Privacy Policy

Last updated: 2 November 2026

ClonifyLab is a service of DecodeIT OÜ (registry code 16593048, Tallinn, Estonia).

In short: we use your data to make, approve and post your videos. Your face and voice are cloned only after you record your consent, and only for your own videos. We store data in the EU by default, but some AI vendors we use are in the US, under the EU's Standard Contractual Clauses. We use no cookies on our website. You can ask us for a copy of your data, or to delete it, at any time.

1. Who we are

The controller of your personal data is DecodeIT OÜ, trading as ClonifyLab, Tallinn, Estonia, registry code 16593048, VAT number EE102552621.

Write to us at info@clonifylab.com, or send /support to our Telegram bot @ClonifyLabBot. We have not appointed a data protection officer; the same address reaches the person responsible for privacy.

2. What this policy covers

This policy covers our website (clonifylab.com), our web app (app.clonifylab.com, which is also our Telegram Mini App), our Telegram bot, the emails we send, and the people we work with: customers, business clients and their staff, presenters, prospects, and people who comment on our Instagram posts.

When we make videos for a business client, that business decides why and how its people's data is used (it is the controller), and we act for it under our Data Processing Agreement. Its own privacy notice applies then. We stay responsible ourselves for the consent records of presenters, for our clients' account and billing data, and for our security logs.

3. What we use, why, and on what legal basis

The legal bases are those of Regulation (EU) 2016/679 (GDPR): contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), consent (Art. 6(1)(a)) and, for face and voice clones, explicit consent (Art. 9(2)(a)).

3.1 Your account and sign-in

• Accounts with the same verified email address are joined. Your Telegram account is joined to your web account only when you press Link Telegram (and confirm in the bot) or add your email in the Mini App.
• We use your Google data only to sign you in and run your account. We read no other Google data, we don't use it for advertising, and we share it only with Supabase, which runs our sign-in. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• Legal basis: contract.

3.2 Your brands, topics and videos

• Brand details (we call them your brand's card): your business, what you offer, your audience, tone, topics, posting schedule, and the stories, facts and numbers you give us for your story bank. Please don't add other people's personal data without their permission.
• Topics and messages: what you type or say in a voice note. Voice notes are turned into text by ElevenLabs.
• What we make: scripts, voice tracks, pictures, music, the videos, their post texts, and the steps of each video.
• Approvals and posts: who approved each video and each post, when, and the fingerprint (hash) of the exact file and texts; where and when each post goes, its status and, later, its numbers (views, watch time, likes, shares) from Upload-Post.
• Ideas and memos: topic ideas and the monthly "what worked" memo, made from your card, your past topics and your posts' numbers.
• Legal basis: contract.

3.3 Your clone (face and voice)

• What we use: the 3–5-minute recording you make on our consent page (you can make one only while you have a paid plan); the consent sentence and random phrase you say at its start and their transcript; the short clips we cut from the recording; your voice model; and the videos made with them.
• Why: only to make the videos you ask for and approve, as our Likeness & Voice Licence says.
• Legal basis: your explicit consent (GDPR Art. 9(2)(a)), given by speaking the consent sentence, ticking the consent box and accepting the licence, together with our contract. You can withdraw it at any time (section 8).
• Checks: ElevenLabs Speech to Text turns the start of the recording into text, so we can check your phrase. To make a clone we ask no ID document and do no face matching. Only when we have a specific reason (for example a report that a clone shows someone else) do we ask the account to verify its identity with Stripe Identity: Stripe checks a photo of an ID document and a selfie and tells us the result. Legal basis: your explicit consent at the check (GDPR Art. 9(2)(a)); we keep only the result and its date.
• Consent evidence: we keep the consent part of the recording (about 20 seconds) and its transcript as proof of your consent (legal basis: our legitimate interest and legal obligation to show that every clone was made with consent, and GDPR Art. 9(2)(f) for legal claims).
• Clone mode is available only to people who live in the EU.

3.4 Your own videos, clips and screen recordings

• Takes for your own videos: the videos you film of yourself (or of your presenter) for us to edit. ElevenLabs Speech to Text turns the speech into text, and we delete ElevenLabs' copy as soon as the transcript is saved; the words we keep are checked by OpenAI's moderation and read by Claude (Anthropic) to cut the video and write its captions. When you upload a take, you confirm: “This is my own camera recording of me (or of our presenter, who agreed). Nobody else can be recognised in it, nobody in it is under 18, and it isn’t made or changed with AI.”
• Clips and screen recordings: short real clips of your place, your products, your team and you at work, and screen recordings of your app or website. When you add them, you confirm: “These are my or my business’s own recordings; everyone recognisable in them is 18 or over and agreed to appear.”
• We use this footage only for your videos.
• Legal basis: contract.

