Privacy Notice

Clausery is operated by Hiirepadi OÜ (registry code 11951709), a private limited company registered in Estonia, with its registered address at Wismari tn 22, Kesklinna linnaosa, 10136 Tallinn, Estonia. In this notice "we", "us" and "our" mean that company. Where this notice says we are the controller of personal data, it is that company that decides why and how the data is processed, and that company you may hold to the obligations described here.

We have not appointed a Data Protection Officer. We are not a public authority, our core activities do not consist of large-scale monitoring of individuals, and we do not process special categories of data at scale, so Article 37 does not require one. Questions, requests and complaints about personal data go to privacy@clausery.ai, which is read by the people who can act on them.

This notice explains what we do with personal data, on what legal basis, who else sees it, how long we keep it, and what you can require of us. It is written to be read rather than to be survived; if any part of it is unclear, write to us and we will explain it in plain terms.

It covers three groups of people. First, visitors to our website. Second, people at businesses we contact about Clausery, including people whose details we obtained from somewhere other than themselves — section 4 is addressed to you specifically. Third, people who use Clausery because the organization they work for has an account with us.

For the first two groups, and for the account data of the third, we are the controller. For the document content that a customer organization creates or uploads inside its workspace, that organization is the controller and we act as its processor: we hold and process that content on its instructions, and we do not decide what goes into it. If you are an employee of a customer and your question is about what your employer has written about you in a policy document, your employer is the right place to ask, and we will support them in answering you.

Nothing in this notice reduces rights you have under the GDPR. Where our description of a practice and the law disagree, the law governs.

You can read every public page of our website without accepting anything. We set no analytics or advertising cookies until you have actively accepted them. Before you decide, our analytics provider runs in a consent-denied mode in which it sets no cookies and receives only anonymous, aggregated measurement signals; we also instruct it to truncate IP addresses. If you decline, we additionally delete any analytics cookies already present in your browser.

The cookies we set ourselves are these. A session cookie keeps you signed in and expires after 24 hours of inactivity; it is HTTP-only, so page scripts cannot read it. A cookie named "clausery_org" remembers which organization you are currently working in, lasts one year, and is HTTP-only. A cookie named "clausery_consent" records only whether you accepted or declined analytics, lasts one year, and must be readable by the page in order to do its job. If you accept analytics, Google then sets its own measurement cookies under names beginning "_ga" and "_gcl".

We use Google Analytics to understand which pages are useful, and on our public marketing pages only, Google's advertising measurement to see which campaigns lead to a sign-up. Neither runs inside a customer workspace as an advertising destination. Where we send an identifier for a signed-in person or their organization, it is a keyed hash, not your email address, name or an identifier you could be looked up by; we never send document content, names or email addresses to Google.

You can change your analytics choice at any time using "Cookie preferences" in the footer of any public page. Separately, an administrator of a customer organization can switch Google Analytics off for everyone working in that organization, regardless of each person's own choice. To be straightforward about the limit of that switch: it turns off Google. It does not turn off the cookieless, aggregate traffic and page-performance telemetry we run to keep the service reliable, which sets no cookies, carries no identifier and records no content.

We contact people at businesses we believe have a professional need for compliance documentation tooling. If you received an email from us and never gave us your details, this section is the notice the law requires us to give you, and you are reading it at the first point of contact, which is when it is due.

The personal data we hold about you in that case is limited to business contact and role information: your name, your job title or role, your business email address, the organization you work for, and where relevant a short note of why we thought Clausery was relevant to that organization. We do not build a profile of you, we do not buy behavioural data about you, and we do not hold anything about your private life.

We obtained it from one or more of the following sources: public business registers and regulators' public registers; the published contact and team pages of your organization's own website; publicly visible profiles on professional networking platforms; and our own manual research combining those. All of these are sources that were accessible to the public at the time we consulted them. We did not purchase a contact list.

Our legal basis is our legitimate interests under Article 6(1)(f): promoting a business-to-business compliance tool to organizations that plausibly need one, using professional contact details, in a business context. We considered your interests before relying on this. We keep the volume low and the content specific, we approach you in your professional capacity only, we do not use sensitive data, and we make stopping trivial — see the next section. If you tell us we have the balance wrong, we will stop, and we will not ask you to justify it.

