Privacy, explained plainly.

This Privacy Policy applies to ClonePlug websites, the authenticated application, and related account features. It explains the categories of information the product handles, why it is needed, and the choices available to you.

ClonePlug is a customer-facing creative service. This policy describes product behavior at a practical level and does not publish confidential credentials or internal infrastructure details.

Account and authentication information may include your email address, authentication state, account creation details, sign-in events, password-reset or verification state, and OAuth identity information when you choose an enabled sign-in method.

Profile information may include display name, first and last name where provided, avatar information where configured, plan, timezone or country fields where supported, onboarding state, and notification preferences.

When you use ClonePlug, the service may handle uploaded images and videos, Face Library assets, selected face references, Character Swap source and character inputs, Real-Time Lucy session metadata, project titles and statuses, durations, outputs, and other project metadata needed to provide the workflow. If the Lucy session camera snapshot policy is enabled, we will show a separate notice and ask for your acknowledgement before the session starts. With your acknowledgement, ClonePlug may capture one still image after transformed output is established for the stated security, support, or abuse-prevention purpose. It is not continuous camera recording; the image is private, accessible only to authorized Admin staff, and automatically deleted after the retention period shown at consent.

Wallet and credit records include reservations, usage or capture, releases, refunds where applicable, purchases, referral rewards, administrative adjustments, ledger references, and related timestamps. Payment records may include package snapshots, amount, currency, provider status, safe references, and credited timestamps.

Manual crypto deposits may include the selected coin and network, destination-address snapshot, transaction hash or TXID, expected value, package snapshot, proof path, review status, rejection reason, and review timestamps. Proof files are stored in private storage according to the configured access policies.

Support requests and messages, referral attribution and reward records, in-app notifications, settings, and account-deletion requests may be stored when you use those features. Technical information may include request, authentication, security, error, and rate-limit logs needed to operate and protect the service.

ClonePlug uses this information to authenticate accounts, maintain profiles and preferences, provide Face Library, Real-Time Lucy, Character Swap, Projects, Wallet, Billing, Referrals, Notifications, Help, and Support, and keep resources scoped to the correct account.

We also use records to reserve, capture, release, and reconcile credits; verify payments; review manual crypto deposits; prevent unauthorized access; investigate reported misuse; respond to support requests; maintain idempotency and recovery; and meet legal or operational obligations.

When you request a transformation, the relevant inputs and job or session metadata are sent through the server-side processing path needed to fulfill that request. Real-Time Lucy uses session and output-activity information to operate the session and apply the configured usage policy. Character Swap uses source and selected reference inputs to create and track a project.

The product may use an upstream transformation processing service for requested jobs. The browser does not receive provider credentials. We do not state that media or streams are immediately deleted, never stored, or retained for a fixed period unless the configured service behavior and policy explicitly guarantee that outcome.

You are responsible for having the consent and rights needed for media and references you submit. See the Acceptable Use Policy and Trust & Safety page for responsible-use requirements.

ClonePlug maintains one account wallet and ledger for credit activity. Kora payments, where configured, are initialized and verified server-side before a purchase credits the wallet. Manual crypto deposits remain pending until the configured review and approval process is completed; uploading proof or submitting a TXID does not itself add credits.

ClonePlug does not receive or store your card secret, Kora secret, wallet private key, or seed phrase. Payment processors and financial-service providers may process payment information under their own privacy terms. Incorrectly routed crypto transfers may not be recoverable.

ClonePlug uses managed authentication, database, access-control, and storage services to operate the account and workspace. Payment processing may involve Kora or another provider selected in the server configuration. Requested transformations may involve an upstream processing service. Email delivery, hosting, storage, and other operational services may also process limited information where necessary.

Provider credentials and server secrets are kept out of browser code. The exact providers, regions, contracts, and data-processing terms may change as the product is configured and operated.

Information is stored for as long as needed to provide the relevant feature, maintain account and financial records, support security and recovery, resolve disputes, comply with legal obligations, and preserve audit or ledger integrity. Different records may have different lifecycles.

The current implementation does not make a single immediate-deletion or fixed-retention promise for all uploaded media, projects, payment records, crypto proofs, support messages, logs, or audit history. Account deletion may remove or de-identify some account-linked data while financial, audit, legal, or operational records may need to remain.

ClonePlug uses authenticated sessions, owner-scoped database policies, server-authorized mutations, private storage policies for applicable media and proofs, payment verification, webhook validation, rate limits, idempotency controls, and ledger-first credit handling as part of its security architecture.

No online service can guarantee absolute security. Do not send passwords, API keys, seed phrases, private keys, or other secrets through uploads, support requests, payment notes, or chat.

You can review and update available profile, security, notification, onboarding, and account settings. You can inspect your own projects, wallet ledger, payment activity, crypto deposits, referrals, notifications, and support requests through the authenticated application.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, subject to identity verification, legal exceptions, and records that must be retained. Contact support@cloneplug.ai for a privacy request; owner-specific response timelines and jurisdictional rights should be confirmed before launch.

You may use the available account-deletion request flow in Settings. Deletion is not a way to erase financial, audit, security, support, referral, or other records that ClonePlug must retain for legitimate operational or legal reasons. The result and timing of deletion depend on the configured account workflow and applicable requirements.

ClonePlug and its service providers may process information in countries different from the country where you live. The available regions, transfer mechanisms, contractual safeguards, and user notices depend on the production providers and deployment configuration selected by the operator.

The operator should confirm the production processing regions and any jurisdiction-specific transfer language before launch.

ClonePlug is not intended for children below the minimum age required by applicable law. The current product does not claim to perform age verification. Do not create or submit sexual content involving minors, and do not use the service for the exploitation of children.

ClonePlug uses essential cookies and related session technology for authentication, security, callback handling, referral attribution where applicable, and reliable navigation between the public site and application. The current policy does not assume optional analytics or advertising cookies unless separately configured and disclosed.

We may update this policy when the product, providers, legal requirements, or data practices change. The Last Updated date identifies the current published version. Material changes should be communicated through appropriate product or account channels where required.

Questions or privacy requests may be sent to support@cloneplug.ai. The configured public operator name is ClonePlug.ai. Business address, legal entity, regulator, jurisdiction, and data-protection-officer details are not invented here and require owner confirmation before launch.