Privacy Policy

1. Who is responsible

2. Personal data we process

• Account data: email address, name if provided, password hash, account identifiers, session data, and OAuth authorisations.
• Clipboard content: text, titles, and descriptions you or an authorised agent submit.
• Technical data: IP address, request time, client information, security events, rate-limit records, and service logs.
• Communications: messages and information you send when requesting support, exercising rights, or reporting abuse.

3. Why we process data

4. How content is used

Clipboard processes stored text only to provide the actions you request and to operate, secure, and troubleshoot the service. We do not use stored content to train AI models. We do not sell stored content or personal data.

Search is performed against titles and descriptions supplied by you or your authorised agent. Clipboard returns the stored text when an authorised user or client requests it.

5. Who receives data

We use service providers acting on our instructions where needed to operate Clipboard. Current infrastructure includes Cloudflare for edge hosting, traffic security, and email routing, and Neon for managed PostgreSQL database infrastructure. Authentication is implemented with Better Auth. A connected agent or OAuth client receives only the data and permissions you authorise.

We may disclose information where required by law, to protect rights and security, or in connection with a corporate transaction subject to appropriate safeguards.

6. International transfers

Some providers may process data outside the European Economic Area. Where required, we rely on adequacy decisions, standard contractual clauses, or another lawful transfer mechanism.

7. Retention

We keep account data and active Clipboard content while your account exists or until you delete the relevant content. Authentication sessions and tokens expire according to their configured lifetime or when revoked. Security and operational records are kept only for as long as reasonably needed to protect and operate the service. Support and legal records may be retained for the period required to resolve the matter and meet legal obligations.

After deletion, limited copies can remain temporarily in backups until those backups are overwritten. We may retain information where required to establish, exercise, or defend legal claims.

8. Your rights

Depending on applicable law, you may request access, rectification, erasure, restriction, portability, or objection to processing. You may withdraw consent where processing relies on consent, without affecting earlier processing.

Send requests to privacy@clipboard.work. We may need to verify your identity. You may also complain to the Spanish Data Protection Agency (AEPD) ↗.

9. Automated decisions

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects.

10. Security

We use technical and organisational measures appropriate to the service, including encrypted transport, access controls, password hashing, scoped OAuth permissions, and rate limits. No system is perfectly secure, so keep independent copies and avoid storing unsupported high-risk data.

11. Children

Clipboard is not intended for anyone under 18. If you believe a minor has provided personal data, contact us so we can investigate and remove it where appropriate.

12. Changes

We may update this policy as Clipboard changes. We will update the date above and give additional notice where required.