and update this policy.

6. How we disclose data — recipients and sub-processors

We do not sell your personal data. We disclose it only to the categories of recipients below, each acting as our processor under contract, or where disclosure is required by law. We engage the following principal sub-processors to deliver specific parts of the Services.

We also rely on infrastructure providers that host our database, cache, message queue and supporting services on our behalf; these are operated as sub-processors and do not act as independent controllers. Business customers can obtain our current, maintained sub-processor list and notice of changes under our Data Processing Addendum. We may also disclose personal data to professional advisers, to authorities where legally required, and to an acquirer in the context of a merger, acquisition or asset sale, subject to this policy.

7. International data transfers

Some of the sub-processors that power generation, voice, transcription, email delivery and error monitoring are located in the United States or process data globally. Where we transfer personal data outside the European Economic Area to a country without an adequacy decision, we put in place an appropriate safeguard — in practice, the European Commission’s Standard Contractual Clauses (SCCs), supplemented by technical and organisational measures — so that your data continues to receive an essentially equivalent level of protection. You may request a copy of the relevant safeguards by emailing [email protected].

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy, or for as long as the law requires. The default periods below apply unless a longer period is required (for example by tax law) or a shorter period is appropriate. When you delete content or close your account, we mark the relevant records as deleted and then reclaim the underlying media on the schedule below.

9. Your rights and choices

Subject to the conditions and exceptions in applicable law, you have the following rights over your personal data:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data where there is no overriding reason to keep it.
• Portability — receive the data you provided to us in a structured, commonly-used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Restriction — ask us to limit processing in certain circumstances.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent (for example for biometric/likeness data), withdraw it at any time, without affecting processing already carried out.

You can exercise many of these rights directly in your account settings (for example updating your profile, revoking sessions, or deleting your account), or by emailing [email protected]. We will respond within the timeframes required by law (under the GDPR, normally within one month). We do not charge a fee for a reasonable request, and we will not discriminate against you for exercising your rights.

10. Biometric, likeness and creator-CRM data

Inoue AI lets you create and train virtual-influencer “models” from images you upload, which may include faces, bodies and other identity media. Depending on how it is processed, this media may constitute special-category (biometric) personal data under Article 9 of the GDPR.

• Legal basis — we process face/likeness/identity media on the basis of your explicit consent under Article 9(2)(a) of the GDPR, given when you upload such media to build or train a model, in addition to the contractual basis in Article 6(1)(b).
• Your representations — you must hold all necessary rights and consents in any face or likeness you upload, including the consent of any identifiable person depicted. You must not upload another person’s likeness without their authorisation. See our Acceptable Use Policy.
• Retention and deletion — identity media is retained while your model and account are active and is deleted on the schedule in section 8 when you remove it or close your account. You may withdraw your consent at any time, after which we will stop the relevant processing and delete the associated media.

10.1 Creator-CRM messages (your fans’ data)

When you connect a creator platform such as Fanvue and use our CRM features, we process the direct messages and participant data you exchange with your fans. With respect to that third-party data, you are the controller and we act as your processor: you are responsible for providing any notice to, and obtaining any consent from, your fans, and for the lawfulness of that messaging. Our handling of that data is governed by our agreement with you, including our Data Processing Addendum.

11. Children

The Services are intended for adults and are not directed to children. We do not knowingly collect personal data from anyone under 16 in the EEA (or under the applicable digital-consent age in your country, which is not below 13), nor from anyone under 13 in the United States. If you believe a child has provided us with personal data, please contact [email protected] and we will take steps to delete it.

12. How we protect your data

We maintain technical and organisational measures appropriate to the risk, including: hashing of passwords with Argon2id; encryption at rest of sensitive secrets such as two-factor secrets and connected-account tokens; encryption in transit (TLS); strict access controls and least-privilege access; row-level access controls in our database; rate-limiting and abuse detection; audit logging; and error and security monitoring. No method of transmission or storage is completely secure, but we work to protect your data and to detect, contain and notify you of any personal-data breach as required by law.

13. Cookies and similar technologies

We use only strictly-necessary, first-party cookies — for authentication, session refresh and CSRF/PKCE protection of the social-connection flows. We do not use advertising, analytics or third-party tracking technologies. For the full list of cookies, their purposes and lifespans, and how to manage your choices, see our Cookie Policy.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our Services, our processors, or the law. When we make material changes, we will update the effective date and version shown at the top of this policy and, where appropriate, notify you by email or in-product. We encourage you to review this policy periodically.

15. Contact us

If you have any questions about this policy or how we handle your personal data, or if you wish to exercise your rights, please contact us:

16. Regional supplements

16.1 European Economic Area and United Kingdom

If you are in the EEA or the UK, the GDPR (and the UK GDPR) governs our processing. Our lead supervisory authority is the Italian Garante; you may also contact your local authority. The lawful bases, rights, retention periods and transfer safeguards described above apply to you.

16.2 United States — California (CCPA/CPRA) and other state laws

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how we use and disclose it, to access and delete it, to correct it, and to opt out of any “sale” or “sharing” of personal information and of certain profiling.

We honour the Global Privacy Control (GPC) browser signal as a valid opt-out request. You may exercise your California rights, including “Your Privacy Choices”, by emailing [email protected]; we will verify your request and will not discriminate against you for exercising your rights. You may use an authorised agent to submit a request on your behalf. Residents of other U.S. states with comprehensive privacy laws have comparable rights, which we extend to them where those laws apply.

16.3 Australia (Privacy Act and Australian Privacy Principles)

If you are in Australia, we handle your personal information in accordance with the Australian Privacy Principles. You may request access to, or correction of, your personal information by emailing [email protected]. If you are not satisfied with how we have handled a privacy matter, you may complain to us first and then, if unresolved, to the Office of the Australian Information Commissioner (OAIC).