Privacy Policy

BengalReach operates Clip. This policy covers the Clip website and the Creator and Brand accounts, onboarding, profile and campaign tools that sit behind it. It does not cover third-party platforms such as Facebook, Instagram, TikTok or YouTube, which have their own privacy policies.

The responsible operator is BengalReach. Our registered company name and address will be added here when finalised; until then, use the contact details in section 14 for any privacy matter.

Account and sign-in information

• Your name, email address and mobile phone number.
• Your password, which we store only as a salted hash, never as plain text.
• Whether you registered as a creator or a brand, your verification and onboarding status, and sign-in timestamps.
• One-time verification codes and email links, which we keep only in hashed form, together with attempt and resend counts and expiry times.

Creator profile

• Username, full name and date of birth.
• Optional details: gender, bio, profile picture, a separate contact phone number, city, postal code and a delivery address (used where a campaign involves sending you a product).
• Country (Bangladesh by default).

Brand and business profile

• Brand name, legal name, tagline, description, industry, company size, founded year, logo, banner and website.
• Business contact email and phone, contact person name and role, and business address.
• Which accounts belong to the brand and their roles.
• Where you request brand verification, the details and supporting documents you submit, and the review history.

Connected social media accounts

• The platform (for example Facebook, Instagram, TikTok or YouTube), your handle, profile URL, display name and account type.
• Verification status, the short code you are asked to place in your public bio, and the review history of that verification.
• Audience and view figures for the account, as recorded by our team after review.

We do not receive your social media passwords, private messages or access tokens. See section 4.

Campaign information

• For brands: campaign briefs, creative and media assets, schedules, targets, pricing selections and status.
• For creators: campaign enrolment and eligibility results, and content you submit for a campaign.
• Images and videos you upload, stored on our file-storage provider.

Technical and security information

• For each sign-in session: a hashed session token, IP address, browser and device type (user agent), and creation, last-seen and expiry times.
• Server and security logs kept by us and our hosting providers.
• Records of administrative actions on an account, such as review decisions, suspensions and the reason given.

Communications

Messages you send to us, and the verification and service messages we send you by SMS and email.

Earnings and payment information

Wallets, payouts and brand billing are not yet operational, and we do not currently collect bank, mobile-wallet or card details. Before that changes we will update this policy and name the payment providers involved.

• Accounts and sign-in: create and secure your account, verify your phone and email, and keep you signed in.
• Onboarding: set up creator and brand profiles and decide which steps you still need to complete.
• Social account verification: confirm that you control an account you connect, through the bio-code check and manual review.
• Campaigns: let brands create campaigns, decide which creators are eligible, and let eligible creators take part.
• Content review and performance measurement: review submitted content against campaign instructions and evaluate views and engagement.
• Fraud prevention and security: detect fake accounts, artificial engagement, abuse and unauthorised access, and act on it, including suspending accounts.
• Financial administration: once payouts and billing launch, calculate and record earnings and campaign spend.
• Support and necessary communications: respond to you and send verification codes, password resets and important service notices.
• Improving the service and meeting our legal obligations.

What is active today

Connecting a social account on Clip is manual. You tell us the platform, handle and profile URL, place a short code in your public bio, and submit it for review. We look at the public profile to confirm the code. We do not use Facebook Login, Instagram, Google, YouTube or TikTok APIs to read your data, and we do not hold access tokens for those platforms. Because no Google user data is accessed, no Google API user data is stored, shared or retained, and there is nothing for the Google API Services User Data Policy to cover at this time.

The sign-in buttons for Google, Facebook, Apple and Microsoft on the sign-up screen are shown as “coming soon” and are not functional. You create an account with an email address and phone number.

Planned, not yet available

We may later offer OAuth connections or API-based reporting for platforms such as Facebook, Instagram, TikTok and YouTube, to verify account ownership and read view and engagement figures. If we do, we will request only the permissions we need, explain them in this policy before launch, use platform data only for the purposes stated here, and comply with that platform’s developer terms, including the Google API Services User Data Policy where Google APIs are used. You will be able to disconnect an account at any time.

Infrastructure providers

We use service providers to run Clip. They currently include hosting (Vercel), a PostgreSQL database provider, Cloudflare R2 for file storage, an SMS provider for verification codes, and an email delivery provider for verification and password-reset messages. An optional caching service may hold short-lived copies of profile data to speed up pages; the database remains the source of truth. These providers process data only to provide their service to us. We do not use advertising or third-party analytics services.

We do not sell your personal information. We share it only as follows.

• Brands and creators in a campaign.Brands can see the creator information needed to run a campaign they are part of, such as username, connected social handles and performance figures. Creators can see a brand’s public profile and campaign details.
• Service providers listed in section 4, under contract and only as needed to operate Clip.
• Authorities and legal needs, where we are required by law, court order or valid legal process, or to protect the rights, safety and security of users or the platform.
• Business changes. If BengalReach is involved in a merger, acquisition or sale of assets, information may transfer to the successor, who must honour this policy.