We keep this data for 24 months from our last meaningful contact with you, after which it is deleted automatically. If you ask us to stop, we delete your details immediately, apart from the minimum record needed to ensure we do not contact you again.

Two processors see this data on our instructions: a specialist email outreach platform, which holds the contact list and sends the messages, and our transactional email provider. Both are bound to use it only for us. We do not sell it, share it for anyone else's marketing, or pass it to data brokers.

You have an absolute right to object to us using your personal data for direct marketing. This is not a request we weigh against our own interests: if you object, we must stop, and we will.

To exercise it, reply to any email we send you with the word "stop" — that is enough, you do not need to explain — or write to privacy@clausery.ai. We will stop contacting you and delete your details, keeping only the minimum record required to make sure we do not contact you again. We do not require you to create an account, click through a preference centre, or confirm anything twice.

You also have the right to object to other processing we carry out on the basis of legitimate interests, on grounds relating to your particular situation. Those objections we do assess, and we will tell you the outcome and our reasons.

If you send us an enquiry through the contact form on our website, we collect your name, your email address, optionally your organization's name, optionally whatever you choose to write in the message field, and the two answers you give about your compliance framework and the number of policies you hold. We use it to answer you and to understand what prospective customers need. The legal basis is our legitimate interest in responding to a person who has asked us to.

If you create an account yourself, we collect your name, your email address, a password and optionally your organization's name, and we create a workspace for you. The legal basis is the steps necessary to provide a service you asked for. We send you an email with a link confirming you control the address; until you use it, some features stay closed, because an operator should never be reviewing an unreachable address.

On both of those forms we record the IP address the request came from, solely as the key of a counter that limits how many submissions one source can make in an hour. It is never used to identify you or to make a decision about you, it is not combined with anything else, and the counter rows are cleared on a rolling basis. Both forms also carry a hidden field that automated submissions tend to fill in and people do not; when it is filled in, we accept the request and store nothing.

Enquiry data is kept for 24 months and then deleted automatically. If your enquiry turns into an account, the account data is governed by the next section instead.

To give you an account we hold your name, your email address, your job title where you or an administrator provide one, the role and permissions you hold in each organization you belong to, and the dates your account was created and last used to sign in. If you set up two-factor authentication we also hold the secret your authenticator app uses, encrypted, and one-way hashes of your recovery codes. Passwords are stored only as a one-way hash; we cannot read yours.

If you sign in with Google or Microsoft, we receive only your email address and your name from them. Where your organization has approved its email domain for automatic joining, a first sign-in can create your account. We do not receive or store your password for those providers, and we request no other profile information.

Because Clausery exists to make compliance documentation provable, some records about your actions are deliberately durable. We record which version of a policy you acknowledged and when, because that acknowledgement is the evidence your employer needs. We record who authored, approved or rejected each version of a document, because a version history that loses its authorship is not an audit trail. We keep an append-only log of privileged administrative actions — role changes, approval routing changes, account deletions — recording who did what and when.

A consequence of that, stated plainly: when your account is deleted you can no longer sign in and you disappear from your organization's user lists, but the record that you authored or approved a particular document version is retained, because deleting it would falsify your employer's compliance history. If you ask us to erase your data, this is the part we will ordinarily need to keep, and we will tell you so and explain why rather than quietly doing it.

The legal basis for this processing is our legitimate interest, and your employer's, in operating a secure and auditable documentation system. Your employer determines who gets an account and what happens to it.

Customer organizations write and upload their own documents — policies, procedures, registers — inside their workspace. That content is theirs. They decide what goes into it, we hold it on their instructions, and we do not review it. If it names people, that is their processing, and they are the controller of it.

Our terms ask customers not to place special categories of personal data, or other sensitive personal information, into document content, and the service is not designed to hold it. We cannot police what is typed into a document, and we do not attempt to.

Customers control the lifetime of their own content. A deleted document goes to a recoverable trash for 30 days and is then destroyed. An organization that leaves can take a complete, restorable archive of its workspace, after which the workspace is scheduled for deletion, goes dark immediately, and is destroyed after 30 days.

