Privacy Policy
We collect as little as we can. SaveMeClip has no accounts, doesn't ask for your name or e-mail to use the tools, and doesn't keep what you submit to them, except as described below. This policy follows Brazil's General Data Protection Law (LGPD) and the European Union's GDPR.
Who is responsible
The controller of your data is the independent developer who runs SaveMeClip, based in Brazil. For any question or request about your data, write to [email protected]: this is our data protection contact channel.
In short
- No account, no name and no e-mail are needed to use the tools.
- We don't set cookies of our own. Google, which serves the ads, may use cookies, with your consent where the law requires it.
- What you submit to a tool is used only to produce your result, and is erased as described below.
- Usage records hold no IP address and nothing of what you submit. They're kept for 90 days, and so is the feedback you choose to send.
- We don't sell your data.
What we process, why and on what basis
The legal bases are those of the LGPD (article 7) and the GDPR (article 6): providing the service you ask for, our legitimate interest in running and protecting a free service, your consent, and legal obligations.
- What you submit to a tool (text, files or links): used only to produce the result you asked for, as described for each tool below. Basis: providing the service you request.
- Connection data: like any website, our server receives your IP address and the technical information that your browser sends, by way of Cloudflare. Your IP address is kept only in the server's memory, for up to about two hours, to apply usage limits, keep your place in a queue and block abuse. It's never written to disk or to the database, and our server keeps no access log. When a tool asks for a bot check, your IP address is sent to Cloudflare along with it. Basis: legitimate interest in security.
- Usage records: for each use of a tool, we record the date, the tool, the page's language, your country as reported by Cloudflare, the result, how long it took and technical settings, such as the chosen voice, the length of a text or the size of a file. They never include what you typed, your files, their names or the links you pasted. Instead of your IP address, they hold a code computed from it with a key that changes every day and is never stored, so once the day is over not even we can link the code to an address. Kept for 90 days. Basis: legitimate interest in running the service, measuring its capacity and detecting abuse.
- Feedback: if you use the form at the end of a page, we keep your rating, the reasons you chose and your message, with the page, its language, your country, the same daily code and how you saw the page: browser and system (only their family), browser language, time zone, window and screen size, whether the screen is a touch screen, the type of connection, time on the page, how far you scrolled, the site you came from and whether a tool had shown a result. The rating is recorded as soon as you click it. Kept for 90 days. Please don't include personal data in your message. Basis: legitimate interest in improving the site; whether to send it is up to you.
- Server health: every 30 seconds, the server records its load, memory and queues. It also records the type of each error that happens, never its text, links or anything a visitor sent. Kept for 30 days. Basis: legitimate interest.
- Messages you send us: if you write to us, we use your e-mail address and what you wrote only to answer you and handle your request. We keep messages while they're needed for that, and copyright or removal requests for as long as the block they led to remains in place, or as needed to defend a legal claim. Basis: legitimate interest, or a legal obligation when the request is about your rights.
Links you paste
The link you paste goes to our server, which asks the network it belongs to, Instagram, Facebook, TikTok or X, for the post's public information. That network receives the link and our server's address, never yours, and we never ask for your login. A short link, like vm.tiktok.com or fb.watch, is first opened on that network's own site, only to learn which post it leads to. The answer is kept in memory for up to 10 minutes, so that asking again is faster: it holds the post's public information, but nothing about who asked. If Instagram refuses our server, an Instagram request may go through an intermediary network provider (a proxy), which receives the Instagram link and nothing about you; links from the other networks never go through it.
Files you download
Files and their previews pass from the network's servers through ours to your browser as you receive them, and aren't stored. Download links are signed and expire after two hours. While it reads a TikTok post, our server gets a technical cookie from TikTok, which TikTok asks for again with each file: it goes inside the download link and says nothing about you. Your browser may keep the previews in its cache for up to an hour. Usage records only get the network, the kind of content, the number of items, the file format, technical details such as whether the answer came from memory, and whether it worked: never the link, the post code or the account name.
Block requests
When we block a post or an account after a request, our block list only holds the network and the post code or the account name. The request itself, with the name and e-mail of the person who sent it, is kept as described above for messages.
Advertising and Google's cookies
The site is funded by ads served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this site or to other sites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. Google acts as an independent controller of this data: see how Google uses information from sites that use its services and how Google uses cookies in advertising.
In the European Economic Area, the United Kingdom and Switzerland, Google shows you a consent message, from a consent management platform certified by Google, before it uses cookies or similar data to personalize ads. If you don't agree, Google may still show non-personalized or limited ads, which rely on less data, as Google explains in its policies. You can change your choice at any time through the privacy and cookie settings link that the message leaves on the page. Basis: your consent.
