ClapGen
Privacy Policy
How ClapGen handles accounts, creative content, AI processing, subscriptions and your privacy rights.
Who is responsible
ClapGen is operated by Deniz Sonu EI, an individual entrepreneur in France, SIREN 103 349 155. The business address is 8 RUE Sabran de Pontevès, 93240 Stains, France. Deniz Sonu EI is responsible for the personal data processed to operate ClapGen.
For privacy questions or to exercise your rights, email [email protected]. You can also write to the business address or call +33 7 80 75 05 25.
Information we process
Account information includes your email address, account identifier, sign-in and session information, and recorded account confirmations such as acceptance of terms. If you choose Google sign-in, the authentication service receives the identity information needed to create or access your account.
Passwords submitted through the ClapGen sign-in service are passed to Supabase for authentication. They are not stored in ClapGen’s business database. Session credentials are kept in protected cookies rather than browser local storage.
Creative content includes the prompts, reference images, video, audio and URLs you submit; file names and technical media details; generated results; and the request history, preparation plans and status information needed to run and display your work. This content can include information about you or other people.
When you use subscriptions, we process the selected plan, EUR amount, recurring-payment confirmation, order and transaction references, payment status, paid periods, credit grants and cancellation requests. A withdrawal declaration also records the identified contract, your account email, the declaration, its receipt time and the acknowledgment.
Technical and support information includes network addresses, request times, browser or connection details, security and error information, and the messages or attachments you send us. Please do not send passwords, full card numbers or card security codes in a support message.
Why we use this information
We use account and creative information to provide the service you request: create and secure your account, process uploads and imports, analyze references, generate content, show results and maintain your history. The legal basis is taking steps at your request before a contract and performing our contract with you.
We use subscription and payment references to arrange the payment you authorize, verify its outcome, grant the corresponding credits, manage renewal or cancellation and answer billing questions. This processing supports performance of the subscription contract. Recording a recurring-payment authorization does not waive your consumer rights.
We keep the evidence needed to handle statutory withdrawal, complaints and applicable accounting or tax duties to comply with legal obligations. Where necessary to establish, exercise or defend claims, we also rely on our legitimate interest in keeping reliable contract and dispute records.
We use limited operational information to prevent unauthorized access or abuse, apply service limits, diagnose failures and maintain reliable infrastructure. Our legal basis is our legitimate interest in protecting users and operating a secure service, subject to your rights and interests.
Where a separate use requires your consent, we must ask for that consent and you may withdraw it. Accepting the Terms of Service is not blanket consent to unrelated tracking or other uses of your content.
Information needed to use the service
An account email and authentication information are needed for account access. The prompts or reference material required for your chosen operation are needed to perform that request. Required subscription information is needed to arrange and verify an authorized payment. If you do not provide information required for a feature, we cannot provide that feature.
You choose what creative content to submit. Only provide content and information about other people when you have the necessary rights and a lawful reason to share it. Consider whether a less sensitive reference can meet your needs.
Hosting, authentication and other recipients
The application uses Hetzner infrastructure for hosting and Cloudflare for the website’s network protection and private R2 media storage. The hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; telephone +49 (0)9831 505-0. Business records are stored in the application’s database, and backups support recovery.
Supabase provides authentication, account verification and password-recovery functions. Resend delivers account emails through the configured authentication email service. Google participates when you choose Google sign-in. Their processing concerns the relevant identity, email and authentication flow rather than every creative request.
Amux and ReAPI route relevant generation or analysis requests to upstream AI providers. The model and operation you choose determine which prompts, references and technical parameters need to be sent. Video enhancement can use Everypixel. A public URL you ask us to import is also requested from the website hosting that content.
Viva.com provides hosted payment entry and processing. Payment details are entered on Viva.com’s checkout. ClapGen does not collect or store full card numbers or card security codes; it receives the payment references and outcome needed to manage your subscription. Viva.com processes payment information under its applicable privacy terms and legal duties.
The operator and service providers receive information needed for their respective functions. Information may also be disclosed when required by law or needed to handle a lawful request or legal claim. A provider may have its own legal obligations for some records.
AI providers and copies of your content
ClapGen’s private media storage and account access controls do not make every copy held by an AI provider private. Amux documents publicly readable, unguessable URLs for generated artifacts and uploaded reference material. ReAPI also documents output files accessible to anyone holding their URLs. Do not share these addresses with anyone who should not see the content.
Providers can retain task information and files separately from the copy shown in your ClapGen account. Amux documents a default 30-day retention for asynchronous task content and up to 15 days for sampled failed-call data. ReAPI documents 30 days for generated files. These are supplier statements, not a promise that every upstream provider uses the same period.
Content sent through a gateway is also processed by the upstream provider used for the request. Its retention, permitted uses and processing location depend on that provider and the applicable service terms. We do not promise that every model or route has identical training or deletion rules.
Contact us if you need more information about the handling of a particular request.
International processing
Your information is not necessarily processed only in France or the European Economic Area. Our suppliers operate internationally; Amux states that its own services and storage are in the United States, and upstream AI providers determine their own processing locations.
