Clipz Agency Dashboard by Creatinsta
How we collect, use, and protect your data
Effective: October 15, 2026
Creatinsta Kereskedelmi es Szolgaltato Korlátolt Felelossegu Tarsasag
Registered address: 8130 Enying, Erkel Ferenc utca 1/A, Hungary
Tax number: 14145757-2-07
Email: hello@clipz.hu
Website: https://app.clipz.hu (app: https://dashboard.clipz.hu)
Creatinsta Kft. ("Creatinsta", "we", "us", or "our") operates Clipz Agency Dashboard (the "Dashboard", also referred to as "Agency Dashboard"), a software-as-a-service platform for advertising performance management. We are the data controller for personal data processed through the Dashboard as described in this Privacy Policy.
Where we act as a data processor on behalf of our client companies (advertisers), the respective client company is the data controller for the end-consumer data they bring into the platform. Creatinsta processes such data only under documented instructions from the client and in accordance with applicable data processing agreements.
This Privacy Policy applies to all personal data processed in connection with:
This policy does not cover third-party websites or platforms to which the Dashboard may link. Please review those platforms' own privacy policies.
3.1 Account and User Data
When a user account is created, we collect:
3.2 OAuth Credentials and Tokens
To connect advertising and social accounts, we store OAuth tokens obtained through authorised OAuth flows with Meta, Google, and TikTok. Specifically:
Tokens are stored encrypted at rest in our database and are used exclusively to retrieve advertising performance and social analytics data on behalf of the agency.
3.3 Advertising and Analytics Performance Data
We retrieve and store aggregated daily performance metrics from connected platforms. This data relates to advertising campaigns and does not include individual end-consumer personal data. Metrics include:
3.4 Content Prepared for Publishing
3.5 Client and Ad Account Configuration
3.6 Access Request Enquiries
When you submit the access request form on app.clipz.hu, we collect the details you provide so that we can respond to your enquiry:
These details are used only to contact you about your enquiry and to prepare your workspace if you become a customer. We do not use them for unrelated marketing, and we do not sell or share them.
3.7 Usage and Technical Data
3.8 Meeting Notes (Google Meet recordings)
Clipz team members (agency staff and, where enabled, subcontractors) can use the "Clipz Meeting Notes" Chrome extension to take notes of Google Meet meetings. The extension's content script runs only on meet.google.com, and the only other site the extension communicates with is the Dashboard (dashboard.clipz.hu). It involves two kinds of processing:
We also process technical diagnostic events reported by the extension (for example, that a Meet page element could not be detected), and the pairing key that links the extension to the team member's Dashboard account (stored only as a hash and revocable by the user).
From the audio we produce: a transcript (text with speaker labels and timestamps), a summary of the meeting, suggested follow-up tasks and reminders (each backed by a quotation from the transcript), and proposed client-specific business facts for the client's knowledge base. Suggested tasks and reminders are created only after a participating Clipz team member approves them in the Dashboard, and proposed client facts are used only after a team member approves them. Business facts approved from a meeting become part of the client's knowledge base and follow the client-data retention rules: they are not deleted together with the meeting. Approved reminders are delivered to the team through Slack (the client's Slack channel, where one is configured, and direct messages to the participating team members) and in the Dashboard.
The audio is stored in a private, non-public storage bucket only until it has been transcribed. For transcription, a transient copy of the audio is processed on our internal processing computer and sent to ElevenLabs; the copy on our processing computer is deleted when processing ends. If the connection to the Dashboard is interrupted, audio segments wait in the extension's local browser storage on the team member's computer until they can be uploaded. Meeting notes are visible to the team members who attended the meeting and to the core agency team; subcontractors see only the meetings they attended. Client users have no access to meeting notes. Participants are informed verbally before a recording starts.
If you took part in a meeting with Clipz and would like to know whether it was recorded or logged, or would like your data deleted or to object to the processing, contact us at hello@clipz.hu (see section 11).
