Cleotic privacy & data

For data about our customers and their users, visitors to our website, people who use our free tools, and people we talk to about sales, we decide how the data is used. We are its controller, and this policy applies in full.

Name, email address, organisation, role, when you were last active, and sign-in records

Website address, email address, time zone, the page you arrived on, the referring page and campaign tags.

Name, email address, plan, subscription and invoices, and what you enter on Stripe’s payment page. We never see card details.

approximate location from your IP address

Pages you open and what you click or do, linked to your name, email address and organisation

Pages viewed, clicks and scrolls, the referring page, device and browser, and approximate location from your IP address.

Prompts, brand facts, drafts, AI answers and Search Console queries can name people, such as a company’s founder.

Names and email addresses of authorised users, sign-in records, and access to connected Google accounts

Recipients’ email addresses and names, and the email contents

Usage events and page addresses; the name and email address of each signed-in user, and their organisation’s name and plan; errors; and session recordings that mask all text and inputs

Each request it carries, including the sender’s IP address, user agent and other headers, and what the request contains

Run your account

Import Google Search Console data, if an admin connects a Google account

Take payment and keep accounts

Send emails about your account and the service

Send marketing emails, if you turned them on

Understand how the app is used, and find and fix problems

Keep Cleotic secure and prevent abuse

Hosts the application and its data

Routes requests to AI models from OpenAI, Anthropic, Google, Perplexity, xAI and others

Product analytics and session recordings in the web app

Sends weekly emails, scan results, account emails and the reports customers send

Until the organisation’s owner deletes it, or 60 days after its subscription or trial ends.

The last 16 months of daily totals and the last 90 days of search queries. Older days are deleted every day.

We clear it 90 days after we receive it.

Billing records 7 years, as UAE tax law requires

Free tool checks, with the email and IP address given 12 months, then the check, email address and IP address are deleted

Demo requests (HubSpot) 2 years after our last contact

Support emails 7 years after the last message

Server logs 30 days

DataForSEO’s terms set no time limit for deleting the prompt text we send it.

TypeSafe may keep and reuse what it derives from them; see below.

Our application and database are hosted in the Netherlands.

We are based in the UAE.

Netherlands (Amsterdam)

US, UK and India. Each request runs in the region nearest the user.

US. Each request passes through its data centre nearest the sender, worldwide.

Estonia (an EU company; it does not publish where its servers are)

France (Paris), with some of its own sub-processors in the US

EU (Frankfurt, Germany)

Stripe, HubSpot, Google, Reddit, X and GitHub : the Data Privacy Framework, and the Standard Contractual Clauses with the UK Addendum.

Microsoft : the Data Privacy Framework with its UK Extension, and the Standard Contractual Clauses.

ClickTerm : none needed. It is an EU company and keeps the data in the EU.

the EU-US Data Privacy Framework (DPF)

the European Commission’s Standard Contractual Clauses (SCCs) with the UK Addendum or the UK International Data Transfer Agreement (IDTA)

Our sub-processors page lists them, with what each receives.

We use it only to provide Cleotic to them, under our Data Processing Agreement.

To see, correct or delete your data, email privacy@cleotic.ai.

get a copy of the personal data we hold about you

have it corrected

have it deleted

have its use restricted

get it in a machine-readable format, or have it sent to another company

object to how we use it when we rely on legitimate interests, and to direct marketing at any time

withdraw your consent at any time, without affecting what we did before

complain to a data protection authority

We do not sell personal data.