Privacy policy

1. Who is responsible

The data controller is the owner of Clervio Ayman Laakel Neffari, an individual based in Spain who operates Clervio (see the Legal notice). Privacy contact: aymanlaakel@gmail.com. No Data Protection Officer has been appointed; if one becomes mandatory it will be listed here.

2. What data we process

• Account data: email address, encrypted password (or your Google sign-in identity), account creation and sign-in timestamps.
• Workspace and business data: workspace name, business name, website URL, industry, location, audience, goals and the business profile generated from your website.
• Research content: website audits, competitor names, URLs and website snapshots, opportunities, campaign drafts, reports, automations and their run results.
• AI interactions: questions you send to the AI Marketing Director, the answers, and the status, inputs, results and errors of AI tasks.
• Usage and activity: counts of metered actions (audits, AI queries, searches, drafts) used to apply plan limits, and in-app notifications.
• Team data: invitations you send (invitee email and role) and workspace membership.
• Billing data: subscription status, plan, renewal date and Stripe customer/subscription identifiers. Card details are entered on Stripe’s pages and never reach Clervio.
• Google data: only if you connect Google services — see section 6.
• Technical data: server and error logs (e.g. IP address, browser, request time) kept by our hosting and database providers for security and reliability.

Clervio reads public web pages you ask it to analyse (your site and competitors’ sites). Those pages may contain personal data published by third parties; we only store the extracted business information needed for the analysis.

3. Purposes and legal bases (GDPR art. 6)

• Providing the service you sign up for, including AI analyses, audits, automations and integrations — performance of a contract.
• Billing, invoices and tax records — legal obligation and contract.
• Security, abuse prevention, plan-limit enforcement and error diagnosis — legitimate interest in running a safe, reliable service.
• Connecting Google services — your explicit authorization in Google’s consent screen, which you can withdraw at any time.

We do not send marketing emails, do not build advertising profiles and do not sell personal data.

4. Use of AI

To generate analyses, opportunities, competitor insights, campaign drafts and answers, Clervio sends the relevant content (your business profile, text from analysed web pages and your question) to AI models through the Lovable AI Gateway, which routes requests to model providers such as Google (Gemini) and OpenAI. Results are stored in your workspace. Clervio does not use your data to train its own models. AI output can be wrong; always verify it before acting on it.

5. Providers and recipients

• Lovable — application hosting and backend (database, authentication, server functions, AI gateway, connector gateway). Hosting runs on a global edge network (Cloudflare).
• Supabase — database and authentication infrastructure operated as part of Lovable Cloud.
• AI model providers (Google, OpenAI) — via the Lovable AI Gateway, as described above.
• Stripe — subscription payments, customer portal and invoices. Stripe acts as an independent controller for payment data.
• Google — only when you sign in with Google or connect Google Sheets, Gmail or Search Console.
• Websites you ask us to analyse — receive a normal page request from our servers.

Other workspace members can see the workspace’s data according to their role. We disclose data to authorities only when legally required.

6. Google user data

Connecting a Google service is optional and done per user. Clervio requests only these permissions:

• Google Sheets — spreadsheets and your email address. Used to create a “Clervio exports” spreadsheet or write to a spreadsheet you choose by pasting its link, appending opportunities and reports when you click export or when an automation you created runs. Clervio does not read or list your other files.
• Gmail — gmail.send and your email address. Used only to send Clervio reports and notifications you request or schedule, to your own address. Clervio cannot read your inbox.
• Search Console — read-only access (webmasters.readonly) and your email address. Used to list your properties and show 28-day clicks, impressions, CTR, position and top queries for the property you choose.

What we store: an access key for each connection, encrypted on our servers (AES-256-GCM) and never sent to your browser; the connected email address; your chosen spreadsheet; and a cached Search Console snapshot. OAuth tokens themselves are held by Lovable’s connector gateway on our behalf.

Disconnect: use “Disconnect” on the Integrations page, which revokes the connection and deletes the stored key, or revoke Clervio at myaccount.google.com/permissions.

Limited Use: Clervio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the user-facing features described above; it is not sold, not used for advertising, not used to train AI models, and not read by humans except with your permission, for security, or where required by law. It is transferred only to the processors listed in section 5 as needed to provide these features.

7. International transfers

Some providers (Lovable’s infrastructure, Stripe, Google, OpenAI) may process data outside the European Economic Area, notably in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. Each provider processes data under its own published data-processing terms.

8. How long we keep data

• Account, workspace and research data: while your account exists. There is currently no automatic deletion; you can delete items at any time and delete your account from Settings (see Data deletion).
• Billing records: kept by Stripe and, where applicable, for the period required by Spanish tax law (generally up to 6 years for accounting records).
• Provider logs: according to each provider’s retention, typically days to weeks.

9. Security

Measures in place today: HTTPS for all traffic; workspace data isolated by database row-level security so only members can access it; Google connection keys encrypted server-side; plan limits and permissions checked on the server; payments handled on Stripe; billing changes accepted only from Stripe’s signed webhook. No system is perfectly secure; we will notify affected users and the authority of a personal-data breach as required by law.

10. Your rights

You can request access, rectification, erasure, restriction, objection and portability of your personal data, and withdraw consent at any time. Much of this is self-service: edit your profile in Settings, export opportunities as CSV or to Google Sheets, and delete your account in Settings. For anything else, write to aymanlaakel@gmail.com; we answer within one month. You may also complain to the Spanish Data Protection Agency (aepd.es).

11. Minors

Clervio is a business tool and is not intended for people under 18. We do not knowingly process children’s data.

12. Cookies

Clervio uses only essential browser storage. See the Cookie policy.

13. Changes

We will publish changes here with a new date and version, and notify signed-in users in the app (or by email once available) before material changes take effect.