We run the service on infrastructure and services provided by others. Each of them acts as our processor, is permitted to use the data only to provide its service to us, and is bound by a data processing agreement. Our hosting and content delivery is provided by Vercel. Our database is provided by Prisma's managed Postgres service. Transactional email — account verification and operator notifications — is sent through Resend. Prospect outreach is sent through a specialist email outreach platform. Website analytics and advertising measurement are provided by Google, only after you accept, and only as described in section 3.

Some features of Clausery use a large language model provided by Anthropic to draft, check and cross-reference document content. When a customer uses one of those features, the material sent to Anthropic can include document titles and body text, the organization's description of its own business, glossary terms and their surrounding sentences, and — when suggesting who should approve a document — the names and job titles of members of that organization. Anthropic processes it to return a suggestion and does not use it to train models. Every such feature only proposes: a person reviews and applies the result, and nothing is written to a document without that step.

We should be straightforward about a limit here: there is currently no per-organization switch to disable the AI features while continuing to use the rest of the service. Whether they are available at all is a deployment-level setting. If that matters to your organization, tell us before you adopt the service.

We do not sell personal data, and we do not share it with anyone for their own purposes.

Some of the providers named above are established outside the EEA, in the United States. Where personal data is transferred to them, the transfer is made under the European Commission's standard contractual clauses, incorporated into each provider's data processing agreement, together with the technical measures described in section 11.

You may ask us for information about the safeguards applying to a specific transfer by writing to privacy@clausery.ai.

Prospect and enquiry data: 24 months from our last meaningful contact, deleted automatically thereafter, or immediately on request.

Documents a customer deletes: 30 days in a recoverable trash, then destroyed. A workspace whose organization has left: 30 days after deletion is scheduled, then destroyed, with a restorable archive provided to the customer first.

Account data: for as long as the account exists. After deletion, the account record is retained in the reduced form described in section 7, so that authorship of past document versions remains attributable.

Administrative audit entries: for the life of the workspace, and destroyed with it. We do not currently set a shorter outer limit on them, because their purpose is to remain available for the period a customer may be audited over.

Cookies: as stated in section 3. Abuse-counter records keyed on an IP address: cleared on a rolling basis, within days.

Passwords are stored only as bcrypt hashes and are never recoverable. Two-factor authentication secrets are encrypted at rest with AES-256-GCM, and one-time recovery codes are stored only as hashes. Sessions can be revoked centrally and are re-checked against the database on every request, so a role change, a password change or an account deletion takes effect immediately rather than when a token expires.

Each customer organization's content is isolated from every other, and that isolation is enforced in the code and verified by an automated test suite that runs against a real database before any change is accepted. Sign-in attempts are rate limited per account and per source. The site is served over HTTPS with strict transport security, and is not permitted to be embedded in another site's frame.

No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, tell you directly.

You may ask us for a copy of the personal data we hold about you, and for it to be corrected if it is wrong. You may ask us to delete it, to restrict what we do with it, or to provide it in a portable form. You may object to processing we carry out on the basis of legitimate interests, and — absolutely, with no balancing — to direct marketing, as set out in section 5. Where we rely on your consent, you may withdraw it at any time without affecting what we did lawfully before.

To exercise any of these, write to privacy@clausery.ai. We will respond within one month. If your request is unusually complex we may extend that by a further two months, and we will tell you within the first month if that happens and why. We do not charge for this.

If your request concerns document content inside a customer organization's workspace rather than data we hold about you as a controller, we will tell you promptly and direct you to that organization, and we will assist them in responding to you.

If you are unhappy with how we have handled your personal data, you may complain to the supervisory authority. Ours is Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, https://www.aki.ee. You may also complain to the authority in the country where you live or work. We would rather you raised it with us first, but you are not required to.

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you. The AI features described in section 9 act on document content and only ever produce suggestions for a person to accept, edit or discard; none of them scores, rates or evaluates an individual.

We update this notice when what we do changes. The date it last changed is shown at the top of the page. If a change materially affects how we use personal data we hold about you, we will tell you directly rather than relying on you to notice, and where the change requires your consent we will ask for it before acting on it.