Privacy policy

Clonefy is established at Peizerweg 140, 9727 AP Groningen, and is registered in the Trade Register of the Dutch Chamber of Commerce (KvK) under number 90681096. Our VAT number is NL004300936B81.

In this privacy policy we explain how we handle personal data when you:

• visit our website;
• contact us;
• enter into a quotation, payment link or agreement with us;
• have a clone made;
• use our software, workspace, video player or hosting;
• receive support;
• appear in recordings, scripts, videos or other materials processed through Clonefy.

For legal or privacy questions, you can contact us at legal@clonefy.ai.

Clonefy is not required to appoint a data protection officer and has not done so. Privacy questions are received at the address above and handled internally.

This privacy policy applies to personal data that Clonefy processes as a controller. This may include data of:

• website visitors;
• contact persons at prospects and customers;
• users of a Clonefy account or workspace;
• clone persons;
• people who contact support;
• individuals whose personal data appears in scripts, uploads or project material provided to Clonefy.

For clarity, Clonefy broadly applies the following allocation of roles:

• for our own website, marketing, sales, quotations, contracts, invoicing, our own customer relationship, account provisioning, security and internal business operations, Clonefy in principle acts as controller;
• for personal data that a customer has processed through the Clonefy services in the context of its own organisation, own websites, own portals, own learning environment, own scripts, own use of clones or own end-user processes, Clonefy in principle acts as processor, insofar as Clonefy does not itself determine the purpose and the essential means of the processing.

In some situations the allocation of roles may be mixed or may differ per processing activity. In those cases the actual circumstances, the contractual arrangements and the applicable legislation are decisive. Where Clonefy processes personal data exclusively on behalf of a customer, the data processing agreement or other privacy arrangements with that customer also apply. In that case, that customer is usually the first point of contact for privacy requests about that specific processing.

The personal data we process depends on the relationship you have with us and on the service being used.

3.1Website visitors and contact requests

We may process the following data, among other things:

• name;
• company name;
• email address;
• phone number;
• the content of your message;
• date and time of contact;
• technical data needed for security, troubleshooting or the correct functioning of the website.

3.2Prospects, customers and contact persons

When you work with Clonefy on behalf of an organisation, or are in contact with us about this, we may process, among other things:

• name;
• job title;
• company name;
• email address;
• phone number;
• invoicing and payment details;
• contract, quotation and order details;
• communication about sales, onboarding, support or delivery;
• account and workspace details.

3.3Users of our software and workspace

When you use the Clonefy software, we may process, among other things:

• name;
• business email address;
• user role;
• account status;
• workspace details;
• login and session data;
• usage data within the software;
• settings and preferences;
• support requests and error reports;
• data about subscription type, credits and usage limits.

3.4Clone creation and video production

When Clonefy creates a clone or performs clone-related services, we may process, among other things:

• name of the clone person;
• position or role within an organisation;
• video recordings;
• audio recordings;
• voice recordings;
• scripts and text input;
• images of face, upper body, facial expressions, posture and body language;
• metadata relating to recordings and projects;
• consent documents and project arrangements.

3.5Scripts, uploads and project material

The customer or user may include personal data in scripts, documents, subtitles, uploads, training material, instructions or other content processed through our services. This may include, for example, names, positions, internal instructions or other substantive information.

3.6Player and usage analytics

When our video player, hosting or analytics features are used, we may process, among other things:

• session identifiers;
• playback events, such as play, pause, heartbeat, completion, rewatching and drop-off;
• language selection;
• viewing time and viewing duration;
• technical metadata, such as user agent, referring host and country code;
• in an app context, where applicable, a user ID or workspace link.

This data is used to enable analytics and reporting. This processing may initially take place at session or event level and then be displayed in aggregated form in dashboards and overviews.

3.7Website statistics

To see how our website is used and which organisations show interest, we measure visits without cookies and without storing anything on your device. We do this with a statistics service and with our own visitor log. For each visit, the following may be recorded:

• date and time of the visit;
• the page visited and the corresponding page type;
• the page or source you came from, and campaign parameters in the link;
• an approximate location, derived from your IP address, down to the level of country, region and city;
• operating system, browser and device type, with version number;
• a limited number of events that we have configured ourselves: clicking a button to the demo, starting a video, opening a preview, switching language in the demo and opening a question.

