Privacy Policy

Who operates Click Pop

Click Pop is the operator of this website, Click Pop Studio, the Click Pop API, and the Click Pop MCP connector. Write to hello@clickpop.ai.

What the service is

Click Pop is an AI video and influencer studio. With an account you can:

• Describe a fictional character and keep a reference set for later videos.
• Generate scripts, images, and videos, and upload product photos, logos, and other reference images.
• Save a brand profile (niche, tone, audience, example posts, colors, and logo) that later scripts and captions can use.
• Connect social accounts and publish or schedule posts you ask for, including to Instagram and Facebook.
• Call the REST API, or use the MCP connector with an API key you create, so an agent can list your studio, create a character or video, and publish when that key is used to do so.

The MCP connector is a tool that runs with your API key. It can read the same account, character, video, and connected-account information the API can read, and it can create or publish content only when a call is made with that key. See the MCP documentation and the Terms of Service.

Information we collect

Account

• Name, email address, and a date of birth. Signup and the birthday step reject anyone under 18, and remember a refused attempt so it cannot be repeated with another date.
• A record of what you agreed to and when: the Terms and this policy at signup, whether you want product emails (never pre-ticked), and at checkout the renewal terms and, in the EU/EEA and UK, your request for immediate access. Each record keeps the wording you saw, its version, the time and your country.
• Your approximate country, worked out from your IP address with the DB-IP Lite database (IP Geolocation by DB-IP). We use it to show the prices for your country and to check that a local price is paid from that country. We do not store your IP address for this.
• Sign-in method. Email and password are handled by Supabase. We do not see your password. If you continue with Google, Microsoft, or GitHub, we receive the email that provider shares, a name, a provider account id, and a profile image when the provider sends one. We do not see that provider’s password.
• Whether the email is verified, the plan, the credit balance, and the time the account was created.
• Workspace name, timezone, and how many hours before a scheduled post a video should render.

Content you put in the studio

• Character descriptions, scripts, captions, prompts, and generated images and videos.
• Uploaded images, including reference photos, product photos, and brand logos.
• Brand profile fields: niche, tone, audience, example posts, words you want left out, a style note, colors, and the logo file.
• Products, affiliate details, schedules, and posts you create in the studio.

Social accounts you connect

If you connect a network from the Social page, Click Pop stores the account id, username or handle, display name, profile photo, account type when the network provides it, connection status, and which characters you assign to that account. For posts published through Click Pop, we also store the post record and, when the publishing provider returns them, performance numbers such as views, likes, and shares for those posts.

Connection tokens for Instagram, Facebook, and the other networks stay with our publishing provider, Post for Me. Click Pop does not store your Instagram, Facebook, or other social password. Bluesky connections use an app password that is sent to Post for Me to open the connection. We do not keep a copy of that app password in the studio record.

API keys and connector use

On the API keys page you can create a key. The full secret is shown once. We store a hash of the key, a short prefix, the last four characters, the name you gave it, and when it was created and last used. Requests made with the key, including through the MCP connector, are tied to your account.

Billing

Paid plans are monthly subscriptions processed by Stripe. Credit top-ups are one-time payments, also processed by Stripe. We store a Stripe customer id and, when you subscribe, a subscription id, your plan, and a credit ledger (charges, grants, and credits returned when a render fails). Stripe handles the card. We do not receive or store the full card number.

Security and usage

We keep a session so you stay signed in, and we keep short-lived counters for sign-in, signup, and verification attempts. Those counters can include an IP address and the email address used on that attempt, so we can slow repeated tries. We also record credit use and API activity needed to run the account.

Visits to this website

When you browse the public pages we record page views, how far you scroll, how long a page stays open, which buttons you click, and where the visit came from (the referring site and any campaign tags in the link). We also note the device type, browser language, time zone, and the country, region and city, which we look up from your IP address on our own servers. We store the IP address itself only if you choose “Accept all”, and with sign-ups and sign-ins, where it helps keep accounts secure. Before you choose on the cookie notice, or if you choose “Essential only” or your browser sends Global Privacy Control, these records are tied only to the current browser tab. If you choose “Accept all”, they are tied to a first-party visitor cookie so we can see whether a visit later led to an account or a purchase.

