This Privacy Policy explains how ClipAd, operated by Harpley Technologies, collects, uses, shares, and safeguards your personal data when you use our marketplace connecting African video creators with global brands.
1. Data we collect
We collect data you provide directly and data generated through your use of the platform. This includes:
- Account and profile data — name, email, password (stored as a salted hash, never in plain text), display name, country, platform handles, audience demographics, and bio.
- Content and campaign data — videos you upload, segments, demo reels, brand campaign assets and content, rates, campaigns, and applications.
- Connected social-media account data — see "Connected social-media accounts" below.
- Payout data — Mobile Money or bank details and identity verification information needed to pay creators.
- Usage and device data — log data, IP address, browser type, and interactions such as impression and approval events.
2. How we use your data
We use personal data to operate and improve ClipAd: to create and secure your account, match creators with brands, process video, run brand campaigns with creators, calculate and deliver payouts, provide support, prevent fraud and abuse, and comply with legal obligations. We may send you service-related communications and, where permitted, occasional product updates you can opt out of.
2a. Connected social-media accounts
ClipAd allows authorized creators to connect third-party social-media accounts — including YouTube, Facebook (Instagram), and TikTok — in order to publish video content on their behalf and to measure the audience reach of that content. Connecting an account is always optional and is initiated by you.
- What we obtain. When you connect an account, the provider (Google/YouTube, Meta/Facebook & Instagram, or TikTok) grants us an access token scoped to specific permissions you approve during that provider's consent screen — for example, permission to read your channel/account's basic profile and audience-analytics data (views, followers, watch time, demographics), and, only if you separately opt in to auto-publish, permission to upload video on your behalf. We do not request or receive your account password at any point — authentication happens entirely on the provider's own login page.
- Why we use it. Read access lets us calculate your view tier and show you and prospective brands your real audience reach. Upload access, granted only when you explicitly enable auto-publish for a platform, lets us post a rendered ad-embedded clip directly to your own connected account so the resulting post is provably yours.
- How authentication works. We use each provider's standard OAuth 2.0 authorization-code flow. You are redirected to the provider's own site, you approve (or deny) the specific permissions requested, and the provider redirects back to ClipAd with a short-lived authorization code that our server exchanges for an access token and, where issued, a refresh token. We never see or store your provider password.
- Whether tokens are stored. Yes. Access and refresh tokens are encrypted at rest (AES-256-GCM) in our database and are decrypted only by a background server process at the moment a scheduled sync or a publish action runs — never by client-side code or in a page you can view. Tokens are never sold, rented, or used for any purpose outside operating ClipAd on your behalf.
- How you disconnect. You can disconnect any connected account at any time from Dashboard → Settings → Connected accounts. Disconnecting immediately revokes and deletes the stored token and stops any further reads or publishes to that account; it does not remove content already published before disconnection, and does not affect content or data unrelated to that provider. You can also revoke ClipAd's access directly from the provider's own account/security settings (e.g. Google Account → Security → Third-party access), which has the same effect.
- Sharing with third parties. Platform data obtained through a connected account is used only to operate ClipAd's own features (audience metrics, auto-publish) for you and, in aggregate/summary form (e.g. your view tier), to the brand you are collaborating with. We do not sell this data, and we do not share your tokens or raw platform data with any third party other than the infrastructure processors listed in "Sharing and processors" below, who process it solely on our instructions to run the service.
- Retention. Tokens and the metrics derived from them are retained only while the connection remains active. If you disconnect a platform, or if a token is revoked or expires and is not renewed, we delete the stored token and purge the associated audience-insight data within 30 days.
3. Cookies and tracking
We use cookies and similar technologies for essential functions, analytics, and preferences. You can learn what we use and how to manage them in our Cookie Policy.
4. Sharing and processors
We do not sell your personal data. We share data only as needed to run the service: with the counterparty to a collaboration (for example, a brand sees the creator profile it is contracting with), and with trusted processors who act on our instructions. These include cloud hosting and database providers, object storage for video, payment and payout providers, and analytics tools. We may also disclose data where required by law or to protect rights and safety.
5. Payment data
Brand payment-card details are handled by our payment provider and are not stored on our servers. For payouts, we collect the minimum information required to verify identity and send funds in local currency, and we retain it as required by financial and tax regulations.
6. Data retention
We keep personal data for as long as your account is active and as needed to provide the service, then for any additional period required to meet legal, tax, accounting, or dispute-resolution obligations. When data is no longer needed, we delete or anonymize it.
7. Security
We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and isolation of stored media. No system is perfectly secure, but we work to limit risk and to respond promptly to any incident.
8. Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. You can disconnect a connected social-media account at any time from Settings, and you can request deletion of your account and personal data at any time — see our Data Deletion page for how. We will respond within the timeframes required by applicable law.
9. International transfers and children
ClipAd operates across multiple markets, and your data may be processed in countries other than your own, including where our hosting and processors are located. Where we transfer data internationally, we use appropriate safeguards. ClipAd is not directed to children, and we do not knowingly collect data from anyone under 18; if you believe a minor has provided us data, please contact us so we can remove it.
10. Changes and contact
We may update this Privacy Policy from time to time and will revise the "Last updated" date above. For material changes, we will provide additional notice. To exercise your rights or ask a question, please reach out through our contact page.