We process personal data only where we have a valid legal basis under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Hungarian Privacy Act (Infotv.). The following table summarises our processing activities and their legal bases:
| Processing Activity | Legal Basis (GDPR Art.) |
|---|---|
| Responding to an access request enquiry | Steps prior to entering into a contract — Art. 6(1)(b) |
| Creating and managing user accounts | Contract performance — Art. 6(1)(b) |
| Storing and using OAuth tokens to sync ad data | Contract performance — Art. 6(1)(b) |
| Storing WooCommerce API credentials | Contract performance — Art. 6(1)(b) |
| Displaying performance dashboards to agency and client users | Contract performance — Art. 6(1)(b) |
| Sending transactional emails (password reset, sync alerts) | Contract performance — Art. 6(1)(b) |
| Retaining sync logs for troubleshooting | Legitimate interests — Art. 6(1)(f) |
| Security logging and fraud prevention | Legitimate interests — Art. 6(1)(f) |
| Recording and transcribing business meetings started by a team member (participants are informed verbally beforehand), and logging meeting presence (title, Meet code, participant names, attendance) so that recordings can be joined | Legitimate interests — Art. 6(1)(f) |
| Compliance with legal obligations (tax, accounting) | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, we have assessed that our interests do not override the rights and freedoms of data subjects.
We use collected data solely for the following purposes:
We do not sell, rent, or trade personal data to third parties. We do not use personal data for automated profiling or decision-making that produces significant legal effects on individuals.
We engage the following sub-processors to deliver the Dashboard. Each processor has been assessed for adequate data protection standards:
| Processor | Role | Location | Basis for Transfer |
|---|---|---|---|
| Supabase Inc. | Database hosting, authentication (PostgreSQL + Auth), private file storage (meeting audio, until transcribed) | EU (Ireland, AWS eu-west-1) | Adequacy / SCCs |
| Vercel Inc. | Application hosting, serverless functions, edge network | USA (primarily) + global CDN | SCCs / Data Processing Addendum |
| Meta Platforms Ireland | Ad data and social analytics API (Facebook, Instagram) | Ireland (EU) | Adequacy (EU entity) |
| Google Ireland Limited | Google Ads and Google Analytics 4 API | Ireland (EU) | Adequacy (EU entity) |
| TikTok Technology Limited | TikTok Ads and TikTok Open Platform API | Ireland (EU) / Singapore | SCCs |
| WooCommerce (Automattic) | E-commerce order and revenue data (client-hosted stores) | USA | SCCs / Data Processing Addendum |
| ElevenLabs | Speech-to-text transcription of meeting audio | USA (and EU where available) | SCCs / Data Processing Addendum |
| Anthropic | AI analysis and summarisation of meeting transcripts (text only; the audio is not sent to Anthropic) | USA (and EU where available) | SCCs / Data Processing Addendum |
| Slack Technologies | Delivery of approved meeting reminders and notifications to the team | USA (and EU where available) | SCCs / Data Processing Addendum |
Data shared with these processors is limited to what is strictly necessary for the stated purpose. We do not authorise processors to use the data for their own purposes.
Note on platform APIs: When we retrieve data from Meta, Google, or TikTok, we act under the authorisation granted by the agency via OAuth. The agency is responsible for ensuring it has appropriate permissions and legal basis to allow Creatinsta to access the data through those APIs.
Our primary database is hosted in the EU (Supabase on AWS Ireland, eu-west-1). However, certain sub-processors (Vercel, TikTok, WooCommerce/Automattic, ElevenLabs, Anthropic, Slack) may process data in the United States or other countries outside the European Economic Area (EEA).
