Privacy Policy

This Privacy Policy explains how Clevertrek processes personal data when you visit our website, create an Account, and use the Service.

Clevertrek is a service operated by Fernando Beneitez Vela-Hidalgo, a sole proprietor under Spanish law, holder of NIF 75794423Q, with registered address at Avenida del Hotel, 1, 15º, 08860 Castelldefels, Barcelona, Spain. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"), and the Spanish Law 34/2002 on Information Society Services and Electronic Commerce ("LSSI-CE") to the extent applicable, the Data Controller of your personal data when you use the Service in your personal capacity is Clevertrek.

When you use the Service on behalf of an organization (for example when you invite members to a Workspace or use Surveys or CRM & Support), Clevertrek may act as a Data Processor for personal data that the organization uploads or otherwise causes to be processed through the Service. In that case, the Data Processing Addendum (DPA) governs that processing.

1. Scope

This Policy applies to:

• the Clevertrek website at the public domain;
• the Clevertrek web application;
• the Clevertrek Chrome extension;
• the Clevertrek Progressive Web App (PWA);
• any APIs and integrations operated by Clevertrek.

It does not apply to third-party websites, services, or platforms linked from or integrated with Clevertrek. Those third parties have their own privacy policies, which we encourage you to review.

If you submitted a form or contacted a business through Clevertrek Surveys or CRM & Support, that business is responsible for your data: see the Privacy notice for people who submit forms.

2. Categories of Personal Data We Process

Depending on how you use the Service, we may process the following categories of personal data:

(a) Account and identity data: name (or pseudonym), username, slug, email address, password (hashed), profile picture, biography, language preferences, time zone.

(b) Authentication data: authentication tokens, password reset tokens, two-factor authentication secrets (where applicable).

(c) Workspace and content data: the names, descriptions, links, notes, comments, tasks, images, attachments, and other content you create or upload to your Workspaces, Visors, Sections, and Groups.

(d) Collaboration data: the identities of users you collaborate with, permissions you grant or receive, mentions, and assignments.

(e) Engagement and interaction data: likes, saves, comments, cross-shares, shortcuts, and similar signals about how you interact with content on the platform, together with the derived engagement scores per URL or content item computed from those signals.

(f) Payment and billing data: plan tier, subscription status, billing address, VAT number (if any), invoices, payment history. Card numbers are not processed or stored by Clevertrek; they are processed directly by Stripe.

(g) Usage and telemetry data: IP address, device type, browser type and version, operating system, pages visited, features used, timestamps, error logs, performance metrics.

(h) Communications data: the content of emails, support tickets, and feedback you send us.

(i) AI Feature data: prompts, inputs, contextual data from your Workspaces, AI-generated outputs, and quota usage.

(j) Cookies and similar identifiers: see the Cookie Policy for details.

(k) Data from connected third-party services: when you connect Google, an MCP Connector, or another integration, we receive only the data within the scopes you authorize.

We do not knowingly process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) and we ask that you do not upload such data into the Service unless strictly necessary for your use case and lawful under the GDPR.

3. Sources of Personal Data

We receive personal data from:

• you, when you register, configure your Account, upload content, or contact us;
• other users, when they invite you, mention you, or share content with you;
• third-party services that you connect (Google, MCP Connectors, etc.);
• Stripe, in the form of billing metadata (not card numbers);
• automated logs generated by your interaction with the Service.

4. Purposes and Legal Bases for Processing (GDPR Article 6)

We process personal data for the following purposes and on the following legal bases:

Where we rely on legitimate interests, you have the right to object — see Section 20.

5. Account and Profile Data

We use your Account and profile data to identify you within the Service, to display your contributions to other users, and to communicate with you. Your username, profile picture, biography, and public Workspaces are visible according to the visibility settings you choose.

6. Workspace, Visor, and Content Data

Your User Content is stored on our infrastructure and processed only as needed to provide the Service to you and to the recipients you choose. Public Workspaces are accessible to anyone with the URL and may be indexed by search engines.

We do not access User Content for any purpose other than (a) operating, securing, and improving the Service, (b) responding to your support requests, (c) complying with applicable law or a valid legal request, or (d) where strictly necessary to investigate suspected violations of these Terms or applicable law.