3.5 Style examples

For now, style examples are offered only on our business plans. You can show us up to 3 example videos you like, as public YouTube links. Google's Gemini API watches up to the first 3 minutes and writes notes about the format only: the type of hook, pacing, cuts, caption style and music mood. The notes never describe who appears, their looks, voice, name or brand. Example videos may show other people: we keep only the format notes. We send Google a link, never the file. Google may log the request and the video it reads for a limited time, to detect abuse and for disclosures the law requires, under its paid Gemini API terms. Gemini may process them outside the EU (section 5).

Legal basis: contract (for you) and our legitimate interest in giving you the format you asked for (for people shown in an example; we keep nothing about them).

3.6 Safety checks

Before anything is made or posted, OpenAI's moderation checks every topic, script, post text and AI-made picture; our own written rules, checked by Anthropic's Claude, read every topic, script and post text you edit. They block sexual or political content, public figures or other people's faces, fake testimonials, income or unsupported medical or financial claims, and promised views. Your own clips, takes and screen recordings aren't checked automatically (only the words kept from a take are): you confirm what they show when you upload them. See section 9 for how these automatic decisions work and how to ask a person to review one.

Legal basis: contract, our legitimate interest in keeping the service lawful and safe, and our legal obligations as a hosting service under Regulation (EU) 2022/2065 (Digital Services Act).

3.7 Payments and credits

• In Telegram you pay with Telegram Stars. Telegram handles the payment; we receive the payment ID, the amount and what you bought.
• In the browser you will pay by card through Stripe (once card payments open). Stripe processes your card; we never see or store card numbers. We receive the payment ID, the amount, your country and VAT details, and the status of your subscription.
• Credits: we keep a ledger of every credit you get, use or get back.
• Legal basis: contract; and our legal obligation to keep accounting records for 7 years (Estonian Accounting Act).

3.8 Preventing abuse of the free sample and the service

We give one free sample per person (per Telegram account and per confirmed email address), refuse disposable email domains for it, cap the number of free samples per day, and limit video requests per hour. After 3 blocked topics or scripts in one day, new requests wait until the next day. If our safety check blocks a video's script, or you cancel 20 videos in a month before we start on them, new requests wait until the next month. If a version in another language fails because its translation doesn't fit the video, you can try the same video and language once more that day, and after 3 failed versions in a month, new versions wait until the next month. The blocked, cancelled and failed videos still get their credits back, and support, cancelling and withdrawal keep working (our Terms, section 5.9). Legal basis: our legitimate interest in preventing abuse.

3.9 Where you came from

When you sign up through our website, the link carries the marketing source you arrived from (for example a "utm_source" in the address), and when you start our bot, its start parameter does the same. We save that source on your account, so we know which channels bring customers. Nothing is stored on your device for this. Legal basis: our legitimate interest in knowing which of our channels work.

3.10 Emails and messages

We send sign-in codes and service emails (for example "your video is ready") from updates.clonifylab.com through Resend, and service messages in Telegram. We don't send newsletters or advertising emails to customers. Legal basis: contract.

3.11 Support, reports and requests

When you write to us or report content, we use your message and contact details to answer, and keep the case record as long as section 6 says. Legal basis: contract, legitimate interest, and our legal obligations (Digital Services Act; GDPR requests).

3.12 Security and records of what happened

• Sign-in logs: your IP address and device details when you sign in are kept in Supabase's authentication logs for 7 days.
• Audit log: we record important actions (sign-ins, approvals, posts, downloads, changes to your card, payments and requests) with who did them and when, to keep your account safe and to prove what was approved.
• Legal basis: our legitimate interests in security and in proving approvals, and our legal obligations.

3.13 Visitors to our website

Our website sets no cookies and stores nothing on your device. It loads no third-party scripts and no advertising pixels. We count visits with Cloudflare Web Analytics, which is cookieless: it gives us totals such as page views, referring sites, countries and browser types, and does not build a profile of you. Cloudflare processes your IP address to deliver and protect the site. Legal basis: our legitimate interest in running and improving the website.

3.14 People who comment on our Instagram posts

When you comment on one of ClonifyLab's own Instagram posts with the keyword the post asks for, Upload-Post sends you one automatic private reply with the link you asked for. Upload-Post processes your username and comment only to send that reply; we keep only the number of replies sent, never your name, ID or comment. Legal basis: our legitimate interest in answering your request.