Using Click Pop Studio

When you are signed in, we record how the studio is used so we can improve it: which screens you open and for how long, when you start typing a brief (not what you type), when you add an upload (how many and what kind, not the file), when you start a generation and whether it finished or failed and how long it took, when a plan or credits message is shown, when you open pricing or start a checkout, and when you play, download or share a video. These records are tied to your account and carry the device type, language and country. They do not include your prompts, your files, or your email address, and they set no extra cookies. If you arrive from one of our emails, we note which email it was.

Email you give us on the website

If you leave your email in the “What do you want to make?” card, we store it with what you said you want to make, the page you were on, where the visit came from, and whether you ticked the box to receive updates. We use it to set up your account and to remind you to finish creating it. We send marketing email (new models, prompts and offers) only if you ticked that box, and every such email has an unsubscribe link.

Email

Account email, such as the verification message, is sent through Supabase. The contact form on this website opens your own email app addressed to hello@clickpop.ai. It does not store the form on our servers. In-studio notices, such as a failed render, stay inside the product.

Where information comes from

• From you, when you create an account, type a date of birth, upload a file, write a prompt, or fill in a brand profile.
• From Google, Microsoft, or GitHub, when you choose that sign-in method.
• From a social network, including Instagram or Facebook, when you connect it. The fields we receive are the profile and posting fields described above, returned through Post for Me.
• From Stripe, when a payment or subscription succeeds: the customer id, subscription id, and the plan that payment applies to.
• From the service itself: generated videos, credit ledger entries, and post results for posts you asked us to publish.

How we use information

We use personal information to:

• Create and secure your account, including the 18-or-older check and the verification email.
• Render the videos and images you request, store them in your library, and show them back to you.
• Publish and schedule posts to the accounts you connect, and show analytics for posts published through Click Pop.
• Run the API and the MCP connector under your API key.
• Bill you, apply monthly plan credits, apply top-ups, and return credits when a render fails.
• Rate-limit sign-in and signup, and enforce the product’s content rules (for example, the character builder treats a human character as a fictional adult, 21 or older).

Where a privacy law asks for a reason, we rely on these:

• Contract. Account, content, billing, posting, and API data are processed to provide the service you asked for.
• Consent. You provide a date of birth to pass the age check, and you start each social-account connection. You can ask us to remove a connection or the account, as described under data deletion.
• Legitimate interests. Limited sign-in and security data is used to protect accounts, prevent abuse, and keep the service available. You can object by emailing hello@clickpop.ai. We will consider the request.

Click Pop does not use your characters, prompts, uploads, or videos to train a model of its own. Prompts and images are sent to the providers named below so they can fulfill the request you made. Those providers apply their own terms to a request they receive.

Meta, Instagram, and Facebook

You can connect Instagram, Facebook, and Threads from the Social page in ClickPop Studio. Connection is optional. If you do not connect an account, we do not receive that account’s platform data.

When you connect one of those accounts, ClickPop asks Post for Me to open that network’s login. The permission requested for the connection is permission to publish posts. From the connection, ClickPop stores the account id, username or handle, display name, profile photo, account type when Instagram or Facebook provides it (for example, whether an Instagram account is personal, business, or creator), and connection status.

We use Meta platform data only to provide the features you asked for:

• Show you which Instagram, Facebook, or Threads account is connected.
• Publish or schedule the post, caption, and video you select for that account.
• Read results for posts published through Click Pop, such as views, likes, and shares, and show them in your studio.
• Let an API or MCP call list those connected accounts or publish a ready video when your API key is used to make that call.

We do not sell Meta platform data. We do not use it for advertising, and we do not share it for cross-context behavioral advertising. We do not use it to train a Click Pop model. We do not access your Instagram or Facebook password, your private messages, or your friends list for this product. The login token that lets a scheduled post go out is held by Post for Me, not stored as a social password in Click Pop.

