Understand where your data is stored and processed
Where Clevera stores and processes your recordings, videos and account data, which service providers it uses and where they are, how long data is kept, and whether your content is used to train AI.
This article explains where Clevera stores and processes your data: the servers, the file storage, the service providers that handle parts of the work and the countries they're in. It sums up our Privacy Policy and Security page, which are the binding versions.
In short
- Clevera's application servers and database run in the EU (Germany).
- Recordings, uploads and the videos you make are stored in the US, on Amazon Web Services. Public brand assets are stored in the EU (Sweden).
- The AI and other service providers process data mainly in the US.
- You can't choose a data region for your workspace today.
- Your content is never used to train AI models.
Where your data is stored
| What | Where | Provider |
|---|---|---|
| The Clevera app, your account and workspace data (the database) | EU (Germany) | Hetzner, managed with Laravel Forge |
| Recordings, uploads and generated media (videos, audio, images) | US | Amazon Web Services (Amazon S3) |
| Public brand assets | EU (Sweden) | Amazon Web Services (Amazon S3) |
| Delivering media to your browser | Global network, through links that expire | Amazon Web Services (Amazon CloudFront) |
| Database backups | Cloud object storage, encrypted at rest | Laravel Forge |
The database only accepts connections from Clevera's own application server, not from the internet.
Where your recordings are processed
When you record with the desktop app, the recording uploads to your Clevera workspace while you record and right after you stop. From there:
- The recording is stored in Clevera's file storage (US).
- Clevera's servers (EU, Germany) run the job that makes your video.
- The AI providers below analyze the recording, write the script, make the voice-over and captions. Video files sent to them for analysis are deleted from the provider within hours.
- Your finished video is saved back to your workspace.
Rendering an export happens in your own browser by default, so the video is put together on your computer. When a video is rendered on the server instead, that runs on Amazon Web Services in the US.
Service providers we use
These providers process data on Clevera's behalf (sub-processors). Apart from Hetzner (EU, Germany) and the EU storage noted above, they process data in the US.
| Provider | What it does for Clevera |
|---|---|
| Amazon Web Services | File storage, media delivery, server rendering and email |
| Hetzner | Application servers and database (EU, Germany) |
| Google (Gemini API, Cloud Text-to-Speech) | AI analysis of your material, scripts, translation, narration, images and drafts of support replies |
| Anthropic | AI models that write and direct videos and social clips, and the in-app assistant |
| OpenAI | Speech-to-text and captions, AI models and the website research model |
| Browser Use | Isolated cloud browsers for website research and Record with AI |
| HeyGen | AI avatar videos, presenter voices, and music and sound-effect search |
| Brandfetch | Finding your public brand logo from your domain |
| Lemon Squeezy | Payments, invoicing and tax, as Merchant of Record |
| Slack | Internal notifications to the Clevera team, such as new support messages |
| ipgeolocation.io | Approximate sign-in location, for security |
| Laravel Nightwatch | Application monitoring and error tracking |
A few other services handle data in specific cases:
- ElevenLabs, when you add your own ElevenLabs key, works under your own agreement with ElevenLabs.
- Publishing integrations such as Notion, Confluence, GitHub or WordPress receive what you choose to publish to them, under their own terms. See Integrations.
- Map scenes send place names to the Photon geocoder (Komoot, based on OpenStreetMap).
- Google Fonts are loaded by the app, so Google receives your IP address.
Payments go through Lemon Squeezy. Clevera never sees or stores your full card number.
Your content and AI training
Your recordings, uploads and videos are not used to train AI models. The AI providers work under commercial API terms that don't allow training on this data.
Some providers keep API inputs and outputs for up to about 30 days to detect abuse. Video files uploaded to them for analysis are deleted within hours.
Transfers outside the EU
Clevera is operated by Odise Studio in Türkiye, and the providers above process data mainly in the US and EU. Transfers out of the EEA, the UK or Türkiye rely on:
- adequacy decisions, including the EU–US Data Privacy Framework where a provider is certified,
- the EU Standard Contractual Clauses and the UK Addendum,
- the standard contracts required by Türkiye's data protection law (KVKK).
Data is encrypted in transit (TLS), files are encrypted at rest by the storage provider, and private media is served through signed links that expire, usually within 24 hours.
How long data is kept
| Data | Kept for |
|---|---|
| Your recordings, videos and articles | While your account is active, or until you delete them |
| Items in the trash | 7 days, then permanently deleted |
| Recordings not used in any video | 15 days, then deleted |
| Video files sent to AI providers for analysis | A few hours |
| Saved Record with AI browser sign-ins | Until 30 days without use, until you remove them, or until you delete your account |
| Support attachments | 2 years |
| Application logs | About 14–30 days |
| Sign-in and security records | 12 months |
| Database backups | 7 days |
| Invoices and billing records | As long as tax and accounting law requires |
When you delete your account, your subscription is cancelled, tokens and saved sign-ins are revoked, and the workspaces you own are permanently deleted with their content shortly after.
Who controls your data
- For your account, billing and usage data, Clevera is the controller.
- For your content (recordings, uploads, website captures and the videos, articles and audio you make), Clevera is a processor and follows the instructions of the workspace owner. If your employer gave you access, your employer controls the content in that workspace.
Clevera follows the EU GDPR, the UK GDPR, Türkiye's KVKK and the California CCPA/CPRA. SOC 2 and ISO 27001 aren't held yet; certification is planned for 2027.
Questions and requests
Email [email protected] to:
- request the Data Processing Addendum (DPA) or the current sub-processor list,
- access, correct, export or delete your personal data,
- ask anything about privacy or security.
We usually reply within one month, and we may ask you to confirm your identity first.