7. Payment Data (Stripe)

Payments are processed by Stripe Payments Europe, Ltd. When you submit payment details, they are sent directly to Stripe through Stripe's secure forms. Clevertrek never sees or stores full card numbers, CVCs, or full bank-account numbers.

What Clevertrek receives from Stripe and stores: subscription status, plan, last four digits of the card, card brand, country, billing email, billing address, VAT number, and invoice metadata.

Stripe's privacy policy is available at https://stripe.com/privacy.

8. Usage, Telemetry, and Device Data

We automatically collect technical data when you use the Service (IP address, browser, OS, pages, errors). We use this data for security, debugging, capacity planning, fraud detection, and to understand how the Service is used in aggregate.

9. Content Interactions, Engagement Score, and Personalization

Clevertrek records the way you interact with content on the platform — such as likes, saves, comments, cross-shares, shortcuts, and similar engagement signals — to (a) operate the social and collaborative features of the Service, and (b) compute an algorithmic engagement score for each URL, link, Visor, or content item, which Clevertrek then uses internally to rank and personalize the content shown to you and to other users in feeds, walls, search results, discovery surfaces, and recommendations within the Service.

9.1 What we process

For each interaction event, Clevertrek typically stores: your user identifier, the URL or content identifier you interacted with, the type of interaction (e.g., like, save, comment, cross-share, shortcut), a timestamp, and limited contextual metadata (such as the Workspace where the interaction took place).

9.2 How the engagement score is computed

The engagement score for a given URL or content item is computed by a deterministic algorithm that weights different categories of interaction. Different interaction types reflect different strengths of signal: stronger commitments (such as adding a content item as a shortcut, or cross-sharing it to another Workspace) typically weigh more than lighter signals (such as a like), because they reflect a stronger expression of value or curation by the user. The exact formula and weights may evolve over time as we improve the algorithm.

9.3 What we use it for

Clevertrek uses interaction data and the resulting engagement scores only inside the Service, to:

• rank and order content in feeds, walls, search results, and discovery sections;
• personalize content recommendations to you, based on the topics, sources, and types of content you engage with;
• surface high-quality and well-curated content to the wider community of users;
• inform aggregated, anonymized analytics about how content circulates on the platform.

We do not sell, share, or otherwise transfer interaction data or engagement scores to third parties for advertising, profiling, or any unrelated purpose. Engagement data is not transmitted to our AI provider (Anthropic) or to any other external party beyond the strictly necessary infrastructure subprocessors listed in Section 17.

9.4 Legal basis

The legal basis for processing interaction data and engagement scores is Clevertrek's legitimate interest (Article 6(1)(f) GDPR) in operating, securing, and improving the Service, and in providing users with relevant, personalized, and well-curated content. We have balanced our legitimate interest against your rights and freedoms and concluded that this processing has a limited impact on you: it does not produce legal or similarly significant effects, it affects only what content is shown to you inside Clevertrek, and you can object or adjust your interactions at any time.

9.5 No significant automated decisions

This processing is not automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR. The engagement score affects only what content is recommended or ranked higher for you inside the Service. It does not affect any legal, financial, employment, credit, or material right of yours, and it does not produce decisions about you that you cannot influence by changing your interactions.

9.6 Your controls

You can:

• delete individual interactions (e.g., remove a like, save, shortcut, or cross-share) at any time inside the Service, which removes them from the engagement-score calculation going forward;
• close your Account; your interaction history is then kept as set out in Section 19 (Data Retention Periods) and Section 11.15 ("Closing your Account");
• exercise your right to object (Article 21 GDPR) to processing based on legitimate interest, including for personalization purposes, by writing to privacy@clevertrek.com. If you object, Clevertrek will stop using your interaction data for personalization (where technically feasible) unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.

10. Cookies and Similar Technologies

We use cookies, local storage, session storage, and service worker caches. See the Cookie Policy for the full list, purposes, retention, and how to manage your preferences.

11. Google API Services Data Handling

This Section 11 describes in detail how Clevertrek accesses, uses, stores, and shares data obtained through Google APIs. It is designed to comply with, and to make verifiable for review purposes, the Google API Services User Data Policy and the Limited Use requirements that apply to it.

For the avoidance of doubt: this Section 11 supplements, and where applicable prevails over, the more general statements in this Privacy Policy with respect to data obtained through Google APIs ("Google User Data").