3.15 Businesses, prospects and demos

• Business contacts: names, roles and work contact details of people at businesses we work with or contact, from your messages or from public business sources (for example a company website). We contact businesses only at company or role addresses, say who we are in the first message, and stop when asked (we keep a do-not-contact list). Legal basis: our legitimate interest in offering our service to businesses.
• B2B approvers: names, Telegram IDs and work email addresses of the people a client lists as approvers. Legal basis: contract with the client.
• Sanctions screening: we check business clients and their owners against the EU's sanctions lists. Legal basis: legal obligation.
• Prospect demos: if you ask for a demo of yourself, you record a 1-minute selfie on our demo page that starts with a consent sentence and a random phrase, and tick "use this only for my demo". We make one short demo clone and video only for you, send it to you by a private link, and delete the footage, clone and demo after 30 days unless you sign. Legal basis: explicit consent (GDPR Art. 9(2)(a)).

4. Who receives your data

We use these service providers (processors). Each acts only on our instructions under a data processing agreement, and we keep copies of those agreements.

Others who receive data, as independent controllers under their own terms:

• Telegram, when you use our bot or Mini App or pay with Stars.
• Instagram, Facebook, YouTube and TikTok, when your approved videos are posted to the accounts you connected (Upload-Post holds the connection; we store none of your social media passwords or tokens).
• Authorities, courts and advisers (such as our accountant or lawyer), when the law requires it or to establish or defend legal claims.
• A successor company: we plan to move ClonifyLab to a new company of our own (ClonifyLab OÜ). Your account, consents and licences would pass to it, and we would tell you first.

We don't sell your data, and we don't share it with advertisers.

5. Transfers outside the EU

We store your data in the EU by default (Supabase in Ireland, Cloudflare R2 in the EU, our server in Germany, Google Cloud renders in the Netherlands). Not all data stays in the EU: Anthropic, OpenAI, ElevenLabs, fal, the Gemini API and Namecheap process data in the US, and other providers may access it from there for support. These transfers are protected by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where the provider is certified, the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards at info@clonifylab.com.

6. How long we keep your data

When a report, takedown, payment dispute, consent dispute or authority request is open, we pause the deletion of the data it concerns until it is closed, and then delete it within 30 days. Deleting files does not delete the records of approvals, posts, payments and our audit log, which we keep for the periods above.

7. Your rights

You have the right to:

• access your data and get a copy;
• correct data that is wrong;
• delete your data ("right to be forgotten");
• restrict how we use it;
• receive the data you gave us in a common, machine-readable format, and have it sent to another company ("portability");
• object to uses based on our legitimate interests, including the channel tracking in section 3.9;
• withdraw your consent at any time, for example to your clone (section 8); this doesn't affect what we did before;
• complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee); you can also complain in the EU country where you live or work.

To use a right, write to info@clonifylab.com or use /support in our bot. We answer within 30 days, and may ask you to confirm it's you first. Some data we must keep by law (for example payment records), and we'll tell you when that applies.

8. Withdrawing your clone consent

You can withdraw your consent to your clone at any time: in the app, in the bot, or by email. From that moment no new video is made with your face or voice, the downloads of videos made with your clone stop, and unfinished videos and posts not yet published that use it are cancelled. We delete your clone and every video made with it, at our providers too, within 30 days. Posts that are already public stay on your social accounts until you delete them there. We keep only the consent evidence described in section 6.

9. Automatic decisions

Our safety check (section 3.6) decides automatically whether a topic, script, text or picture can be used. When it blocks something, we tell you the reason in plain words, give your credit back and, where we can, suggest a safe version. These decisions have no legal effect on you, but you can always ask a person to review one: reply to the message or write to info@clonifylab.com. We make no other automated decisions about you and do no profiling for advertising.

10. Do you have to give us your data?

You need to give us an email address or a Telegram account to use ClonifyLab, and the details needed to make your videos. A clone needs the consent recording; if you don't want to make one, you can use faceless videos, which need no recording of you.

11. Children

ClonifyLab is only for people aged 18 or over. We never make a clone of a minor. If you think a child has used our service, write to us and we will delete their data.

12. Cookies and storage on your device

Our website uses no cookies and no other storage on your device. Our web app keeps your sign-in session in your browser's storage, which is strictly necessary to keep you signed in, so it needs no consent banner. Inside Telegram, the Mini App gets your sign-in details from Telegram.

13. Security

We protect your data with access rules on every database table, an audit log, encryption in transit and at rest at our providers, private storage with short-lived signed links, a server that is not reachable from the internet except through a protected tunnel, two-factor sign-in on all our provider accounts, and deletion jobs that run on the schedule in section 6. Every video we make carries invisible marks (C2PA Content Credentials and a watermark) that show it was made with AI by ClonifyLab: see how our videos are marked.

14. Changes to this policy

We'll update this policy when our service or the law changes, and show the date at the top. If a change matters for how we use your data, we'll tell you in the app, the bot or by email before it takes effect.