Privacy policy
Last updated 24 September 2026
This policy explains what personal data Clipless collects, why, who else handles it, and how to have it corrected or deleted. In short: we collect what we need to run the service and to follow up with people who asked us to. We do not sell personal data, we do not use it for advertising, and the site sets no tracking cookies.
Who we are
Clipless is run by {{COMPANY}}, the controller of the personal data described here.
{{COMPANY}}
{{ADDRESS}}, Croatia
OIB {{OIB}} · registered at the {{COURT}} under MBS {{MBS}}
Email: [email protected]
What we collect, and why
When you ask for a trial in the playground
Your name, work email address, company (if you give one), the description of the process you want designed, your IP address, and when the link was sent and opened. We use them to email you the link, to design the workflow you described, and to follow up with you about Clipless. The legal basis is taking the steps you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in following up with people who approached us (Art. 6(1)(f)). You can ask us to stop at any time.
When you use the engine as a customer
The details of your workspace and the people we are in touch with there, your API keys (we store only a hash of each key) and when they were last used. We use them to provide the service and to bill for it (Art. 6(1)(b)).
The answers, files and documents that flow through your workflows are your data, not ours. For those we act as a processor on your behalf, under your instructions; your own privacy policy covers the people who fill in your workflows. A data processing agreement is available on request.
When you email us
Your address and what you write, to answer you (Art. 6(1)(f)).
Running the service safely
- Rate limits count requests per IP address in windows of a minute to an hour; the counters are deleted within about an hour after their window ends.
- Server logs record requests (IP address, path, status) and are kept for a limited time by our hosting provider.
- Error reports record what went wrong in our code (a stack trace, the route and the time). They are sent without request bodies, headers, cookies or form answers.
The legal basis is our legitimate interest in keeping the service secure and working (Art. 6(1)(f)).
The website
The site sets no cookies and runs no analytics. The playground keeps the process you typed in your browser's local storage, so it is still there when you continue; it never leaves your device until you submit the form.
Who else handles it
We use these providers to run Clipless. Each processes data only to provide its service to us.
| Provider | What for | What they receive |
|---|---|---|
| Railway | Hosting and the database | Everything the service stores |
| Cloudflare | Network and protection from attacks | Requests to the site and the engine, including IP addresses |
| Resend | Sending email | Recipient address and the email |
| Anthropic | Designing the playground workflow | The process description you typed (not your name or email) |
| Sentry (EU) | Error reports | Stack traces and the failing route, as described above |
Some of these providers are based in the United States. Where personal data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
We do not sell or rent personal data and do not share it with anyone else, except where the law requires us to.
How long we keep it
Trial details and emails are kept until you ask us to delete them, or until we no longer need them to follow up with you. Customer account details are kept while the account is open and afterwards for as long as accounting and tax law requires. Rate-limit counters, logs and error reports are deleted automatically, as described above.
Your rights
You may ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Email [email protected]; we answer within one month. If you think we have handled your data unlawfully, you may complain to the Croatian data protection authority, the Agencija za zaštitu osobnih podataka (azop.hr), or to the authority where you live.
Children
Clipless is a service for businesses and is not meant for anyone under 16.
Changes
If we change this policy, we will update the date at the top, and tell customers by email before a change that affects them takes effect.