The Google API Services Disclosure sets out the same commitments on a single page. The texts on scopes, Limited Use, AI features, service providers, security, retention and revocation are the same, word for word, in both documents.

11.1 Application Identity and Verified Domain

The application that requests Google User Data is registered with Google under the name "Clevertrek" and is operated by Fernando Beneitez Vela-Hidalgo (sole proprietor under Spanish law, NIF 75794423Q). The verified domain associated with the OAuth consent screen and with this Privacy Policy is clevertrek.com. The OAuth consent screen displays the application name, logo, support email, and links to this Privacy Policy and to the Terms of Service.

11.2 Google APIs and OAuth Scopes Used

Clevertrek requests the minimum set of OAuth scopes required to deliver the features described below.

Clevertrek does not request the broad drive or drive.readonly scopes, the spreadsheets or spreadsheets.readonly scopes, the read-write webmasters, analytics or analytics.edit scopes, any Gmail or Google Calendar scope, or any scope that Google classifies as Restricted, and it does not request scopes it does not actively use. If new scopes are added, this document and the OAuth consent screen will be updated first, and any new Sensitive or Restricted scope will go through Google's verification before it is used in production.

Why each scope is needed, and why a narrower one is not enough:

Where the data flows. Responses from Google go directly to the Clevertrek server that handles your request, are processed to show charts, tables and reports, and are returned to your browser inside your authenticated Workspace. They are also used by the AI features you use and by the report-rendering service when you generate a report, as described below. Each user's Google User Data is visible only inside their own Workspace, to the people they give access to it there. Clevertrek does not combine the Google User Data of different users, republish it or sell it.

Background use that you set up. Some features read your connected accounts while you are not using Clevertrek, only because you set them up: scheduled automations (for example SEO Controller reports, insights and project memory on a schedule) and the reading of your top Search Console pages that you start in Content Ideas. When you create an automation that sends data to the AI, Clevertrek asks for your permission first. You can pause or remove automations at any time on the Automations page. Automations that use Search Console pause on their own when that connection, or your access to that property in the project, is no longer available.

11.3 Google Sign-In and OAuth Identity

What we access. When you sign in with Google, Clevertrek receives only your basic OpenID Connect profile information: your Google account ID, name, primary email address, and profile picture URL.

Why we use it. To create or look up your Clevertrek Account, to authenticate you, and to display your name and avatar inside the Service.

Retention. This information is stored in your Clevertrek Account profile while the Account exists. What happens when you close your Account is set out in Section 11.15 ("Closing your Account").

No further use. Clevertrek does not use Sign-In data for advertising, profiling, or AI-model training.

11.4 Google Search Console

What we access. When you connect Search Console, Clevertrek calls the Google Search Console API with the read-only scope https://www.googleapis.com/auth/webmasters.readonly. We access the list of properties verified to your Google account, and the search-performance data (clicks, impressions, click-through rate and average position, by query, page, country, device and date) of the properties you choose to use in Clevertrek.

We do not access Search Console properties of Google accounts you have not connected, and we do not use any write or modify endpoint of the Search Console API.

Why we use it. To show, inside your Workspace, the search performance of your own websites in SEO Controller (with its reports and insights) and in Live Dashboards; to track the positions of your pages (Rank Tracker) and research keywords (Keyword Research) with your own search data; to read your top pages when you ask Content Ideas to, so that new content ideas can be told apart from updates of existing pages; to give Persona Studio, Ideation and Talk to Report the search data they need; and to answer your questions about it with the AI assistant (Section 11.11). Scheduled automations that you set up can read it in the background (Section 11.2, "Background use that you set up").

Not Google User Data: page speed. The PageSpeed reports of Clevertrek use Google's public PageSpeed Insights API with Clevertrek's own API key, on the public address of the page you enter. This does not use your Google account or any OAuth scope.

11.5 Google Analytics (GA4)

What we access. When you connect Google Analytics, Clevertrek calls the Google Analytics Data API and Admin API with the read-only scope https://www.googleapis.com/auth/analytics.readonly. We access the list of GA4 accounts and properties your Google account can access, and the dimensions and metrics (such as users, sessions, page views, events, conversions, traffic sources, devices and countries) of the properties you choose, for the date ranges you choose.

We do not access Universal Analytics data, any write, configuration or user-management endpoint, or the broader analytics or analytics.edit scopes.

