Turbosurge ⚡ · Legal
Effective date: 23 August 2026 · Last updated: 23 August 2026 · Version 1.0
This policy covers Turbosurge, the AI ad-generation product operated by ClipSpeedAI. It explains, feature by feature, what data Turbosurge collects, where that data physically lives, how long we keep it, who else touches it, and how to get it back or get rid of it. It is written to be read, not to be survived.
ClipSpeedAI ("ClipSpeedAI", "we", "us", "our") is the controller of the personal information described in this policy. ClipSpeedAI was founded by Kyle White and is operated from Florida, United States. Turbosurge is one of our products; ClipSpeedAI's video-clipping product is another.
| Controller | ClipSpeedAI · founded by Kyle White · operated from Florida, USA |
|---|---|
| Product | Turbosurge ⚡ — clipspeed.ai/surge.html |
| General support | support@turbosurge.ai |
| Privacy & data rights | privacy@clipspeed.ai |
| Security disclosure | support@turbosurge.ai with "Security disclosure" in the subject |
This policy applies to the Turbosurge product: the marketing page at /surge.html, the Turbosurge application, Turbosurge demo links, the Turbosurge API, and Turbosurge emails.
ClipSpeedAI's video-clipping product is governed by a separate policy: clipspeed.ai/privacy.html. That policy covers the part of ClipSpeedAI that connects to your YouTube, TikTok, Instagram, X and LinkedIn accounts and holds the resulting access tokens. Turbosurge uses those connections to publish, but does not create or store them — so token handling, and how to revoke a connection, live in that policy and are cross-referenced here rather than restated. See Section 7.
If you use both products with one account, both policies apply to their respective features. Where this policy and the ClipSpeedAI policy differ about a Turbosurge feature, this policy governs.
This policy sits alongside our Terms of Service, which govern your use of Turbosurge. Defined terms have the same meaning in both documents.
| Term | Meaning |
|---|---|
| Turbosurge | The AI ad-generation product described in this policy. |
| Brand Profile | The structured description of your business that Turbosurge derives from scanning the website URL you paste — what you sell, who you sell to, your tone, your positioning, your competitors. |
| Ad | A generated creative — a meme ad, slideshow, creator-style post or wall-of-text card — produced by Turbosurge for you. |
| Swipe | Your keep-or-kill judgement on a single Ad: right means you would post it, left means you would not. |
| Library | The store of media files you upload to Turbosurge, plus the Ads you have generated. |
| AI Studio | The Turbosurge surface where you type a prompt and receive a generated image. |
| AI Character | A persistent synthetic person you create in Turbosurge and reuse across Ads. Also referred to in the product as an "AI influencer". |
| Trending Feed | The corpus of publicly posted third-party social content Turbosurge analyses to understand what formats are working. See Section 6. |
| Calendar | The Turbosurge schedule of Ads you have queued to go out, each with a platform, a date and a time. |
| Connected Account | A social account you have linked to ClipSpeedAI. Turbosurge publishes through these; it does not create them. See Section 7. |
| Demo Link | A signed, time-limited link that lets a prospective customer try Turbosurge without creating an account. |
| Credits | The internal unit consumed by generation actions in AI Studio and AI Characters. |
Most privacy policies open with a page-long list of everything a company could conceivably collect. That style is legally safe and practically useless — it tells you nothing about what actually happens when you press a button. So this section is organised by feature. If a feature is not listed, it does not collect anything beyond the server logs in 4.13.
A Turbosurge account is a ClipSpeedAI account. When you sign up — by email, or with "Sign in with Google" — we receive and store your email address and, if your provider supplies it, your name. We never receive or store your password for Google or any other identity provider.
Signing in with Google is an authentication step. It does not connect a YouTube channel to Turbosurge, and it grants Turbosurge no access to your Google data beyond your basic profile.
The core Turbosurge action is pasting your website URL. When you do, our server fetches your site from our own infrastructure — not from your browser — and reads it:
Website assets. When you ask Turbosurge to analyse your website, Turbosurge reads the page and identifies publicly accessible images it declares, such as logos, product photography, and location photography. Turbosurge records metadata about those images, including their source URL, dimensions, format, content hash, and any description your site provides. Turbosurge does not currently copy or store the image files in your account, and does not currently use those images to generate ads. These metadata records remain associated with your account and are not sold, licensed to advertisers, or used to train AI models.
