Privacy Policy

Clonebased is operated by ApeTec Ltd, a company registered in England and Wales (company number 17065917) with its registered office at 124–128 City Road, London EC1V 2NX. ApeTec Ltd is the data controller for your account data and is registered with the Information Commissioner's Office (ICO), registration number ZC202053. Contact: hello@clonebased.com.

Three kinds of people meet Clonebased: Builders, who have accounts with us; creators, whose public channels Builders make clones of and who have no account with us; and students, who sign in to a clone's site with a login their creator gave them. This policy covers all three.

What we collect

• Account data (Builders): email address, password (hashed), display name, notification preferences, when you were last active, and whether email to your address has bounced.
• Billing data (Builders): processed by Stripe — we never see your card number. We store your Stripe customer ID and subscription state. Invoices are held by Stripe and available through the billing portal.
• Your Anthropic API key (Pro Builders): stored encrypted, used only on our servers to run your clones, never shown again in full, never written to logs or error reports, and deleted the moment your account is deleted, or 30 days after your subscription ends. We also record whether it last worked and what each clone has spent on it.
• Clone data: the public YouTube channel data a Builder points us at (the channel's name, handle, description, avatar, banner and subscriber count, and the public videos and their transcripts); the course material the Builder adds, kept as text only — video is transcribed in the Builder's own browser and never reaches our servers; the generated descriptions of the creator's voice, personality and knowledge; the clone's site content and edit history; and the Builder's choices about style, arrangement and theme.
• A creator's name and likeness: a clone carries the creator's public name, handle and avatar, as shown on YouTube. The creator's agreement to the clone being published is the Builder's responsibility and is confirmed by the Builder in the product (see the Terms). A creator can take a clone of themselves down at any time at the takedown page; to do so we fetch their public channel page once and record the request, with a keyed one-way hash of the requester's IP address, for seven days.
• Student logins: a login is a username and a password, given to the student through their creator. We store the username, a one-way hash of the password (never the password itself), when it was issued and renewed, when it was last used, and a label the Builder may have typed (such as a first name or an email address the creator gave them). A signed-in student's browser keeps a signed token in its own storage — not a cookie — that names the clone's site and the login, nothing more. A failed sign-in leaves a keyed one-way hash of the IP address and of the username tried, kept no longer than a day.
• Students' questions and the clone's answers: to answer, a student's message and the relevant course excerpts are sent to the AI provider — on the Builder's own key for a Pro Builder's clone, on ours for a Free clone — together with the conversation so far — its recent messages as written, and a short summary of anything earlier. We do not store the questions or the answers: a student's conversations live on their own device, in their browser, and neither we nor the Builder nor the creator can read them through Clonebased. We keep a count of answers per clone per day, and what they cost, so the Builder can see their spend.
• Preview links: a private link to a clone that a Builder shares with a creator. Anyone who opens it can chat with the clone; to bound that use we hold one allowance counter for the link, removed once it has gone unused for two days.
• Find Creators: the niche and audience size a Builder searches for, and the public channel data the search returns (name, handle, avatar, subscriber and video counts), kept as the Builder's pipeline.
• Operational data: rate-limit counters (hashed IP addresses, and the email addresses and account and clone identifiers that sign-in and usage limits count), abuse-event records, and error monitoring via Sentry (reports of errors from our servers and from browsers — nothing else is sent). Sentry processes these in the United States.

We set no analytics or advertising cookies anywhere, and we do not track visitors on published clone sites.

Why we process it

Contract performance (running your account, building and hosting clones, billing), legitimate interest (security, rate limiting, abuse prevention, error monitoring, a creator's control over clones of themselves, and running a clone for the students its creator has given access to), and legal obligation (tax and accounting records).

Who we share it with

We share specific data with these service providers, and no one else except as required by law. We do not sell your data.

Provider	Purpose	Data
Supabase	Database, authentication, storage	Account and clone data, session IPs, uploaded logos
Stripe	Payments	Billing identity, transactions
Anthropic	The AI that builds and answers (Claude models)	Channel data and transcripts, course material, the clone's voice and knowledge descriptions, students' messages and the course excerpts relevant to them. For a Pro Builder's clones this is sent under the Builder's own Anthropic account and key, so Anthropic's terms with the Builder apply; for a Free clone it is sent under ours
Apify	Fetching public YouTube data	The channel link a Builder pastes, the channel's public page, video listings and transcripts; Find Creators queries and the public channels they return
Postmark	Transactional email to Builders	Recipient address, message content
Cloudflare (Turnstile)	Bot protection	The challenge token we check; the Turnstile widget runs in your browser and receives your IP address and browser signals directly
Upstash	Rate limiting and allowances	Keyed hashes of IP addresses; email addresses, account, clone and login identifiers for sign-in and usage limits
Vercel	Hosting and domains	Request data
Sentry	Error monitoring (United States)	Error reports, as described above
Hugging Face	Serving the speech-recognition model a Builder's browser downloads, once, to transcribe course video on the device	The browser's IP address; no video, audio or transcript leaves the device

Students' browsers load a clone's site and its chat from our hosting, and the creator's avatar and banner from our storage. If those two pictures could not be copied when the clone was built, they load from YouTube's image hosts (Google) instead, which receive the browser's IP address under Google's own privacy policy.