Why we use it. To show, inside your Workspace, the traffic and engagement of your own websites and apps in the connector and in Live Dashboards, to give Persona Studio the audience data it needs when you ask it to, and to answer your questions about it with the AI assistant (Section 11.11).

This integration is distinct from the public-website measurement described in Section 11.9.

11.6 Google Ads

What we access. When you connect Google Ads, Clevertrek calls the Google Ads API with the scope https://www.googleapis.com/auth/adwords. We access the list of Google Ads accounts your Google account already has access to, and the performance reports of the accounts you choose (for example campaigns, ad groups, ads, keywords and search terms), with metrics such as impressions, clicks, cost, conversions and all conversions.

Why this scope. The Google Ads API has a single scope, adwords, with no read-only version, and Google's consent screen describes it as "see, edit, create, and delete". Clevertrek uses it only to read reports (Section 11.2).

Read-only use. Clevertrek does not create, change, pause or remove anything in your Google Ads accounts, and does not automate bidding or spend. Any suggestion is shown to you as text, for you to act on yourself in Google Ads.

Why we use it. To show, inside your Workspace, the performance of your own advertising accounts in the Google Ads connector, the Google Ads Controller and Live Dashboards, and to answer your questions about it with the AI assistant (Section 11.11).

11.7 Google Sheets and Clever Tables

What we access. With the file-by-file scope https://www.googleapis.com/auth/drive.file, Clevertrek can open only the spreadsheets you pick in the Google Picker; it cannot see your other files. We read the cells of those spreadsheets through the Google Sheets API. This is the narrowest scope available: a Sheets scope such as spreadsheets.readonly would give access to all your spreadsheets.

Why we use it. To show your spreadsheet data in dashboards, to answer your questions about it with the AI assistant (Section 11.11) and, if you choose, to import a spreadsheet into Clever Tables. An import is a copy that you create on purpose: it is no longer updated from Google and is kept with the project.

11.8 Google Drive Picker

What we access. The Google Picker is a Google-hosted window that runs in your browser. When you pick files from your Google Drive, Clevertrek receives the metadata of those files (file ID, name, type and link) and a short-lived access token, limited by the drive.file scope to the files you picked. The token stays in your browser and is not stored on Clevertrek's servers.

We do not access files you have not picked, your Drive folders, or the rest of your Drive.

Why we use it. To attach Drive files to your Workspaces and projects (for example in Ideation) without uploading them again and, when you attach a file to an AI chat, to read it so that the assistant can answer your question about it (Section 11.11).

11.9 Google Analytics — Clevertrek's Public Website Measurement

Google Analytics is used only on the public website, to understand aggregate visitor behavior. Where EU law applies, it is loaded only after you grant analytics consent through our cookie banner. We use IP-anonymization features where available, do not enable Google's advertising features in our property, and do not use Analytics inside the authenticated Service. This is not an OAuth integration and does not involve Google User Data.

11.10 Limited Use of Google User Data — Affirmative Statement

Clevertrek's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, this means:

(a) Only for the features you use. Clevertrek uses Google User Data only to provide or improve user-facing features that are prominent in Clevertrek and that you use: Google Sign-In; the Search Console, Google Analytics, Google Ads and Google Sheets connectors and the features that show their data in your projects (SEO Controller with its reports and insights, Live Dashboards, Google Ads Controller, Rank Tracker, Keyword Research, Content Ideas, Persona Studio, Ideation, Talk to Report and Clever Tables imports); the Google Drive file picker; the automations you set up; and the AI features described below, when you use them.

(b) No transfer. Clevertrek does not transfer Google User Data to anyone, except: to provide or improve those features, through the service providers listed below; for security purposes (for example, investigating abuse); to comply with applicable law; or as part of a merger, acquisition or sale of assets of Clevertrek, and then only after obtaining your explicit prior consent. Clevertrek does not transfer or sell Google User Data to advertising platforms, data brokers or information resellers.

(c) No advertising. Clevertrek does not use or transfer Google User Data for serving advertisements, including retargeting, personalized or interest-based advertising, and does not sell it.

(d) No credit decisions. Clevertrek does not use or transfer Google User Data to determine credit-worthiness or for lending purposes.

(e) No training of AI models. Clevertrek does not use Google User Data to develop, improve, or train generalized AI or machine-learning models, whether its own or those of third parties.

