Privacy Policy

1. Overview

Clivu (“we”, “our”, or “us”) is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding your data. By using Clivu, you agree to the practices described here.

2. Information we collect

Information you provide

• Account information: name, email address, and password when you register.
• Profile information: business name, profile photo, and contact details.
• Client data: names, emails, and notes you add to your client records.
• Communications: messages, proposals, and documents you create in Clivu.

Information collected automatically

• Usage data: pages visited, features used, and actions taken within the app.
• Device information: browser type, operating system, and IP address.
• Cookies: session tokens and preferences (see Section 7).

Information from third-party integrations

• Gmail: if you connect your Gmail account, we access your email data as described in Section 3a below.
• Google Sign-In: your name, email address, and profile photo from your Google account when you sign in.
• Stripe: payment method details processed directly by Stripe. We store only the resulting payment status and Stripe customer/account identifiers.

3a. Google API and Gmail data

Clivu's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access

When you connect your Gmail account, Clivu requests the following OAuth scopes:

• https://www.googleapis.com/auth/gmail.readonly — to read your email threads and identify client contacts, surface conversation history on client profiles, and generate AI relationship summaries.
• https://www.googleapis.com/auth/gmail.send — to send emails on your behalf only when you explicitly compose and click Send within Clivu. We never send email automatically without your direct action.

How we use Gmail data

• Contact discovery: we scan sender and recipient email addresses to identify people you communicate with professionally and create or update their client records in Clivu.
• Conversation history: we store email thread metadata (subject, snippet, participants, date, direction) linked to the matching client record so you can see your communication history in one place.
• AI relationship summaries:thread content is sent to Anthropic's Claude API to generate a plain-language summary of your relationship with a client and suggest a next action. This data is processed transiently and not stored by Anthropic for training purposes under our API agreement.
• Sending email:when you compose an email in Clivu and click Send, we transmit it via the Gmail API using your authenticated account. The email is sent from your Gmail address, not from Clivu's servers.

What we do not do with Gmail data

• We do not read, store, or process emails for advertising or marketing purposes.
• We do not share Gmail data with third parties except Anthropic (for AI summaries) and Supabase (for encrypted storage), both under data processing agreements.
• We do not use Gmail data to build profiles for sale or transfer to data brokers.
• We do not allow humans at Clivu to read your email content except to diagnose a specific technical issue you have reported and consented to investigation of.
• We do not send email on your behalf without your explicit action in the app.

Data retention and deletion

Email thread metadata (subject, snippet, participants, date) is retained while your account is active. Full email body content is processed in memory to generate AI summaries and is not persisted to our database. When you disconnect Gmail in Settings or delete your Clivu account, we permanently delete all stored Gmail data within 30 days. You can also revoke Clivu's Gmail access at any time at myaccount.google.com/permissions, which immediately prevents any further access.

OAuth tokens

Gmail OAuth tokens (access token and refresh token) are stored encrypted at rest in our database. They are used solely to authenticate requests to the Gmail API on your behalf and are never exposed to other users or shared with third parties.

3. How we use your information

In addition to the Gmail-specific uses described in Section 3a, we use your information to:

• To provide, maintain, and improve Clivu's features.
• To send transactional emails (account confirmations, payment receipts).
• To send product updates and announcements (you can opt out at any time).
• To detect and prevent fraud, abuse, or security incidents.
• To comply with legal obligations.

We do not sell your personal data to third parties.

4. Data sharing

We share your data only in the following circumstances:

• Service providers: trusted vendors who help us operate Clivu (e.g., Supabase for database hosting, Stripe for payments, Anthropic for AI features). These providers are contractually bound to protect your data.
• Legal requirements: when required by law, court order, or governmental authority.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs.

5. Data retention

We retain your data for as long as your account is active or as needed to provide our services. When you delete your account, we delete your personal data within 30 days, except where retention is required by law.

6. Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest, and role-based access controls. No system is completely secure — if you believe your account has been compromised, contact us immediately at hello@clivu.ai.

7. Cookies

We use cookies for authentication (keeping you logged in) and basic analytics (understanding how features are used). We do not use advertising cookies. You can disable cookies in your browser settings, but some features may not function correctly.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Export your data in a portable format.
• Object to or restrict certain processing.

To exercise any of these rights, email us at hello@clivu.ai. We will respond within 30 days.

9. Children's privacy

Clivu is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or a prominent notice in the app at least 14 days before they take effect.