That text is analysed into a Brand Profile: your business summary, offer, audience, tone, keywords, calls to action, angles, identified gaps (social proof, urgency, founder story, and so on), positioning, voice do's and don'ts, segments and competitors. If you edit any of it, your edits are stored alongside the derived values.
Where it is stored: a single row keyed to your user ID in our Supabase Postgres database (US region), in the table blitz_brand_profiles — columns user_id, url, profile (JSON), updated_at.
What leaves our systems: the extracted page text is sent to one AI provider — Anthropic or OpenAI, whichever is configured — to perform the analysis. It is sent for inference only. See Section 5.
Only fetch the URL of a site you are entitled to have analysed. Our fetcher identifies itself as ClipSpeedAI-Surge/1.0, obeys a request timeout, and is restricted so it cannot be pointed at private or internal network addresses.
Every keep-or-kill judgement you make is recorded as one row in the table blitz_swipes. The row holds:
right or left, and the card's position in the session (1 to 20), so we can see where attention drops off.We do not store your IP address or your browser user-agent on this path. That table is readable only by our server; it is not exposed to any client, including yours.
What we do with swipes is described in Section 5.3. In short: your swipes change which ads Turbosurge shows you next — that is the point of swiping — and no model is trained on them.
You can upload JPEG, PNG, WebP images and MP4 video to your Library, between 1 KB and 40 MB per file, up to 200 files. We verify the real file type from the file's own bytes rather than trusting its name or the type your browser declares.
Where it is stored: Cloudflare R2 object storage, under a key of the form blitz/media/<your user id>/<random>.<ext>, served from cdn.clipspeed.ai. The index entry — the file's name (which defaults to your original filename), type, size, storage key and URL — is stored in your Brand Profile row.
Please read this before uploading anything sensitive. Files in the Library and in AI Studio are stored at long, randomly generated, unguessable URLs, and they are not individually access-controlled. They are not listed anywhere, not indexed, and not discoverable by browsing — but anyone who has the exact URL can open the file without signing in. Treat a Turbosurge file URL like a password. Do not upload material you would be unwilling to have viewed by someone holding that link.
When you generate an image in AI Studio we store, in your Brand Profile row: the prompt you typed, the full assembled prompt our template produced from it, the template and model used, the aspect ratio, quality, dimensions, file size, generation time, and the resulting image's storage key and URL. The image itself goes to Cloudflare R2 under assets/<your user id>/surge_studio/.
Your typed prompt is retained verbatim. If you would not want a prompt kept, do not type it. AI Studio does not accept reference-image input, and Turbosurge has no video generation.
The most recent 60 generations are kept in your generation history; older entries fall off the list automatically.
This is the most sensitive thing Turbosurge does, so it gets its own explicit treatment.
An AI Character is a base image plus a short written description. We store: a name you choose, the descriptors you enter (gender, age, ethnicity, free-text details), the assembled prompt, the model used, the credits spent, the character's base image URL and storage key, timestamps, and — where relevant — the time you confirmed you hold the rights to the image.
We say this plainly because "AI avatar" products frequently do the opposite, and because biometric identifiers are separately regulated in several US states. Under those statutes, Turbosurge does not collect biometric information.
Turbosurge lets you upload a portrait as a character's base image. If you do:
You may hold up to 50 characters. Deleting a character removes it from your account and removes its image from our object storage.
Turbosurge has a Calendar. Until 23 August 2026 that Calendar was only a plan, and Turbosurge published nothing. It now publishes. When an item you scheduled comes due, Turbosurge sends the finished ad out to the platform you chose.
This is the part to be precise about, because it determines who holds what.
When you schedule a post, Turbosurge sends it to a platform using a social account you have already connected to ClipSpeedAI. Turbosurge itself does not ask you for, run a login flow for, or separately store social platform credentials — those are held and revocable through your ClipSpeedAI connections.
Concretely: there is no Turbosurge-specific credential store and no Turbosurge OAuth screen. Access tokens live in ClipSpeedAI's shared connection layer, encrypted at rest, and are described in the ClipSpeedAI privacy policy. Turbosurge reads that list at the moment of publishing to find which account to post through. If no account is connected for that platform, the post does not go out and the Calendar says so.