(f) Nobody reads your data. No person at Clevertrek reads your Google User Data, unless: (i) you have given your explicit agreement for specific data (for example, when you ask for help with a specific report); (ii) it is necessary for security purposes, such as investigating a bug, abuse or a security incident; (iii) it is necessary to comply with applicable law; or (iv) the data has been aggregated and anonymized and is used for internal operations. The operator works with aggregated metrics, error counters and logs that exclude Google User Data payloads where reasonably possible.

11.11 AI Processing of Google User Data

Clevertrek's AI features are powered by Anthropic's Claude API (Anthropic, PBC). Google User Data (from Search Console, Google Analytics, Google Ads, Google Sheets and the Google Drive files you attach) is sent to Anthropic only to produce the AI feature you use:

• When you ask the AI assistant a question. The assistant retrieves from your connected accounts only the report, date range and fields that the question needs, and sends them with the question. Google User Data is not added to a conversation when the question does not need it.
• When you use an AI tool that works with your connected data, such as SEO Controller reports and insights, Talk to Report, Persona Studio, Ideation or Content Ideas. The tool sends only the data it needs for the result you asked for (in Content Ideas, for example, the paths of up to 20 of your top pages, each with up to 3 of the searches that lead to it, so that new ideas do not repeat them).
• When you attach a Google Drive file to an AI chat. Your browser downloads the file you picked (converted to PDF where needed) and sends its content with your question.
• When an automation you set up sends data to the AI (scheduled SEO Controller reports, insights or project memory). Clevertrek asks for your permission when you create it, and you can pause or remove it at any time.

In every case, only data from the Google accounts you have connected and can use in that Workspace or project is sent, together with any spreadsheet that you or a member of that Workspace imported into Clever Tables there (Section 11.7 of the Privacy Policy), and only what the feature needs. Instructions and project context that Clevertrek adds to every AI request on its own do not include figures from Google. Data sent through Anthropic's commercial API is not used to train Anthropic's models. If you use your own API key (BYOK), the request is made under your key, and these commitments still apply to the Google User Data we send. Clevertrek does not send Google User Data to Anthropic, or to any other AI provider, for any other purpose, and does not use it to build a profile of you.

11.12 Service Providers That Receive Google User Data

Google User Data is processed only by the following service providers (sub-processors), and only as needed for the features described above:

Google User Data is not sent to payment processors, email-delivery providers, analytics or advertising providers, or any other third party. Google is the source of this data, not a sub-processor of Clevertrek. The full list of Clevertrek's sub-processors is published at /forms-privacy/#sub-processors.

11.13 Storage and Security of Google User Data

• TLS encryption for all communications between your browser, Clevertrek's servers and Google APIs.
• OAuth tokens encrypted at rest. The access and refresh tokens of the Search Console, Google Analytics, Google Ads and Google Sheets connectors are stored only on Clevertrek's servers, encrypted with authenticated encryption (XChaCha20-Poly1305). The key is kept in the server configuration, outside the database, so the tokens cannot be read from a database export.
• The Google Drive picker uses a short-lived access token that stays in your browser and is not stored on Clevertrek's servers.
• Access to the production environment is limited to the operator named in this document; the hosting provider can access it only to provide its service.
• Server and error logs are monitored for security events.
• When you disconnect, Clevertrek asks Google to revoke its access and deletes the stored tokens (see revocation below).
• If we become aware of unauthorized access to Google User Data, we will notify the affected users, the Spanish Data Protection Agency (AEPD) where required, and Google, as required by Google's API terms and policies.

11.14 Retention of Google User Data

11.15 Revoking Access and Deleting Google User Data

You can remove Clevertrek's access to your Google data at any time, in two ways:

1. Inside Clevertrek: go to Connectors (/connectors/), open the Search Console, Google Analytics, Google Ads or Google Sheets connector and click Disconnect. Clevertrek asks Google to revoke its access and deletes the tokens it stores. Clevertrek's Google connectors share one authorization with Google, so revoking it also disconnects your other Google connectors in Clevertrek (Search Console, Google Analytics, Google Ads and Google Sheets); the confirmation window warns you before you confirm. If Google cannot confirm the revocation, Clevertrek tells you, so that you can remove the access yourself as in step 2.
2. In your Google Account: at https://myaccount.google.com/permissions, remove Clevertrek from the list of connected applications. The next time Clevertrek tries to use the connection, Google rejects it and Clevertrek deletes the stored tokens.