Public versus private

Your brand profile (name, logo, description, website, industry) and your creator username and bio are intended to be seen by other users as part of campaigns. Your password, verification codes, session data, date of birth, phone number, delivery address, uploaded verification documents and admin review notes are private and are not shown to other users.

We use safeguards appropriate to the data we hold, including:

• Passwords and one-time codes stored only in hashed form.
• Sign-in sessions held in secure, HTTP-only cookies, with expiring access and refresh sessions that can be revoked.
• Limits on verification attempts and resends, and account lock-outs on the separate administrator sign-in.
• Role-based access: brand access comes from membership, and administrative tools use a separate authentication system.
• Encrypted connections (HTTPS) in production.

No online service can be completely secure, and we cannot guarantee absolute security. Please choose a strong, unique password and tell us promptly if you suspect unauthorised access to your account.

We keep personal information for as long as your account is active and as needed to provide Clip, run and settle campaigns, resolve disputes, prevent fraud, and meet legal, tax and accounting obligations. Verification codes and sign-in sessions expire automatically.

When you ask us to delete your account we remove or anonymise your personal information, except for records we have a genuine reason to keep (section 9). We have not set a single fixed retention period for every kind of data; how long a record is kept depends on its purpose. Copies in backups and provider logs are overwritten according to those providers’ normal cycles.

• Access and correction. You can view and edit most of your information from your creator or brand profile after signing in. For anything else, or a copy of the personal information we hold about you, email support@clip.bengalreach.com.
• Disconnect social accounts. Creators can disconnect a connected social account from the Accounts page in their workspace.
• Delete your account and data. See section 9.
• Communications. Verification and service messages are necessary to operate your account. We do not send marketing email or SMS today; if we start, you will be able to opt out.
• Questions or complaints about privacy: support@clip.bengalreach.com.

Some requests may be limited where we must keep information for legal reasons, to protect other people’s rights, or to prevent fraud. We will tell you if we cannot fully complete a request and why. Depending on where you live, you may have additional rights under local law; we will respect those that apply.

You can ask us to delete your BengalReach Clipping account and the personal information connected to it, including connected social account details. This section is the data deletion instruction page for BengalReach Clipping.

How to request deletion

1. Email delete-req@clip.bengalreach.comfrom the email address registered on your account. Use the subject line “Account deletion request”.
2. Include your registered phone number and, if you want only certain data removed, say which (for example a specific connected social account).
3. We may reply to confirm that the request came from you before we act. We may ask for additional proof if we cannot match the sender to the account.

If you only want to remove a connected social account, creators can also use Disconnect on the Accounts page after signing in, without deleting the whole account.

This also covers data tied to a Facebook or Instagram account you connected to Clip. Clip does not currently receive Facebook or Instagram account data through an API, so deletion consists of removing the social account details you entered on Clip. Use the same email process.

What happens next

• Deletion is handled by our team, not by an automated tool. We aim to respond promptly and will tell you when it is complete or if we need more information.
• We delete or anonymise your profile, contact details, connected social accounts, uploaded media and sign-in sessions, and close your account.

What we may keep

We may retain limited records where required or justified, for example for legal, tax and accounting obligations; unresolved disputes or payments; fraud and abuse prevention (such as a record that an account was suspended); and audit records of administrative actions. Brands that belong to a team with other members may remain for those members, and campaign records involving other users may be kept in a form that no longer identifies you where possible. Deleting your account does not remove content you have published on third-party platforms; remove that on the platform itself.

Clip uses a small number of essential cookies to keep you signed in and to carry you through verification steps. These are HTTP-only cookies set by Clip. Without them the sign-in feature cannot work.

We do not currently use advertising cookies, cross-site tracking or third-party analytics. If we add analytics or non-essential cookies we will update this policy and, where required, ask for your consent. Our hosting provider may collect standard request logs (such as IP address and browser type) to deliver and protect the site.

Clip is built for users in Bangladesh, but our infrastructure providers may store and process data in other countries. Where that happens, we rely on those providers’ contractual and security commitments to protect the data, and we share only what is needed to provide the service.

Clip is not intended for children under 13, and creators must be at least 13 to register. Creators under 18 should use Clip only with the knowledge and permission of a parent or guardian. Brand accounts are for businesses and their authorised representatives. If you believe a child under 13 has given us personal information, email support@clip.bengalreach.com and we will delete it.

We may update this policy as Clip develops, for example when payouts or new social integrations launch. The “last updated” date at the top shows the latest version. For significant changes we will give notice in the product or by email before they take effect where practicable. By continuing to use Clip after an update takes effect you accept the revised policy; if you do not, you can delete your account. Our Terms of Service also apply to your use of Clip.

• Privacy questions and support: support@clip.bengalreach.com
• Account and data deletion requests: delete-req@clip.bengalreach.com
• General enquiries: contact@clip.bengalreach.com