Privacy Policy

1. Who is responsible

ClarAI is the service described in the Terms of Service. Full legal entity details for the data controller: To be completed by counsel. Until then, the working contact for anything in this policy is hello@scoocs.co.

2. What we collect

Account data: your email address, your name if you provide it, and your password stored as a bcrypt hash (we never store the password itself). If you enable two-factor authentication, the authenticator secret is stored encrypted.

Brand and project data: the website URLs, brand names, competitors, personas, prompts, documents and other content you add to your projects, plus the content of pages we crawl from the websites you ask us to analyse, and the analyses the service produces from them.

Security and usage records: for security-sensitive actions such as signing in, we keep an audit trail that includes your IP address and browser user agent. These records are kept for a limited period and then purged automatically.

Consent records: when you create an account we record the time you accepted the Terms of Service and Privacy Policy and which version you accepted.

Product and website analytics: we record which pages of our own website are viewed and which actions are taken on them, such as running the free grader or starting a signup. These records hold a randomly generated visitor identifier, the page path with any query string removed, the referring site, and any campaign tags on the link you arrived through. We do not store your IP address, only a one-way hashed form of it used to filter out bots, and we do not store your browser user agent. This data is collected by ClarAI itself and is not shared with any third-party analytics provider. If your browser sends a Do Not Track or Global Privacy Control signal we collect none of it at all, and you can opt out at any time from your browser storage.

3. How we use it

We use your data to run the service: to analyse how your brand appears in AI-generated answers, to generate the reports, drafts and recommendations you ask for, to operate your account, and to keep the service secure.

We do not sell your data, and we do not use it for third-party advertising.

4. Third-party AI providers

Producing the analyses requires sending parts of your project data to third-party AI providers. Depending on which features you use, this includes Anthropic (Claude), OpenAI (ChatGPT), and Google (Gemini). What they receive is the material needed for the specific analysis: for example your brand name, website content samples, monitoring prompts, and documents you upload for signal extraction.

Some features also use supporting services: SerpAPI for search results, Reddit's public interfaces for community discovery, and Google services such as PageSpeed Insights for site audits. These receive search queries, brand names and page URLs rather than your account data.

We keep an internal engineering record of every third party that data is sent to, and a customer-facing subprocessor list will be published with the counsel-approved version of this policy. If you need the details before then, email us and we will share what we can.

5. Payments

Paid subscriptions, where offered, are processed by Stripe. Your card details go directly to Stripe; we do not receive or store them. We store the subscription state Stripe reports back to us (for example whether your subscription is active).

6. Integrations you connect

If you connect your own accounts (for example Slack, WordPress, Notion, HubSpot, LinkedIn or Reddit), data flows to those services only because you connected them, using your own tokens, and only for the feature you connected them for. You can disconnect them at any time from the Integrations page.

7. Where data is processed

Some of our providers process or store data in the United States. Anthropic, for example, states that data is stored in the US. The formal transfer mechanisms for data leaving the European Economic Area: To be completed by counsel.

8. How long we keep it

Your account and project data are kept while your account exists. Security audit records are purged automatically after a limited retention period. Detailed per-category retention schedules: To be completed by counsel.

9. Deleting your data

You can delete your account yourself from your account settings. This is a hard delete: your account and the projects you own are permanently removed, not just deactivated. A minimal security audit record of the deletion itself is retained.

You can also delete individual projects at any time, and you can ask us at hello@scoocs.co to help with any deletion request.

10. Security

Passwords are stored as bcrypt hashes. Two-factor authentication secrets and integration tokens are encrypted at rest. Security-sensitive endpoints are rate-limited and audited. No system is perfectly secure, and we will be honest with you if something goes wrong that affects your data.

11. Your rights

Depending on where you live, you may have legal rights over your personal data, such as access, correction, deletion and portability. The account deletion and project deletion controls above cover the most important of these directly. For anything else, email hello@scoocs.co and we will handle it with you. The formal statement of legal bases and rights procedures: To be completed by counsel.

12. Changes to this policy

This is a preliminary version. It will be replaced by a counsel-approved version, and the version identifier below will change when that happens. If a future change materially affects how your data is handled, we will tell you.

13. Contact

Questions about privacy or your data: hello@scoocs.co. A human reads it.