Files picked with the Google Drive picker use a short-lived access that expires on its own after about one hour; to remove it earlier, use your Google Account as in step 2.

What happens to the data saved in your projects is set out in the retention rules above. You can ask us at any time to delete specific Google User Data saved in your projects, or all the data of your Account, by writing to privacy@clevertrek.com (Sections 20-21 of the Privacy Policy).

Closing your Account. When you close your Account (Close account in your account settings), it is deactivated at once: you can no longer sign in, your automations stop, your personal data slots are archived and your name is shown as "Former member" in member lists and comments. Before you can close it, you have to turn off the accounts you use in your connectors and, if you own or administer a company Workspace, transfer it to another member or step down as its admin. Your content is kept: what you shared in a Workspace, or what a Workspace accepted, stays there (in member lists and comments, your name is shown as "Former member"). Closing your Account does not by itself delete your Google tokens or the identity received through Google Sign-In: to remove Clevertrek's access to Google, click Disconnect on your Google connectors before closing (or use your Google Account as in step 2), and to have the tokens and the identity (email, Google account ID, profile picture) of a closed Account removed, write to support@clevertrek.com. When we remove that identity, your content is kept in pseudonymized form, not anonymized: your identity details are removed, but the content itself stays. A closed Account cannot be used to export data; if you need your data after closing, ask support to reopen the Account.

For a separate, focused disclosure aimed at the Google API Services verification process, see the Google API Services Disclosure.

12. Chrome Extension Data Handling and Permissions

The Clevertrek Chrome extension requests only the permissions strictly necessary for its functionality (typically activeTab, storage, and access to specific Clevertrek domains).

The extension processes:

• the URL, title, and meta-data of the page you actively choose to capture;
• your Clevertrek session token, to authenticate the capture into your Workspace.

The extension does not:

• track your browsing history in the background;
• read content of pages you have not actively chosen to capture;
• transmit data to any servers other than Clevertrek and the third-party services you have connected.

You can uninstall the extension at any time from your browser's extension manager.

13. PWA, Service Workers, and Push Notifications

When you install Clevertrek as a PWA, the application uses a service worker to cache assets for offline use and improved performance. The service worker stores cached responses on your device and removes them when you uninstall or clear browser data.

If you grant push notification permission, your browser provides a push subscription token which we store and use to deliver notifications. Push payloads are sent through the push provider operated by your browser vendor (e.g., Google FCM for Chrome). We do not include sensitive content in push payloads. You can disable push notifications at any time from your device settings or your Clevertrek preferences.

14. MCP Connectors — How Third-Party Data Flows Work

When you enable an MCP Connector, you authorize Clevertrek to relay relevant requests, prompts, and content from your AI Feature interactions to that external service.

For each MCP Connector you enable:

• we transmit only the data that is necessary to perform the action you requested;
• we do not retain external-service responses beyond what is needed to display them to you and to log the request for security and debugging purposes;
• the external service's privacy practices apply to data received by it.

You can disable an MCP Connector at any time from your Account settings.

15. AI Processing (Anthropic / Claude)

AI Features are powered by Anthropic, PBC (Claude API).

When you use AI Features:

• your prompt and any contextual data needed to fulfill the request, which can include data from integrations you have connected (for Google User Data, see Section 11.11), are sent to Anthropic via the Claude API;
• Anthropic processes requests in the United States; this transfer is covered by Standard Contractual Clauses, and Anthropic keeps API inputs and outputs only for the limited period set out in its commercial terms;
• Anthropic processes the request and returns the AI output;
• Clevertrek configures requests using Anthropic's API such that, by default, prompts and outputs are not used to train Anthropic's models, in accordance with Anthropic's commercial terms in force at the time;
• the AI output and quota usage are stored in your Account.

Anthropic's privacy policy is available at https://www.anthropic.com/legal/privacy.

For BYOK Plans, requests are made under your own API key. Your relationship with the AI provider in that case is governed directly by the provider's terms. Our commitments on Google User Data (Section 11) still apply to the Google User Data we send under your key.

16. BYOK (Bring Your Own Key) — Handling of User-Provided API Keys

When you provide your own AI provider API key (BYOK):

• the key is encrypted at rest using AES-256-CBC before being stored in our database;
• the key is decrypted only when needed to make a request on your explicit behalf;
• the key is never displayed back to you in clear after submission;
• you can rotate or delete the key from your Account settings at any time;
• when you delete the key or terminate your Account, the encrypted record is removed within a reasonable period.