Instagram posting through this product expects a Business or Creator account. A personal Instagram account can be connected and still be unable to receive posts. That limitation comes from Instagram.

How to disconnect a Meta account

On the Social page, choose Remove on the connected account and confirm. That disconnects that account only. ClickPop stops using it for new posts and schedules, and asks Post for Me to disconnect it. To ask by email instead, email hello@clickpop.ai from the address on your ClickPop account. Use the subject “Disconnect social account” and name the network and the handle. We will remove the connection record we store and stop using it to publish.

You can also remove the app’s access in your Instagram or Facebook settings. That revocation is between you and Meta. Posts that already went live on Instagram or Facebook stay on that network until you delete them there. Deleting a post inside ClickPop removes it from the studio list. It does not delete a live post on the network.

Meta’s own terms apply to your Instagram, Facebook, and Threads accounts. ClickPop’s use of platform data is also described in the Terms of Service.

Service providers and sharing

We share personal information with service providers that perform a function for Click Pop, and with a social network when you ask us to publish there. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

The providers this product actually uses are:

• Supabase for authentication, including email sign-in and Google, Microsoft, and GitHub sign-in, and for the verification email.
• Stripe for checkout, subscriptions, and the billing portal. Card numbers stay with Stripe.
• Google, Meta, TikTok and Microsoft for website analytics and ad measurement, only for visitors who choose “Accept all” and only for the tools we have switched on (see Cookies).
• Railway for hosting the application.
• AI model providers for image, video, voice and text generation. A render sends the prompt and the reference, product or source images or clips needed for that job, and nothing else from your account.
• Post for Me (postforme.dev) for social-account connection and publishing, including Instagram, Facebook, and Threads.
• The social network you select, including Meta (Instagram, Facebook, and Threads), TikTok, YouTube, X, LinkedIn, Pinterest, and Bluesky, receives the post, caption, and media you choose to publish.

Each provider receives what it needs for that function. We do not give them your studio so they can advertise to you on other sites. If we add a provider that handles personal information in a new way, we will update this policy.

We may also disclose information if the law requires it, or to respond to a valid legal request, or to protect users, the public, or the service from abuse or fraud.

Cookies and local storage

Click Pop uses essential cookies to keep you signed in. Analytics and advertising cookies are used only if you choose “Accept all” on the cookie notice. You can change your choice at any time by clearing this site’s data in your browser, which brings the notice back.

Essential

• A first-party session cookie named arc_session. It is httpOnly, limited to this site, and lasts up to 30 days. It holds a session token. We store a hash of that token, not the raw cookie value, with your account.
• Supabase auth cookies that keep the sign-in session, including short-lived cookies while Google, Microsoft, or GitHub sign-in finishes.
• Your cookie choice and language choice, kept in local storage, and a per-tab id in session storage that ends when you close the tab.

Only with “Accept all”

• cp_vid, a random first-party visitor id (up to 13 months), and cp_src, where your first visit came from (up to 90 days). They let us see which pages and campaigns lead to sign-ups.
• Google Analytics and Google Ads (Google), Meta Pixel (Meta), TikTok Pixel (TikTok), and Microsoft Clarity (Microsoft), when we have them switched on. They measure visits and ad performance. Microsoft Clarity records how pages are used, including clicks, scrolling and mouse movement, to make heatmaps and session replays; it masks text you type. These providers process data under their own privacy policies.

The signed-in studio also stores a few preferences in your browser’s local storage: theme, whether the sidebar is collapsed, draft brand-kit and agent-chat text, and the position of the on-screen agent control. Those values stay on your device. Clearing site data in the browser removes them. Public pages do not require an account cookie to be read.

Retention

We keep account information, content, brand profiles, social connection records, and API key records while the account is open and the item has not been deleted. Sign-in sessions last up to 30 days. Verification links expire after one day. Rate-limit counters used for sign-in and signup are short-lived.