The protections applying to a transfer depend on the supplier, its processing arrangements and the applicable law. Contact [email protected] for information about relevant processing locations, international-transfer safeguards and how to obtain information about those safeguards.
How long information remains available
Account records, saved creative content, uploads and generation history support your continuing account and access to previous work. They do not currently have a universal automatic inactivity-deletion timer. You can ask us to close the account or delete particular information; we assess and handle the request subject to applicable rights, legal obligations and the need to resolve claims.
The reference-analysis cache is valid for seven days. Expired entries are no longer used and are removed during later cache maintenance; expiry does not itself delete the original upload or generation history. Temporary upload authorizations expire after 15 minutes, and short-lived processing files are normally removed when processing finishes.
Billing, consent, cancellation and withdrawal records are kept to verify the contract, handle disputes and meet applicable legal recordkeeping duties. Canceling a renewal does not automatically erase those records. Information needed for a specific outstanding claim or legal duty may be retained separately for that purpose.
Operational logs and backups are retained for security, troubleshooting and recovery within their rotation or retention arrangements. Backups can contain an older copy after a change to the active system. Supplier copies follow separate retention arrangements. A request to hide an item from a screen is not necessarily a request to erase all stored copies.
For records without a fixed technical expiry, the retention criteria are whether the account or requested feature still needs the information, whether a deletion request applies, and whether a legal duty or unresolved claim justifies retaining it. Contact us for information about a particular category or record.
Optional Google Analytics
ClapGen offers optional audience measurement with Google Analytics on public information pages. It stays disabled until you accept. Use Analytics settings to accept, reject or change your choice with the same ease. No Google Analytics tag, analytics cookie or measurement request is activated before you accept, and refusing does not restrict access to the service.
After acceptance, Google Analytics can use pseudonymous browser and session cookies, including _ga and related _ga_ cookies, to measure visits to public pages. Google also receives the technical information needed for the browser request. The purpose is to understand visits to our public information and improve those pages, rather than to track account activity or build advertising profiles.
Measurement is limited to the homepage, Pricing, the public creation guides and their index, Terms, Privacy, Contact and the Legal Notice. It does not run on sign-in, account settings, Billing, private creative workspaces or API responses. The Google tag is also kept off any page whose current URL contains a query string or fragment. Account identifiers, prompts, uploads, payment references and full private URLs are not included in the events sent by this feature.
A referral may identify the origin of a recognized search or AI service, such as Google Search, Bing, DuckDuckGo, Yahoo Search, ChatGPT, Perplexity, Claude or Microsoft Copilot. Paths, search terms, query parameters, fragments and credentials are removed. Other referrals, including our own pages, are not supplied as referral URLs. Google Signals, advertising personalization and user-account identifiers are not enabled for this feature.
Your acceptance or rejection is saved in browser storage for six calendar months from your latest explicit choice. Visits alone do not extend that choice. Analytics cookies are restricted to this website, expire no later than the remaining choice period and are not renewed automatically on each visit. Browser restrictions can shorten their lifetime.
Use Analytics settings, or Manage analytics choices below when available, to change your decision. Selecting Reject analytics stops future measurement and removes this website’s readable Google Analytics cookies. It does not itself erase information already sent. You may contact us about the personal-data rights that apply to earlier processing.
Google Analytics is provided by Google. Google and its service providers may process information in the United States and other countries under the arrangements applicable to that service. Its privacy information explains Google’s processing. Analytics information is kept according to the property’s configured retention controls and the type of report; a user-level or event-level retention setting does not mean that all aggregate reports are deleted on the same schedule.
Security and automated processing
The service uses account-based access restrictions, protected session cookies, encrypted HTTPS connections and limited-duration media links. Payment credentials stay on the server, and logs are designed to exclude passwords, session cookies, authorization headers and sensitive URLs. These measures reduce risk but do not guarantee that every system or provider is free of security incidents.
Automated processing generates content, verifies authentication and payments, applies service limits and updates billing states. Contact us if you think an automatic account or billing result is wrong or you need human review. Do not rely on generated content as a verified decision about a person.
Your rights and how to contact us
Subject to the conditions of applicable law, you may request access to your personal data, correction, deletion, restriction or portability. You may object to processing based on legitimate interests and withdraw consent for processing based on consent. Withdrawal of consent does not affect earlier lawful processing. Legal duties and the rights of other people may limit a particular request.
Email [email protected] with your request and enough information to identify the account or data concerned. We may request proportionate information when needed to verify that the request concerns your data; an identity-document copy is not automatically required.
We respond without undue delay and normally within one month. If the complexity or number of requests permits an extension, we explain the reason within that first month; the extension can be up to two additional months. Requests are normally free, subject to the limited exceptions allowed by law.
You may complain to the French data-protection authority, CNIL, or to the competent supervisory authority where you live or work. Contacting us first does not remove that right.
Changes to this policy
We update this policy when our data handling or relevant requirements change and show the updated date here. Where required, we provide additional notice or obtain consent before a new use begins.