Because the connection is ClipSpeedAI's, you revoke it there, and revoking it stops Turbosurge publishing immediately:
You can also stop all Turbosurge publishing account-wide at our end; ask support@turbosurge.ai and we will disable it.
On the Calendar item itself: the status (planned, posting, posted or failed), the number of attempts, the time it was claimed and posted, the platform's post identifier, and — if it failed — the reason, written where you will see it. A post is claimed before the network call so that two overlapping sweeps can never double-post to your audience, and a failure is retried at most three times.
Separately, at the moment a post goes out, we freeze a record of what was posted — the ad's identifier, the creative attributes behind it, the platform and the time. This is our own record of our own generator's output; it contains no audience data.
Turbosurge collects performance figures for the ads it published for you, and it is important to be exact about how narrow that is.
What we retrieve: for each ad Turbosurge itself posted, we periodically ask our publishing transport for that post's view, like and comment counts and its public post URL, and we store those values together with the time we learned them. Nothing is retrieved for a post that Turbosurge did not publish.
The numbers come from the platform, never from us, and we always store when we fetched them, so a zero can be read as either "genuinely zero" or "not synced yet" rather than presented as a confident measurement. These figures are stored in your own account record and are shown only to you.
Payments are processed by Stripe. Card entry happens entirely on Stripe-hosted pages — Stripe Checkout and the Stripe Billing Portal. ClipSpeedAI never receives your card number, expiry, CVC or bank credentials, and we do not even store the last four digits.
What we store on our side is subscription state, in your Brand Profile row: plan, status, trial end date, current period end, your Stripe customer ID, your Stripe subscription ID, trial-consumed and past-due timestamps, whether you have cancelled at period end, and event timestamps.
What we send to Stripe: your email address, a description of the subscription, and your account's internal identifier so a payment can be matched to an account. We handle four Stripe webhook events — subscription created, updated, deleted, and checkout session completed — and persist only the identifiers, plan, status and timestamps above.
Credits are tracked as a ledger in your Brand Profile row: timestamp, signed amount, reason (for example ai_studio_generate), an optional reference string, an idempotency key and the resulting balance. The last 200 entries are retained. No IP address, device or location is recorded per spend. Note that the reference field is caller-supplied free text, so if you use the Turbosurge API, do not place anything sensitive in it.
Turbosurge sends email through Resend. It sends two messages: a welcome email when you finish onboarding, and a receipt when a paid trial starts. Both contain your first name, your website's domain, and your plan details.
Delivery events — delivered, opened, clicked, bounced, complained — are recorded against a send log so we can tell whether our email actually arrives. Yes, that means our emails contain open and click tracking. Every message carries a working unsubscribe link and one-click unsubscribe headers; unsubscribing is recorded on your profile and suppresses future non-essential mail. A hard bounce or spam complaint also suppresses you automatically.
Non-essential email is suppressed between 22:00 and 08:00 US Eastern time. Billing receipts are not.
If you create a Turbosurge API key, we store only a SHA-256 hash of it, plus a display hint showing the first and last few characters, a name you choose, creation time, last-used time, a request counter and a revocation timestamp. The key itself is shown to you exactly once and is unrecoverable afterwards, including by us. No IP address, user-agent or per-request log is retained against a key. Turbosurge API keys are stored separately from ClipSpeedAI's own API keys and share nothing with them.
A Demo Link lets a prospective customer try Turbosurge with no signup. When you use one:
Our hosting provider records standard application logs: request paths, status codes, timing, error traces, and operational lines about swipe and email events. Where a client IP address appears in ClipSpeedAI logging, it is stored as a salted SHA-256 hash rather than in the clear. Logs are retained for up to 30 days.
We also send ourselves operational alerts about subscription changes over Telegram. Those alerts contain internal identifiers — your account UUID and Stripe subscription and price IDs — and no name, email address or content.
This is the question people ask first about any AI product, so it gets a direct answer rather than a defensive one. There are two separate questions hiding inside it — do you train models on my data, and does the product learn from what I do — and most policies collapse them into one sentence. They have different answers here, so they get separate sections.
1. We do not train AI models on your data. Not your website content, not your Brand Profile, not your uploaded media, not your prompts, not your generated Ads, and not your swipes — none of it becomes training data. We do not fine-tune models, we do not build datasets from customer content, and we do not license or sell your content to any AI provider for their training. There is no enterprise-only opt-out, because there is nothing to opt out of.
