The data we hold, and the rights you have over it.

We deliberately collect as little as possible. The categories below cover everything we hold:

• Account data — email, name, organisation, country and city (so we can route to the right legal framework), the role assigned to you, and a hashed password if you signed up that way.
• Workspace content — your prompts, generated outputs, attachments, and threads. This is yours. We process it to deliver the service and to bill you, and we never use it to train any third-party model.
• Usage logs — model called, tokens in/out, latency, the chat type (chat, research, image, code, voice, video), cost, and timestamp. Used for billing and abuse detection.
• Technical data — IP address, device and browser fingerprint, page paths, and error traces. Retained briefly for security and reliability.
• Consent & preferences — your cookie choices, language, theme, and the audit row that records when an admin changes anything that affects you.

Under GDPR / UK GDPR we rely on the following bases:

• Performance of a contract — to deliver the workspace you signed up for: authentication, model routing, generation, billing, and support.
• Legitimate interests — security, fraud and abuse prevention, debugging, and aggregate product metrics. Balanced against your rights and freedoms.
• Consent — for non-essential cookies, marketing communications, and any analytics or sharing beyond strict service delivery. You can withdraw it at any time.
• Legal obligation — to retain invoices and tax records for the periods required by law.

For California (CCPA / CPRA), Brazil (LGPD), and Quebec (Law 25), the equivalent local bases apply.

We use a short list of providers to host, deliver, and secure the service. Each is bound by a data-processing agreement and processes data only on our instructions:

• Vercel, Inc. — application hosting and edge delivery.
• Supabase, Inc. — database, auth, and file storage.
• Model providers — OpenAI, Anthropic, Google, Groq, Fal, DeepInfra, and other AI inference partners. Your prompt content is sent to whichever provider you (or your workspace settings) selected, and is not used by them to train models when we invoke them through the AI Gateway.
• Stripe, Inc. — payment processing for paid plans.

A current list with regions and contact details is available on request from privacy@clox.studio.

Some of our providers are based in the United States. When we transfer personal data outside the EEA, the UK, Switzerland, Brazil, or Quebec, we rely on the European Commission’s Standard Contractual Clauses (the UK’s International Data Transfer Addendum where relevant), supplemented by appropriate technical and organisational measures (encryption in transit and at rest, access controls, logging).

• Account & profile data — for as long as the account exists, then 30 days after deletion to handle disputes, then permanent erasure.
• Workspace content — kept until you delete it or close your account; emptied from backups within 35 days of deletion.
• Usage logs — 24 months for billing, security, and capacity planning.
• Invoices & tax records — the period required by your jurisdiction (typically 6–10 years).
• Audit log entries — 24 months unless required for longer by a legal hold.

Depending on where you live, you have some or all of the following rights:

• Access & portability — request a copy of the data we hold and have it sent to you in a machine-readable format.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your account and the data tied to it (subject to legal-retention exceptions).
• Restriction & objection — pause processing or object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — at any time, with no impact on the lawfulness of processing before withdrawal.
• California & Quebec — opt out of the “sale or sharing” of personal information. We honour the Global Privacy Control (GPC) signal automatically as such an opt-out.

To exercise any right, email privacy@clox.studio. We respond within 30 days.

We use TLS in transit, AES-256 at rest, scoped service-role credentials, row-level security on every multi-tenant table, audit logging on privileged actions, and least-privilege staff access. No system is perfectly secure; we’ll notify you and the relevant supervisory authority if a breach materially affects your rights.

Clox is not directed to children under 16. If you believe we hold data about a minor, write to privacy@clox.studio and we will delete it.

We’ll publish material changes here and bump the version recorded against your consent record so the banner re-prompts. The date at the top of this page always reflects the current version.

• Cookie policy — what we store on your device and why.
• Terms of service — the contract that governs the workspace itself.