In our own visitor log we also store your IP address. We use it to look up which organisation or internet provider the address belongs to, so that we can see which companies view our website. We do this on the basis of our legitimate interest in recognising business interest in Clonefy. We do not link this to your name or email address and we do not try to find out who you are personally. Visitors are recognised by a value calculated from the request, which expires after 24 hours, so we do not track you between visits or across other websites. We delete the IP address after 30 days and the other visit data after 13 months. You can object using the contact details in this policy.

3.8Payments and administration

For payments, invoices, subscriptions and credit purchases, we may process, among other things:

• name of the contact person;
• company name;
• invoicing details;
• payment status;
• subscription information;
• transaction and invoice references;
• communication about payments or debt collection.

3.9Let the clone say something

On our website you can have Otter’s voice clone speak a short text of your own. For this we process your email address, the text you enter, the selected language, the translation, your IP address and technical data from your browser.

We use this data to make the feature work, to prevent misuse of the voice and to be able to review what was spoken. We may also send you a message about Clonefy at your business email address. If you do not want this, let us know and we will stop. For translation and review, your text is processed by Anthropic, and for the voice-over by ElevenLabs. The audio is only played in your browser and is not stored by us as a file. We keep this data for as long as necessary for those purposes and for no longer than twelve months.

3.10Asking questions to and talking with the AI clone

On our website you can ask Otter’s AI clone a question or have a short conversation with him. For this we process the questions you type, the answer the clone gives, the page on which you asked the question, the time, your IP address and a random code in a functional cookie (clonefy_kloon). We use that cookie and your IP address only to limit the number of questions and conversations per day. A conversation with video and audio uses your microphone, and only after you have given permission for this in your browser.

We use this data to make the feature work, to prevent misuse and to see what questions visitors have, so that we can improve our website and explanations. Your questions are processed by Anthropic to generate the answer. A conversation with video and audio runs via Anam; we do not store any audio or video from it. Do not enter any sensitive personal data. We delete your IP address after 30 days, and the questions and answers after no more than twelve months.

We only process personal data for clear and legitimate purposes.

4.1Contact and communication

We use personal data to:

• answer questions;
• follow up on contact requests;
• schedule demonstrations, calls or intake meetings;
• conduct commercial or operational communication.

4.2Quotations, engagements and contract management

We process data to:

• prepare quotations, payment links and engagements;
• enter into and perform agreements;
• handle administration and invoicing;
• organise appointments, planning and onboarding.

4.3Delivery of clone and video services

We process personal data to:

• make recordings;
• create clones;
• process scripts;
• generate videos, audio, translations, subtitles and other output;
• carry out and deliver projects.

4.4Provision of software, hosting and workspace functionality

We process personal data to:

• make accounts and workspaces available;
• manage access;
• store settings;
• provide hosting, player functionality, downloads and analytics;
• manage credits, subscription status and usage limits.

4.5Support, security and continuity

We process personal data to:

• provide support;
• resolve outages or errors;
• prevent or investigate misuse, fraud or security incidents;
• monitor the security and continuity of our services.

4.6Improvement and further development of our services

We may use personal data, or data derived from it, to:

• maintain and improve our software, workflows and services;
• analyse usage patterns;
• improve performance, stability and quality.

Where possible, we do this on an aggregated, data-minimised or pseudonymised basis. Clonefy does not use customer-specific scripts, clone recordings, voice recordings, source files or other identifiable customer materials for other customers, for general model training or for external showcase purposes, unless a separate legal basis or consent has expressly been obtained for this.

4.7Compliance with laws and regulations

We may process personal data to:

• comply with legal obligations;
• comply with tax record-keeping obligations;
• respond to valid requests from supervisory authorities, authorities or competent bodies;
• protect our rights and substantiate or defend against legal claims.

Depending on the situation, we base our processing on one or more of the following legal bases.

5.1Performance of a contract

We process personal data when this is necessary to perform an agreement with you or your organisation. For example for:

• handling quotations and orders;
• onboarding;
• account management;
• clone creation;
• provision of software and hosting;
• support;
• invoicing and subscriptions.

5.2Legitimate interest

We process personal data when this is necessary for our legitimate interests, such as:

• maintaining and securing our systems;
• improving our services;
• managing customer relationships;
• preventing misuse or fraud;
• the internal administration of engagements, support and business operations.

In doing so, we always weigh the interests involved and do not process more data than necessary.