2. Turbosurge does learn from your swipes, and that is the point of the product. Your keeps and skips change which ads you are shown next. That is arithmetic over your own decisions, not a model absorbing them — Section 5.3 says exactly how far it goes.
Claim 1 is a statement about training and only about training. It is not a claim that we ignore what you do in the product, and it should not be read as one.
Turbosurge calls third-party AI providers to perform inference — one request in, one result out, no state kept on our behalf. We call only standard inference endpoints. We do not call any provider's fine-tuning, training-job, or dataset-upload endpoints.
| Provider | Used for | What it receives |
|---|---|---|
| Anthropic or OpenAI (whichever is configured) | Reading your website into a Brand Profile; writing ad copy, hooks and captions | The extracted text of your site and the working prompt. No account identifier, no email address. |
| Replicate (running FLUX Schnell) | Generating images in AI Studio and base images for AI Characters | Prompt text only — including any descriptors you typed for a character. No images, no account identifier, no email address. An uploaded photograph is never sent. |
These providers' API terms state that data submitted through their APIs is not used to train their models. We rely on those terms, and we would change provider rather than accept a term that permits training on your content. Providers may retain a request briefly for abuse monitoring under their own published policies; we do not have a negotiated zero-retention agreement with them, and we would rather tell you that than imply one.
ClipSpeedAI's separate clipping product uses additional AI providers for transcription and speech. Those are described in the ClipSpeedAI privacy policy and are not used by Turbosurge.
ClipSpeedAI does not train, fine-tune or host a model of its own. There is no in-house model that could learn from you.
Turbosurge learns from your swipes. That is the product, not a side effect. Every keep and every skip tells Turbosurge which ads you would actually post, and Turbosurge uses that to decide what to show you next. A tool that showed you the same deck no matter how you swiped would be a worse tool. Here is exactly how far it goes, in both directions.
Your swipes from the last 7 days are converted to a small numeric score per card type, weighted so recent swipes count more — the weighting halves every three days — and averaged. The result adjusts the mix of card types in your next deck: how many creator-style posts versus memes versus slideshows. The tilt is bounded and never removes a card type entirely, so a run of skips narrows what you see without cutting off a format for good.
Two limits worth stating explicitly, once you have swipe history of your own — see the next section for what happens before you do:
A brand-new account, or one that has not swiped in the last 7 days, has nothing of its own for the tilt above to work from. Rather than falling back to an identical starting mix for every business, Turbosurge can automatically apply a class-mix pattern drawn from other customers' swipe history — first from businesses in your own industry vertical, or failing that, from all verticals pooled together. It only ever applies a pattern that has cleared a statistical bar built specifically so no small number of accounts, let alone one, can be its source:
What is used is a class-mix ratio — how many creator-style posts versus memes versus slideshows tend to perform in that category — never an individual account's swipes, captions or any content, and nothing that could identify which businesses contributed to it. Unlike the human-reviewed process below, this is automatic: no person reviews it before it applies. It is re-evaluated on every deck you are shown, and stops applying as soon as your own account has enough swipe history in the last 7 days to speak for itself — including resuming if you stop swiping for a while and your own recent history thins out again.
Across accounts, we compute yes-rates by format, vertical and emotion arc to learn which kinds of ads business owners will actually post. This is median-lift-by-slice arithmetic with a minimum-sample gate, so a handful of swipes can never overturn a well-evidenced pattern.
Nothing is applied automatically. The output is a report file that a person reads. Where new swipe evidence conflicts with what we already believed and the sample is small, the process is built to hold both and change nothing rather than pick a winner. Any change to how Turbosurge generates ads is a human decision made after reading that report.
Since 24 August 2026, the aggregate learner reads only swipes that have been positively established as customer traffic. Swipes from our own internal and test accounts, swipes from Demo Links, and any swipe whose origin could not be established are all excluded by code — "unknown" never counts as a customer. The classification is written by our server when the swipe is recorded, after any values the browser supplied, so it cannot be spoofed from the client.
No automated decision is made about you that produces a legal or similarly significant effect. Turbosurge decides which ad to show you next; it decides nothing about your eligibility for anything.
If you would rather Turbosurge did not personalise from your swipes at all, you can object — see Section 14.1 — and we will switch it off for your account. You will still get ads; you will just get an unpersonalised mix.
