1. Who we are
This policy explains how Clvrly ("Clvrly", "we", "us") handles personal data. Clvrly is a UK-based service that adds an AI assistant to websites.
You can contact us about privacy at any time at [email protected].
2. Our two roles
- For our customers (the businesses that sign up to Clvrly) and for visitors to clvrly.com, we are the controller. We decide how that data is used, and this policy applies in full.
- For visitors who chat with an assistant on a customer's website, the website owner is the controller and we are their processor. We handle that data on the website owner's behalf and under their instructions. If you chatted with an assistant on someone else's site, their privacy policy applies, and it is best to contact them first. Section 3 explains what we process for them.
3. Visitors using a Clvrly assistant
When a website shows a Clvrly assistant, we process the following for the website owner:
- Your messages and the assistant's replies.
- Details you choose to share in the chat, such as your name, email address, phone number or company. The assistant may note these so it can follow up or pass them to the website owner.
- Page and technical information: the page you were on, your IP address, browser type and the time of each message.
- A visitor identifier: a random ID stored in your browser so a conversation can continue as you move between pages.
We use this to answer your questions, keep a record of the conversation for the website owner, produce summaries and insights for them, and keep the service secure. To generate answers, your messages and relevant parts of the website's content are sent to our AI provider (see section 7). They are not used to train the provider's AI models.
Please do not share sensitive information, such as health details or payment card numbers, in the chat.
Storage in the visitor's browser
The assistant uses your browser's local storage rather than cookies:
| Name | Purpose | Kept |
|---|---|---|
clvrly_vid | Random visitor ID so your conversation continues between pages | Until you clear your browser storage |
clvrly_config | The assistant's appearance settings, so it loads quickly | Until replaced or cleared |
| Dismissed prompt flag | Remembers that you closed the assistant's prompt bubble | Until you close the browser tab |
These are needed for the assistant to work as you would expect. You can clear them at any time in your browser settings.
4. Customers and visitors to clvrly.com
What we collect
- Account details: your name, email address, company, website address and password (stored as a secure hash, never in plain text).
- Billing details: your plan, subscription status and payment history. Card payments are taken by Stripe. We never see or store your full card number.
- Website content: the public pages of the websites you connect, which we scan so the assistant can answer from them, and any content you add in the portal.
- Support and emails: messages you send us and our replies.
- Usage information: how you use the portal, and technical data such as your IP address and browser, used for security and to improve the service.
- WordPress plugin checks: if you use our plugin, it sends your token, site address and plugin version to us to check your installation. It does not send any visitor data.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, providing the assistant, taking payment | Performance of our contract with you |
| Service emails, such as account, security, billing and trial reminders | Performance of contract and legitimate interests |
| Security, preventing fraud and abuse, and fixing problems | Legitimate interests |
| Understanding how our website and portal are used so we can improve them | Legitimate interests, or consent where required for analytics cookies |
| Product news and offers | Legitimate interests (existing customers) or consent. You can unsubscribe at any time. |
| Keeping accounting and tax records | Legal obligation |
Cookies on clvrly.com
Our own website uses a session cookie to keep you signed in to the portal, Google Analytics cookies to understand how the site is used, and Google reCAPTCHA on some forms to block spam and abuse. You can block or delete cookies in your browser settings; the portal will not work without the sign-in cookie.
6. Our service providers
| Provider | What they do | Data involved |
|---|---|---|
| Microsoft (Azure OpenAI Service) | Generates the assistant's answers | Chat messages and relevant website content |
| Stripe | Payments and subscription billing | Customer billing details |
| Google (Analytics, reCAPTCHA) | Website analytics and spam protection on clvrly.com | Usage and device data of clvrly.com visitors |
| Our hosting provider | Hosts the Clvrly service and database | All data described in this policy |
| Our email delivery provider | Sends account and service emails | Customer names and email addresses |
Under Microsoft's terms for the Azure OpenAI Service, data sent to it is not used to train AI models. If you would like the current names and locations of our hosting and email providers, email [email protected].
7. International transfers
Some of our providers process data outside the UK, for example in the European Economic Area or the United States. When data leaves the UK, we make sure it is protected, for example by the UK's adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
8. How long we keep data
- Account data: while your account is open. When you close it, we delete or anonymise it within 90 days, except what we must keep by law.
- Conversations on customer websites: while the website owner's account is open, unless they delete them sooner. They are deleted within 90 days of the account closing.
- Billing and accounting records: for 6 years, as UK law requires.
- Security logs: for a limited period, normally no more than 12 months.
9. Security
We protect data with measures including encrypted connections (HTTPS), hashed passwords, access controls limiting who can see data, and restricting each assistant to the domains its owner has registered. No system is perfectly secure, but we work to protect your data and will notify you and the regulator as the law requires if a breach puts your data at risk.
10. Your rights
Under UK and EU data protection law you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it, including objecting to direct marketing at any time;
- receive your data in a portable format;
- withdraw consent, where we rely on it.
To use these rights, email [email protected]. We will reply within one month. If your request is about a conversation on another business's website, we will pass it to that business, as they decide how it is handled, and help them respond.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority.
11. Children
Clvrly is a service for businesses and is not aimed at children. We do not knowingly collect data from children under 13 for our own purposes. Website owners are responsible for whether their assistant is suitable for their audience.
12. Changes to this policy
We may update this policy as our service changes. The date at the top shows when it was last updated. If we make a significant change, we will tell customers by email or in the portal before it takes effect.
See also our Terms of Service.