Everywhere else, including Brazil, Google may personalize ads based on our legitimate interest in funding a free service, and you can object at any time: turn off personalized ads in Google's Ads Settings, opt out of personalized advertising by other participating companies at aboutads.info or, in Europe, at Your Online Choices, and block or delete cookies in your browser.
Analytics
To know, in aggregate, which pages are visited, how they're found and how fast they load, we use Umami, an open-source analytics tool that we host ourselves, at analytics.hanati.com.br. It uses no cookies and doesn't identify you. It records the page address, the site you came from, your browser, system, type of device, screen size, language and approximate location (country and city), page-speed measurements and clicks on a tool's main button, with only the tool's name. Your IP address is used to work out the location and a visit code that's reset from time to time, and isn't stored. Basis: legitimate interest. We keep these statistics for as long as they're useful to us.
Cookies and storage in your browser
We don't set cookies of our own. The site saves a few items in your browser's storage, which stay on your device and are never sent to us:
- site-language: the language you chose in the menu, kept until you clear your browser's data;
- feedback-prompt: when the feedback box last appeared and which pages you've rated, so that we don't ask too often;
- feedback-prompt-seen: that the feedback box has already appeared during this visit, erased when you close the tab.
Other companies may set cookies of their own: Google, for ads and to remember your consent choice (such as __gads, __gpi and FCCDCF), and Cloudflare, to tell people from bots (such as __cf_bm and cf_clearance), which are needed for security. You can block or delete cookies in your browser's settings; the site will keep working, although some ads or checks may not.
Who receives data
We don't sell or rent personal data. Data is shared only with the providers that make the site work, each for its own role, and with authorities when the law requires it:
- Cloudflare (United States): network, protection against attacks and bot checks. All traffic to the site passes through it, and on pages whose tools do heavy work, its Turnstile check runs in your browser and analyzes technical signals to tell people from bots. Privacy policy.
- Oracle Cloud: the server where the site and its database run, under our control.
- Google (United States): the ads, as described above, and the e-mail service of our mailbox. Privacy policy.
- The services used by specific tools, named above in the sections about each tool.
International transfers
These providers may process data outside your country, including in the United States. Where the LGPD or the GDPR require it, these transfers rely on the safeguards the law recognizes, such as the standard contractual clauses in the providers' terms and, for companies certified under it, the EU-U.S. Data Privacy Framework.
How long we keep data
- What you submit to a tool: only while it's processed, as described for each tool.
- Your IP address: only in memory, for up to about two hours.
- Usage records and feedback: 90 days, then erased automatically.
- Server health records: 30 days, then erased automatically.
- Messages: while they're needed, as described above.
- Data held by Google and Cloudflare: according to their own policies.
Security
The site is served only over encrypted connections (HTTPS), and it sends security headers that tell browsers to keep it that way. The database can't be reached from the internet, our admin page requires two separate sign-ins, and files sent for processing are handled by restricted programs, with no access to our credentials, and erased automatically. No system is completely secure: if an incident is likely to put your rights at risk, we'll inform the authorities and the people affected, as the law requires.
Your rights
Under the LGPD and the GDPR, you may ask us to confirm whether we process your data, to give you access to it, to correct, delete, anonymize or restrict it, to transfer it, and to tell you whom we've shared it with. You may also object to processing based on legitimate interest, and withdraw your consent at any time. Write to [email protected], and we'll answer within 15 days.
Since we keep no account and no IP address, usage records can't be traced back to you, and we usually hold nothing that identifies you. If you sent feedback with personal data and want it erased, tell us the page, the approximate date and the text, and we'll delete it. For advertising data, use the options above or contact Google directly.
You may also complain to a data protection authority: in Brazil, the ANPD; in the European Union, the authority of your country; in the United Kingdom, the ICO; in Switzerland, the FDPIC.
Automated decisions
We don't make decisions that have legal or similarly significant effects on you based only on automated processing. Usage limits and bot checks only decide, at that moment, whether a request can go ahead.
Children
SaveMeClip isn't directed at children and must not be used by anyone under 13. Between 13 and the age of majority, it may only be used with the permission of a parent or guardian. We don't knowingly collect data from children: if you believe that a child has sent us personal data, for example in a message, write to us and we'll delete it.
Changes to this policy
We'll update this policy whenever what the site does with data changes. The date at the top of this page shows the current version.