5.3Consent

We process personal data on the basis of consent where this is required or appropriate. This may apply, for example, to:

• certain forms of use of likeness and voice;
• external showcase or portfolio use of demos or recognisable clone content;
• certain analytical or similar techniques that require prior consent.

Where we rely on consent, that consent can in principle be withdrawn. This does not affect the lawfulness of processing carried out before the withdrawal.

5.4Legal obligation

We process personal data when we are legally required to do so, for example for tax records or when we are obliged to respond to a lawful request from a competent authority.

5.5Special categories of personal data and sensitive data

In principle, Clonefy does not intend to process special categories of personal data, unless this is necessary for the agreed services or unavoidably occurs in materials supplied by the customer.

When creating a clone, we process recordings of face and voice. Such data may be sensitive in nature and, in certain contexts, may fall under special or otherwise specially protected categories. Clonefy therefore handles such data with extra care, restricts access to it as far as possible and processes it exclusively for the agreed purposes and on the basis of an appropriate legal basis.

Clonefy supplies exclusively to businesses and does not direct its services at children. We do not knowingly collect personal data from persons under the age of 16, and our website, software and player are not intended for them.

Customers and users may not upload, or have processed, any recordings, scripts, content or other materials that contain personal data of persons under the age of 16, unless there is a clear necessity for this, a valid legal basis exists and all required consents or authorisations have been validly arranged in advance.

If you suspect that we have nevertheless processed data of a child, please contact us at legal@clonefy.ai. We will then delete that data as soon as reasonably possible.

So that you do not have to match the purposes and legal bases yourself, they are set out together below. More than one legal basis may apply to a purpose.

We usually receive personal data:

• directly from you;
• from your employer or organisation;
• from our customer, when it engages us for clone creation, software or hosting;
• through the use of our website, software or player;
• through payment providers, support channels or other business communication;
• through uploads, scripts, forms, intake or onboarding.

Are you required to provide data?

You are never obliged to provide us with data. For part of our services, however, certain data is necessary: without a name, contact details and invoicing details we cannot enter into or perform an agreement, and without recordings of the clone person we cannot create a clone. If we do not receive that data, we cannot provide the service concerned. For everything else, such as answering a question, there is no obligation, and leaving out data has no consequences other than that we may be able to answer less specifically.

We do not sell personal data.

We only share personal data when this is necessary for our services, business operations, legal obligations or the protection of our rights. This may include sharing with:

• providers of cloud hosting, storage and infrastructure;
• providers of email and communication facilities;
• providers of payment processing and invoicing;
• providers of authentication, backend or database infrastructure;
• providers of video, voice, AI or translation technology;
• providers of support and communication functionality;
• advisers, accountants or legal service providers, insofar as necessary;
• supervisory authorities, authorities or competent bodies, if we are legally required to do so.

Clonefy works with categories of subprocessors and service providers. Where appropriate or required, Clonefy can provide further information on request about relevant categories of recipients, or make a current list of subprocessors available in the context of the data processing agreement or a privacy request.

Clonefy may have personal data processed outside the European Economic Area, for example when a service provider, cloud party or AI provider we use is established there or operates from there.

When personal data is transferred outside the EEA, Clonefy ensures that an appropriate transfer mechanism is used, such as:

• an adequacy decision of the European Commission; or
• appropriate safeguards, such as standard contractual clauses.

Where necessary, we take additional measures to arrange international transfers as carefully as possible.

If you would like to know which safeguards apply to a specific transfer, or would like to receive a copy of the standard contractual clauses used, please request them at legal@clonefy.ai.

We do not keep personal data for longer than necessary for the purpose for which we process it, unless a longer retention period is required by law or is necessary to substantiate or defend against legal claims. In principle, Clonefy applies the following retention periods.

9.1Quotations, contact requests and sales communication

Up to 24 months after the last relevant contact, unless an agreement is concluded earlier or a legal obligation requires otherwise.

9.2Account and workspace data

• for as long as the account or workspace is active;
• thereafter, in principle, for a maximum of 90 days for administrative completion, security, settlement and preparation for deletion.

9.3Scripts, project data and generated output

• for as long as the agreement or workspace is active;
• thereafter, in principle, for a maximum of 30 days in a wind-down or deletion phase, unless legal obligations, disputes or technical necessity require otherwise.