To know what actually performs, Turbosurge analyses a corpus of 4,404 public TikTok posts, harvested on 29 July 2026. If you are a creator whose post is in that corpus, this section is for you.
The corpus was assembled by loading public, logged-out TikTok pages — hashtag pages to discover posts, then each post's own public page. No login, no private content, no scraping of anything behind an access control, and no use of a TikTok API for user data.
| Field | Detail |
|---|---|
| Identity | The post ID, the post URL and the creator's public handle. No real name, no email address, no contact detail. |
| Content | The caption, the on-screen text, the hashtag it was found under, language, duration, and — for roughly half the corpus — a text transcript of the speech in the video. |
| Public metrics | Play, like, comment, share and save counts as displayed publicly, the creator's follower count, and whether the account carries a verification badge. |
| Imagery | For a subset of posts, a single still cover frame, obtained through TikTok's own public oEmbed endpoint and re-hosted on our storage at cdn.clipspeed.ai/surge/trending/tiktok/. We re-host because TikTok's own image links expire. |
We do not download the video. We do not download the audio. One still frame per post is the most we ever copy.
The corpus is used to identify format patterns — which hooks, arcs and structures perform — which then inform the Ads Turbosurge writes for you. It is a reference set, not source material: a third-party post is never re-published as your ad, and its footage is never used in your ad. Where a trending post is shown in the product, it is shown with the creator's handle and a link to their original post.
The corpus is not used to train any model, by us or by anyone else. It never leaves our systems and is never sold, licensed or shared.
If your post is in our corpus and you want it out, email privacy@clipspeed.ai with the post URL or your handle. We will remove every record of that post and delete any cached cover frame from our storage within 10 business days, and confirm to you when it is done. You do not need to give a reason, prove ownership beyond a plausible claim to the handle, or send a formal legal notice.
If you prefer a formal route, a copyright notice to the same address is also honoured under our Terms of Service. Deleting or making your post private on TikTok stops us fetching anything further from it, but does not by itself remove what we already hold — please email us.
Turbosurge publishes to five platforms — TikTok, Instagram, YouTube, X and LinkedIn — when you schedule an ad to go out. The mechanics are in Section 4.7. This section states the boundaries of that, because "it can post for me" and "it has the keys to my accounts" are very different things and the difference matters.
Turbosurge runs no OAuth flow of its own and has no Turbosurge-specific credential store. It publishes through Connected Accounts you have already linked to ClipSpeedAI. The access tokens sit in ClipSpeedAI's shared connection layer, encrypted at rest, shared with the clipping product, and covered by the ClipSpeedAI privacy policy. Disconnecting there stops Turbosurge posting immediately — see Section 4.7 for the three ways to revoke.
Practically, that means Turbosurge cannot obtain access to an account you have not already connected, and cannot retain access to one you have disconnected.
Turbosurge does retrieve view, like and comment counts for the specific ads it posted for you, so the product can tell you what happened to what it sent out. That is the whole extent of it, and Section 4.8 lists what is excluded. Restated as flat negatives:
Publishing can be switched off entirely — there is an operational kill switch on our side, and you can ask support@turbosurge.ai to disable it for your account.
| Purpose | Data involved | GDPR lawful basis |
|---|---|---|
| Generating ads for you | Brand Profile, uploads, prompts, characters | Performance of a contract |
| Running your account and Library | Account data, stored Ads and media | Performance of a contract |
| Publishing a scheduled ad | The ad file and caption, and the Connected Account you chose | Performance of a contract, at your instruction |
| Reporting what happened to a published ad | View, like and comment counts for that post | Performance of a contract |
| Taking payment and managing subscriptions | Email, Stripe identifiers, subscription state | Performance of a contract |
| Sending billing and service email | Email address, name, plan | Performance of a contract |
| Sending the onboarding welcome email | Email address, name, website domain | Legitimate interests, with unsubscribe available |
| Personalising your ad mix from your swipes | Your own swipes, last 7 days | Legitimate interests — you may object, see 14.1 |
| Improving formats across the product | Aggregated swipe outcomes, customer traffic only | Legitimate interests |
| Preventing abuse, fraud and credit farming | Account data, usage counters, hashed IPs | Legitimate interests |
| Keeping tax and transaction records | Stripe records | Legal obligation |
| Responding to legal process | Whatever is lawfully compelled | Legal obligation |
Where we rely on legitimate interests, we have considered your interests and rights, and you can object at any time by emailing privacy@clipspeed.ai.