When you delete a character, video, schedule, post, or logo in the studio, we delete that item from Click Pop. Deleting a character removes its reference photos. Finished videos stay in the library until you delete them there. A post already published on a social network stays on that network.

After we complete an account deletion request, we delete the studio content tied to the account. We keep records we still need for billing, fraud prevention, security, or a legal duty. Stripe keeps payment records under Stripe’s own policy. We do not keep Meta platform data after the connection and the account content that held it have been deleted, except a record of the deletion request itself if we need it to show the request was handled.

Security

We use HTTPS in production, an httpOnly session cookie, hashed session tokens, and hashed API keys. Social passwords are not stored in Click Pop. Card numbers are not stored in Click Pop. No method of transmission or storage is perfectly secure. If you believe your account or API key has been exposed, revoke the key on the API keys page and email hello@clickpop.ai.

International transfers

Click Pop and the service providers listed above may process information in the United States and in other countries where those providers operate. Those countries may have different privacy laws from the country where you live. We use those providers to host the product, authenticate you, take payment, render video, and publish posts you request.

Your rights

You can ask to access, correct, delete, or receive a copy of the personal information we hold about you. You can also ask us to stop a particular use where the law gives you that right. Email hello@clickpop.ai from the address on the account, with the subject “Privacy request”, and say what you want. We will respond, and where we can complete the request we will do it within 30 days. If we need to confirm it is your account, we will ask.

There is no download-my-data button in Click Pop Studio. The Usage page shows the credit ledger for the signed-in account. A copy of the rest of your personal information is provided by email when you ask.

Depending on where you live, you may have additional rights, including the right to appeal a refusal. Email us and we will tell you what we can do under the law that applies. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no separate sale to opt out of.

How to delete your data

This is the deletion path for your Click Pop account, including information received from Meta, Instagram, or Facebook. The quickest way is in the studio: Settings → Account → Delete account (or Settings → Delete account in the iOS app). It deletes the account at once, cancels a subscription billed through Click Pop, and signs you out everywhere. You can also ask by email; you do not need to be signed in to send the request.

1. Email hello@clickpop.ai from the email address on the Click Pop account.
2. Use the subject “Data deletion”.
3. Include the account email. If you connected Instagram, Facebook, or Threads, include the handle and the network so we can match the connection.

We will delete the Click Pop account and the studio data tied to it: profile, date of birth, characters, videos, uploads, brand profile, schedules, studio post records, social connection records we store (including Instagram, Facebook, and Threads), and API keys. We will do that within 30 days of a request we can match to the account. We may keep billing records in Stripe, credit and payment records we must keep, and short security logs, as described under Retention.

You can delete individual items yourself while the account is open:

• Characters, in the character studio. Deleting a character removes its reference photos. Videos already in the library stay until you delete them.
• Videos, in the Library.
• Schedules, in Automations.
• Posts, on the Social page. A post that is already live on Instagram, Facebook, or another network stays there until you remove it on that network.
• A brand logo, in Settings.
• An API key, on the API keys page, by revoking it.

To disconnect a social account without deleting the whole ClickPop account, choose Remove on the Social page, or email with the subject “Disconnect social account”, as described in the Meta section above. Canceling a paid plan is separate: signed-in users cancel from Billing, which opens Stripe. Canceling a plan does not by itself delete personal information.

Children

ClickPop is for adults and is not directed to anyone under 18. Signup requires a date of birth, and the product blocks anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has an account, email hello@clickpop.ai with the subject “Data deletion” and we will delete it.

The account age check is 18. Separately, the studio’s content rules treat human characters as fictional adults. That is a rule about what the product will generate, not an extra age gate on the account.

Changes

We may update this policy. The new version will be posted on this page with a new effective date. If you have an account, continued use of Click Pop Studio after that date means the updated policy applies. The prior contact address remains hello@clickpop.ai.

Contact

Privacy questions, a copy of your information, a correction, a disconnect request, or a deletion request: hello@clickpop.ai.

Related pages: Terms of Service, Copyright notices, Contact.