9.4Player, website and analytics data

• the recognition value behind our website statistics expires after 24 hours;
• raw event and session data, in principle, for a maximum of 12 months;
• aggregated analytics reports, in principle, for a maximum of 24 months, unless they have been fully anonymised or are needed for longer for legitimate business purposes.

9.5Support communication

In principle, for a maximum of 24 months after the support request has been handled, unless a longer retention period is needed in connection with an ongoing customer relationship, a security investigation or a legal dispute.

9.6Clone recordings, clone configurations and source material

• for as long as these are needed for the active services;
• after the agreement ends, Clonefy in principle starts the deletion procedure;
• Clonefy aims to complete the deletion procedure for relevant clone data within 90 days of termination, insofar as the systems and retention cycles of the service providers involved allow.

9.7Contract, invoice and payment data

• for as long as necessary for the agreement;
• thereafter for as long as required by law, including in any event the applicable tax retention period.

9.8Consent documents

• for as long as the clone, engagement or showcase consent concerned is relevant;
• and thereafter, in principle, for a maximum of 7 years for evidential purposes, dispute resolution, legal defence and record-keeping obligations.

9.9Prohibited or incorrect uploads

If Clonefy finds that scripts, uploads or project material contain data that has evidently been supplied unlawfully, falls outside the agreed purposes or should not be processed by Clonefy, Clonefy may refuse, block or delete that data and, where necessary, request additional information or confirmation of authority.

9.10Backups and residual technical data

If personal data temporarily remains in backups, log files or residual technical data, Clonefy will not actively bring that data back into production other than for security, recovery or continuity. Such data is deleted or overwritten in accordance with the normal backup and retention cycles of Clonefy and its service providers.

Clonefy takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised alteration or unlawful processing. These measures may include:

• role-based access restrictions;
• authentication and session management;
• secure connections;
• logging and monitoring;
• contractual arrangements with service providers;
• restricting access to personal data on a need-to-know basis.

No system is entirely free of risk. We therefore cannot guarantee absolute security.

On our own website we only place functional cookies, and only when you use a feature yourself: with the voice clone (section 3.9), a cookie remembers which email address you entered and how many attempts you have left, and with questions to or a conversation with the AI clone (section 3.10), a cookie remembers how many questions and conversations you have left today. If you schedule a demo, you do so in the calendar of an external scheduling service embedded in our page; that service may place a functional security cookie in its own window and receives the details you enter when scheduling. The statistics described in section 3.7 work without cookies and without storage on your device, which is why we do not ask for consent for them and you will not see a cookie banner on our site. If we start using a technique that requires consent, we will obtain that consent before the technique is put into use.

In the software and the player, however, Clonefy may use cookies, local storage, session identifiers and similar techniques, for purposes including:

• authentication and session management;
• security;
• remembering preferences;
• player and usage analytics;
• the correct technical functioning of the software and player.

Functional techniques that are necessary for the technical functioning or security of our services do not always require separate consent. For analytical or similar techniques that do require prior consent under applicable legislation, that consent is arranged through the route intended for that purpose.

More information can be found in our separate cookie and technology statement.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. A human is always involved before any decision about a person is made.

Our software does use AI to generate videos, voices, translations and subtitles. These are production steps on material that the customer supplies and approves, not an assessment of people. We do not use profiling to categorise, score or assess people.

How we relate to the European AI Regulation is described on our AI Act page.

Depending on the situation and the applicable privacy legislation, you may have rights including:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object;
• the right to withdraw consent previously given.

You can submit a request via legal@clonefy.ai.

We may ask you for additional information to verify your identity and to assess whether we ourselves are the right party to respond to your request. Where Clonefy processes the data concerned exclusively on behalf of a customer, we may refer you to that customer for the substantive handling of your request.

If you have a complaint about the way Clonefy handles personal data, please contact us first at legal@clonefy.ai.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Clonefy may amend this privacy policy from time to time, for example in the event of changes to our services, software, legislation or processing activities.

We publish the most recent version on our website or make it available in another appropriate way. In the event of significant changes, we will provide additional notice where appropriate.

This privacy policy should be read in conjunction with our general terms and conditions, data processing agreement and cookie and technology statement, insofar as these apply.

In the event of any discrepancy between contractual arrangements with a business customer and this privacy policy, the applicable contractual arrangements prevail for the specific services concerned, insofar as permitted by law.