We do not share your personal information with anyone except the service providers below, each acting on our instructions under their standard data-processing terms, plus the narrow legal cases that follow. Naming them is deliberate: a policy that says "trusted third-party partners" is telling you nothing.
| Subprocessor | Purpose | Data it receives | Location |
|---|---|---|---|
| Supabase | Postgres database and authentication | Account data, Brand Profiles, swipes, credit and subscription records | United States |
| Railway | Application hosting and compute | All data in transit through the application; application logs | United States |
| Cloudflare (R2 + CDN) | Object storage and content delivery | Uploaded media, generated images, character images, cached trending cover frames | United States, delivered from a global edge network |
| Stripe | Payments and subscription billing | Email address, account identifier, plan; card details entered directly with Stripe | United States |
| Resend | Transactional email delivery | Email address, name, website domain, message content, delivery and open events | United States |
| Anthropic or OpenAI | Text analysis and ad copywriting | Extracted website text and prompt text. No account identifier or email address | United States |
| Replicate | Image generation | Prompt text only. No images, no account identifier, no email address | United States |
| Post for Me | Publishing transport for scheduled ads, and retrieving that post's counts | The ad file, its caption, the Connected Account identifier for the platform you chose; returns the delivery outcome and the post's view, like and comment counts | United States |
| Telegram | Internal operational alerts | Internal account UUID and Stripe subscription and price IDs only — no name, email or content | Global |
Social platforms are not subprocessors. When you schedule an ad, TikTok, Instagram, YouTube, X or LinkedIn receives your ad and caption at your instruction and handles it as an independent controller under its own privacy policy and terms — not on our behalf. We send only to the single platform you chose.
We will also disclose information in three other circumstances: legal process (a valid subpoena, court order or lawful request — we will resist requests that are overbroad and notify you unless legally prohibited); protecting rights and safety (investigating fraud, abuse or a threat to someone); and a business transfer (if ClipSpeedAI is acquired or merged, your information may transfer, and we will notify you by email with enough notice to delete your account first).
When we add or replace a subprocessor that handles personal information, we will update this table and note the change in Section 18.
Because we do not sell or share, there is no opt-out for you to exercise. We still honour Global Privacy Control signals as an opt-out request, and we would rather receive one and have nothing to do than argue about it.
"For as long as reasonably necessary" is not a retention period. Here are ours.
| Data | Retention |
|---|---|
| Account record (email, name) | While your account is open; deleted within 30 days of account deletion |
| Brand Profile and your edits to it | Until you overwrite it, or within 30 days of account deletion |
| Uploaded media in the Library | Until you delete the file, or within 30 days of account deletion |
| Generated Ads and AI Studio images | Until you delete them; generation history keeps the most recent 60 entries; otherwise within 30 days of account deletion |
| AI Characters, including any uploaded base image | Until you delete the character, or within 30 days of account deletion |
| Calendar items, including publish status, attempts and failure reasons | Until you delete the item, or within 30 days of account deletion |
| Record of what was posted (ad identifier, creative attributes, platform, time) | Until account deletion. Contains no audience data |
| View, like and comment counts for ads Turbosurge published | Until you delete the Calendar item, or within 30 days of account deletion |
| Credit ledger | Most recent 200 entries; deleted with the account |
| API keys (hashes) | Until revoked or the account is deleted; a revoked key's hash is kept 90 days for abuse investigation |
| Swipes tied to an account | 24 months from the swipe, then deleted or irreversibly de-identified |
| Swipes from a Demo Link (no account) | 24 months from the swipe; the link itself expires in 14 days by default and 60 days at most |
| Demo scan results | Held in memory for about 15 minutes, never written to the database |
| Email send and delivery logs | 90 days |
| Unsubscribe and suppression records | Kept indefinitely — that is the only way to keep honouring your opt-out |
| Application and server logs | 30 days |
| Billing and tax records held by us and by Stripe | 7 years, as US tax law requires. These hold transaction records, not your content |
| Third-party trending corpus | Until superseded by a newer harvest, or removed on request within 10 business days (see Section 6.4) |
Two honest caveats. First, files are delivered through a CDN with long cache lifetimes, so a copy of a deleted file may briefly remain in an edge cache after the original is removed; it is unreachable from the product and expires on its own. Second, encrypted backups roll on their own schedule, so deleted data can persist in a backup for up to 30 days before the backup itself expires. We do not restore deleted records from backup.