For transfers outside the EEA, we rely on one or more of the following safeguards:
You may request a copy of the transfer mechanisms in place by contacting us at hello@clipz.hu.
| Data Category | Retention Period |
|---|---|
| User account data | Until account deletion, then 30 days for recovery period |
| OAuth tokens | Until the connected account is disconnected or the credential is revoked |
| Daily ad performance metrics | 3 years from the date of the metric |
| Social daily metrics (reach, impressions, followers) | 3 years from the date of the metric |
| Social post data | Refreshed on each sync; latest snapshot retained until connection is removed |
| Access request enquiries | 24 months from the last contact, then deleted |
| Sync logs | 90 days |
| WooCommerce order data (aggregated daily) | 3 years from the date of the metric |
| Meeting audio | Deleted immediately after successful transcription, and in any case within 7 days. The transient working copy on our internal processing computer is deleted when processing ends |
| Meeting transcripts, summaries and suggested items | For the duration of the client relationship; deleted within 30 days of the client being deleted, or earlier on request / when a participant deletes the meeting. Meetings not linked to a client (internal meetings, prospects) are kept until a participant or an administrator deletes them, or until you ask us to. Business facts approved from a meeting are part of the client's knowledge base and follow the client-data retention rules; they are not deleted with the meeting |
| Meeting records with no recording (metadata only) | Deleted after 6 hours of inactivity |
| Meeting extension diagnostic events | 90 days |
| Meeting extension pairing keys (stored as hashes) | Until revoked by the user or an administrator |
| Billing and contractual records | 8 years (Hungarian accounting law requirement) |
When a client account is deleted, all associated ad accounts, social connections, daily metrics, and OAuth credentials are deleted within 30 days. User accounts may be retained in anonymised form for statistical purposes.
The Dashboard uses a minimal set of cookies required for operation:
| Cookie Name | Purpose | Type | Duration |
|---|---|---|---|
sb-*-auth-token |
Supabase session authentication | Strictly necessary | Session / up to 7 days |
sb-*-auth-token-code-verifier |
PKCE OAuth state verification | Strictly necessary | Session |
We do not use tracking cookies, advertising cookies, or third-party analytics cookies on the Dashboard. No cookie consent banner is displayed because no non-essential cookies are set.
The public-facing website at dashboard.clipz.hu may use cookies independently — please refer to the cookie settings on that site.
We implement the following technical and organisational measures to protect personal data:
Despite our security measures, no system is completely immune to breaches. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Art. 33 and 34.
If you are an individual whose personal data we process, you have the following rights under GDPR:
| Right | Description |
|---|---|
| Right of Access (Art. 15) | Request a copy of the personal data we hold about you and information about how it is processed. |
| Right to Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data. |
| Right to Erasure (Art. 17) | Request deletion of your personal data where there is no compelling reason for its continued processing. |
| Right to Restriction (Art. 18) | Request that we restrict the processing of your data under certain circumstances. |
| Right to Data Portability (Art. 20) | Receive your personal data in a structured, machine-readable format and transmit it to another controller. |
| Right to Object (Art. 21) | Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds. |
| Right to Withdraw Consent (Art. 7) | Where processing is based on consent, withdraw consent at any time without affecting prior processing. |
| Right Not to Be Subject to Automated Decisions (Art. 22) | Not to be subject to decisions based solely on automated processing that produce significant legal effects. We do not engage in such processing. |
To exercise any of these rights, contact us at hello@clipz.hu. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are a client user (not an agency user), some of these rights may need to be exercised through the agency that manages your account, as the agency may be the data controller for your data within the platform.
If you took part in a meeting that a Clipz team member recorded or logged with the Meeting Notes extension, you can ask us at the same address to confirm whether the meeting was recorded or logged, to give you access to the transcript, or to delete it. Where the meeting was held with a client, we may need to coordinate the request with that client.
The Dashboard is a professional B2B tool intended solely for business users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that a minor has provided us with personal data, we will delete it promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. When we make material changes, we will:
Continued use of the Dashboard after the effective date constitutes acceptance of the updated policy.
For any questions, requests, or concerns relating to this Privacy Policy or our data processing activities, please contact us:
Creatinsta Kft.
8130 Enying, Erkel Ferenc utca 1/A, Hungary
Email: hello@clipz.hu
Website: https://dashboard.clipz.hu
If you are not satisfied with our response, you have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu
If you are located in another EU/EEA member state, you may also contact your local data protection authority.