Our own marketing page shows an invented demonstration creator whose two photos are served by Unsplash, which receives your browser's IP address under Unsplash's own privacy policy.

How long we keep it

• Account data: until you delete your account. Deletion is immediate and permanent.
• Clones and everything in them (channel data, transcripts, course material, the voice, personality and knowledge descriptions, site content and edit history, student logins): until the Builder deletes the clone or their account; 30 days after a subscription ends; 30 days after a Free account's clone was built; or 30 days after a clone that was never published was built. The product shows the date in every case, and a Builder whose subscription has ended is emailed before the deletion.
• Student logins: a login expires one month after it was issued or renewed; it can be renewed for 30 days after that, and is then deleted with its hash. A login the Builder deletes stops working at once and loses its label; its username and hash are kept for at most 30 days, only so its student is told their access has ended, and are then deleted.
• A signed-in student's session: kept in the student's own browser, not a cookie, until they sign out; it stops working when their login ends.
• Answer counts and spend per clone per day: about 13 months (400 days), for the Builder's own records and ours; they are deleted with the clone or the account.
• Allowance counters for students and preview visitors: each counts a rolling five hours, and a counter unused for two days is removed.
• Preview links: they stop working 7 days after they are made, and are deleted 30 days after that.
• Takedown requests: 7 days for an unproven request; a proven takedown is kept as the record that the channel may not be cloned again.
• Find Creators searches and the creators they found: until the Builder deletes their account. A creator the Builder removes from their pipeline is removed after 30 days.
• Sign-in sessions (with the IP address and browser recorded by our authentication provider): until you sign out on that device, change your password (which signs every other device out), or delete your account.
• Abuse-event records: deleted after 1 year.
• Email-delivery records: 6 months, then deleted automatically. Postmark keeps the content of each email it delivers for 45 days.
• Error reports: kept by Sentry for 30 days.
• Request logs: kept by our hosting provider (Vercel) for no more than 30 days.
• Backups: the database is backed up daily and each backup is kept for 7 days, so deleted data leaves the backups within 7 days.
• Payment-event records from Stripe: the record is kept for the payment audit trail, and the raw event body — which can carry a name, an email address, or a billing address — is stripped once the event has been handled and is 90 days old.
• Billing records: kept as required by UK tax law. On account deletion our own records keep the Stripe customer ID, and the raw payment events keep their details until they are stripped as above; Stripe keeps the customer and invoice records, including the name and email on them, for the same statutory period.

Your rights

You have the rights UK GDPR and applicable privacy laws give you over your data — access, rectification, deletion, portability, objection, and restriction. For Builders, deletion and a copy of your data are both self-service, in your account settings. Deletion takes effect immediately and erases your account, your clones, their course material and student logins, and your key. A creator who wants a clone of themselves removed can do so at the takedown page without contacting anyone. A student's conversations are on their own device and are theirs to delete; a student's login is held by the Builder who issued it, and ends when it expires. For anything else, write to hello@clonebased.com. You can also complain to the ICO.

Transfers

Our database, hosting and most of the providers above are in the United States, so your data is transferred there. For a provider in the United States, the safeguard is the Standard Contractual Clauses (with the UK International Data Transfer Addendum) in that provider's data processing terms; a provider in the European Union relies on the UK's adequacy regulations.

Security

Data travels over encrypted connections (HTTPS) and is encrypted at rest by our providers. A Builder's Anthropic key is additionally encrypted by us before it is stored, with a key that exists only on our servers, and it is decrypted only inside a request that is about to use it. The database accepts connections only over SSL and only with credentials held on our servers and our providers'; the browser's own roles cannot write to it at all, and privileged access runs on our servers only. Each clone answers only from its own material; a clone cannot reach another clone's. Student sign-in resists guessing: each login's password is stored only as a one-way hash, and failed attempts are limited for each login and for each address.

Children

Clonebased's accounts are for Builders aged 18 and over. Students are the creator's own students, given access by the creator; we hold no age or contact details for them beyond any label the Builder types for a login, and we do not knowingly collect data from anyone under 18.

Changes

We may update this policy. The date above shows the current version.

Contact

hello@clonebased.com · ApeTec Ltd, registered in England and Wales, company number 17065917 · Registered office: 124–128 City Road, London EC1V 2NX · ICO registration number ZC202053.