You can delete at four levels, and each is real deletion rather than hiding.
If you cannot delete something through the product, email us and we will do it within 30 days and tell you when it is done.
One thing we cannot delete: an ad that has already been published. Once Turbosurge has posted an ad to TikTok, Instagram, YouTube, X or LinkedIn at your instruction, that post lives on that platform under your account. Deleting it from Turbosurge removes our copy and our records; it does not remove the post. You take it down on the platform itself, and the platform's own retention policy governs what happens after that.
We would rather describe controls that exist than list controls that sound impressive. Here is what is actually in place.
We are not SOC 2 certified, not ISO 27001 certified, and have not commissioned a third-party penetration test. Tenant isolation is enforced in application code rather than by database row-level security. We do not hold negotiated zero-retention agreements with our AI providers. We would rather you know that than infer otherwise from a policy that stays silent.
If personal information is disclosed without authorisation, we will notify affected users by email within 72 hours of confirming the incident, describe what happened and what data was involved, and notify supervisory authorities where the law requires it.
If you have found a vulnerability, email support@turbosurge.ai with "Security disclosure" in the subject line, and it will be routed to the founder. We will acknowledge within 5 business days. We will not pursue legal action against researchers who act in good faith, test only against their own accounts, avoid privacy violations and service degradation, and give us reasonable time to fix the issue before publishing.
No system is perfectly secure, and we will not pretend otherwise. Use a strong, unique password, and tell us immediately if you think your account has been accessed by someone else.
We do not gate privacy rights by geography. Every Turbosurge user may:
Email privacy@clipspeed.ai from the address on your account, or from any address if you tell us which account you mean. We verify identity by confirming control of the account email; for a sensitive request we may ask one additional question that only the account holder could answer. We do not require an ID document.
| Stage | Our commitment |
|---|---|
| Acknowledgement | Within 10 business days |
| Substantive response | Within 30 days (US state laws generally allow 45; we hold ourselves to 30) |
| Extension | Once, by up to 45 further days for a genuinely complex request, with reasons given in writing before the first deadline |
| Cost | Free, unless a request is manifestly unfounded or repetitive |
| Appeal | If we refuse, we will tell you why and how to appeal. Email privacy@clipspeed.ai with "Appeal" in the subject; we respond within 45 days |
You may use an authorised agent where the law allows, with written authorisation we can verify.
California residents have the rights to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and be free from retaliation.
We do not sell or share personal information, so the opt-out right has nothing to act on. We do not collect sensitive personal information as the CPRA defines it — no government identifiers, no precise geolocation, no biometric identifiers, no account credentials for other services, no contents of your private communications — so the right to limit its use likewise has nothing to act on.
Categories collected in the last twelve months, in CCPA's own vocabulary: identifiers (email, name, account and Stripe IDs); commercial information (subscription and credit records); internet activity (usage and swipe records within Turbosurge, and the view, like and comment counts of ads Turbosurge published for you); professional information (your business, from the website you asked us to scan); inferences (your Brand Profile and your ad-format preference); and visual information (media you upload). Each is collected for the business purposes in Section 8, disclosed only to the subprocessors in Section 9 (plus the one social platform you instruct us to post to), and retained per Section 11. We collect no personal information from sources other than you, your website at your instruction, our own service, and the per-post counts a platform returns for an ad we published for you.
ClipSpeedAI is operated from Florida. The Florida Digital Bill of Rights applies to controllers above revenue thresholds we do not meet, so we are not currently a covered "controller" under it. We nevertheless extend its substantive rights — access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling — to Florida residents on the same terms as everyone else in Section 14.1. Being small is not a reason to give you fewer rights.
The same applies to the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with similar statutes: we may fall below their applicability thresholds, and we extend their core rights to you regardless. Colorado and Connecticut residents may appeal a refusal as described above and may contact their state Attorney General if unsatisfied.
If you are in the EEA, the UK or Switzerland, the GDPR or UK GDPR applies to our processing of your personal data. Our lawful bases are set out in the table in Section 8. In addition to the rights in 14.1 you may:
We are not established in the EEA or UK and have not appointed an Article 27 representative. Direct all data protection enquiries to privacy@clipspeed.ai.