17. Sharing with Third Parties and Subprocessors

We do not sell your personal data. We share personal data only with the following recipients, and only to the extent necessary:

• Service providers (subprocessors) that run the Service on our behalf: Rocket.net (hosting, database and cache), Cloudflare (file and archive storage; the archive of project memory is encrypted by Clevertrek, and the files of generated reports are deleted there automatically 30 days after they are created), Railway (report rendering), Anthropic (AI Features, when not in BYOK mode), Google Workspace (email delivery), Zernio (connection to the social media and advertising accounts you connect through it) and Cookiebot (cookie consent on our website). The full list, with what each one receives, where it processes data and the transfer safeguard, is published at /forms-privacy/#sub-processors;
• Stripe, for payment processing;
• Google Analytics, for analytics of our public website, only where you have given consent;
• Professional advisors (lawyers, accountants, auditors) under confidentiality;
• Authorities and courts, where required by a valid legal request.

The services you connect yourself (such as Google, Meta or other integrations) are the sources of the data you ask us to bring into Clevertrek; they are not our subprocessors, and their own terms and privacy policies apply.

18. International Data Transfers and Safeguards

Clevertrek's servers are located in the United Kingdom, which benefits from an adequacy decision of the European Commission. Some of our service providers process data in the European Economic Area (EEA), such as report rendering in the Netherlands, and others outside it, particularly in the United States. Where data is transferred outside the EEA and the United Kingdom, we rely on appropriate safeguards under Chapter V of the GDPR, such as:

• the EU–U.S. Data Privacy Framework for certified providers;
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• supplementary measures where required, such as encryption.

You may request a copy of the relevant safeguards by contacting us.

19. Data Retention Periods

We keep personal data only for as long as necessary for the purposes for which it was collected, and in any case for the periods required by law:

After the applicable retention period, data is deleted, or kept in pseudonymized form where this Section says so.

20. Your Rights Under GDPR

Subject to the conditions and limits set out in the GDPR, you have the following rights:

• Right of access (Art. 15) — to obtain confirmation of whether we process your personal data, and a copy of it;
• Right to rectification (Art. 16) — to have inaccurate or incomplete personal data corrected;
• Right to erasure (Art. 17) — to request deletion in certain circumstances;
• Right to restriction of processing (Art. 18) — in certain circumstances;
• Right to data portability (Art. 20) — to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller;
• Right to object (Art. 21) — to processing based on legitimate interests, including profiling, and at any time to processing for direct marketing purposes;
• Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (Art. 22). Clevertrek does not currently make such decisions through the Service.

You also have the right to withdraw consent at any time (without affecting the lawfulness of processing prior to withdrawal).

21. How to Exercise Your Rights

To exercise any of these rights, write to us at the contact email below. We may need to verify your identity before responding. We will respond within one (1) month of receiving your request, extendable by a further two (2) months for complex requests.

22. Children's Privacy

The Service is not directed at children under the age of 14 in Spain (or the equivalent age of digital consent in your country). We do not knowingly collect personal data from such children. If you believe we have done so, please contact us and we will delete it.

23. Security Measures

We implement reasonable technical and organizational security measures, including encryption in transit (TLS), encryption at rest of sensitive secrets and of the OAuth tokens of Google integrations, access controls, and regular updates of WordPress, its plugins and the server software. See Section 27 of the Terms of Service for further detail.

24. Data Breach Notification Procedure

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency (AEPD) within seventy-two (72) hours where feasible, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, in accordance with Article 34.

25. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-product notice with at least fifteen (15) days' notice before taking effect, except where immediate change is required by law.

26. Supervisory Authority

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a supervisory authority. The competent authority for Clevertrek is:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan, 6 28001 Madrid, Spain https://www.aepd.es

You may also lodge a complaint with the supervisory authority of your country of residence within the EU.

27. Contact

For any questions about this Privacy Policy or about how we process your personal data, contact us at:

Clevertrek (Fernando Beneitez Vela-Hidalgo, sole proprietor, NIF 75794423Q) Avenida del Hotel, 1, 15º 08860 Castelldefels, Barcelona, Spain Email: privacy@clevertrek.com