Turbosurge is operated from the United States, and your information is stored and processed in the United States. If you use Turbosurge from outside the US, your data will be transferred there.
For transfers of personal data from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses as incorporated into our agreements with the subprocessors in Section 9, together with the UK International Data Transfer Addendum for UK transfers. We keep the data we transfer to the minimum each provider needs — notably, our AI providers receive prompt and website text without any account identifier or email address attached.
One transfer is directed by you rather than by us: when you schedule an ad, it is sent to the social platform you selected, which may process it anywhere it operates, under its own privacy policy. That transfer happens on your instruction and we cannot place safeguards on the platform's own handling of it.
You may request further detail about the safeguards applying to a specific transfer by emailing privacy@clipspeed.ai.
Turbosurge is for adults. You must be at least 18 years old to use it, consistent with our Terms of Service. Turbosurge is a business advertising tool; it is not directed to children, we do not knowingly collect personal information from anyone under 18, and we run no service that would be attractive to a child.
If we learn that an account belongs to someone under 18, we will close it and delete the associated data. If you believe a child has given us information, email privacy@clipspeed.ai and we will delete it promptly.
Separately and importantly: never upload an image of a minor to Turbosurge, and never create an AI Character intended to depict one. Our Terms prohibit it and we will terminate accounts that do it.
Turbosurge is unusually light here, so this appendix is short and complete rather than hedged.
| Category | What Turbosurge uses | Purpose | Lifetime |
|---|---|---|---|
| Strictly necessary | Browser local storage entry holding your session token | Keeps you signed in between page loads. Turbosurge does not work without it | Until you sign out or clear browser storage |
| Strictly necessary | A browser-generated session identifier attached to swipe records | Groups the swipes of one sitting so drop-off can be measured | The current session |
| Strictly necessary | Cloudflare security cookies | Bot and abuse protection in front of our servers | Set by Cloudflare, typically up to 30 days |
| Strictly necessary | Stripe cookies, on Stripe's own checkout pages | Fraud prevention during payment. Governed by Stripe's privacy policy | Set by Stripe |
| Functional | Local storage entries for interface preferences | Remembering your view and filter choices | Until cleared |
| Analytics | None | Turbosurge loads no product-analytics script, no session replay and no heatmap tool | — |
| Advertising | None | Turbosurge loads no advertising pixel and no cross-site tracker | — |
Two things to be precise about. Our Turbosurge emails include open and click tracking, described in Section 4.10 — the unsubscribe link removes you from those messages entirely. And ClipSpeedAI's wider marketing website has consent-gated advertising and analytics tools of its own; if you reach Turbosurge through one of those pages, the ClipSpeedAI privacy policy describes them and its consent banner controls them. Nothing loads on those pages before you accept.
Because Turbosurge sets nothing that requires consent, there is no cookie banner on the Turbosurge product itself. Your browser's Do Not Track and Global Privacy Control signals are respected by default, since there is nothing to switch off.
We will update this policy as Turbosurge changes. When a change materially affects your rights or how we handle your data — a new subprocessor, a new category of data, a shorter retention period, a change to Section 5 — we will:
We will never make a retroactive change to how we treat data you have already given us without asking you first. In particular, if we ever wished to use customer data for model training — we do not intend to — that would require your affirmative, specific opt-in, not a policy update.
| Privacy, data rights, removal requests | privacy@clipspeed.ai |
|---|---|
| General support | support@turbosurge.ai |
| Security vulnerabilities | support@turbosurge.ai — put "Security disclosure" in the subject |
| Postal | ClipSpeedAI, Florida, United States — full address supplied on request to privacy@clipspeed.ai |
A real person reads these. If something in this policy is unclear, or you think it is wrong about what we actually do, tell us — we would rather correct it than defend it.
This policy is written to comply with the California Consumer Privacy Act as amended by the CPRA, the Florida Digital Bill of Rights, the comprehensive privacy statutes of Virginia, Colorado, Connecticut, Utah and comparable states, the EU General Data Protection Regulation and the UK GDPR. Where any provision conflicts with a law that applies to you, that law governs and the rest of this policy stands. Related documents: Turbosurge Terms of Service · ClipSpeedAI Privacy Policy · ClipSpeedAI Terms of Service.