1. What we collect

We collect the following categories of information:

• Account information. Email address, display name, profile photo (optional), firm name (optional). Used to authenticate you and provision your workspace.
• Workspace + engagement data. Client names, engagement names, SOW briefings, hypothesis trees, evidence citations, decision memos, workplan rows, DRL entries, stakeholder lists, knowledge assets, expert networks, deliverable drafts. This is the work product of your engagements.
• Uploaded source material. Files you upload (PDF, DOCX, XLSX, CSV, TXT) are stored in Supabase Storage under your workspace and indexed into engagement_facts. We extract text, chunk, and embed the content for sub-agent retrieval.
• Sub-agent outputs + audit trail. Every sub-agent invocation is recorded (agent_runs, sign_offs, agent_run_citations, methodology_steps). Every fact the sub-agent cites is recorded (engagement_facts).
• Usage telemetry. Which endpoints you hit, when, and how long they took. We use this to monitor performance + identify which sub-agents need tuning. No key-stroke-level tracking.
• Notifications + billing data. Email + Slack recipient addresses (when you opt in to outbound transmission), Stripe customer ID + subscription ID (when you subscribe).

2. How we use it

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Run the sub-agents on your source material (within your workspace's RLS boundary).
• Process payments (via Stripe) and manage your subscription.
• Send you product updates + changelog notifications (you can opt out).
• Monitor + debug issues. We use Langfuse observability events for the sub-agent harness; the events include the agent_type, the token usage, and the audit-trail summary, but never the source-material content.
• Enforce the multi-tenant RLS boundary. Every read + write is workspace-scoped.

3. What we don't do

• We don't train large language models on your data. The sub-agents use the OpenRouter API; OpenRouter forwards to upstream providers (Anthropic, OpenAI, Google); none of these providers train on your content under our contract.
• We don't sell your data to third parties.
• We don't share your data across workspaces. The RLS policy enforces this at the database level.
• We don't read your content. No Clarovo employee has standing access to your workspace data.

4. Who we share with

We share information with:

• Sub-processors. Supabase (database + auth + storage), OpenRouter (LLM routing), Langfuse (observability), Stripe (payments). Each has a data-processing agreement in place.
• Legal. When required by law or to protect our legal rights (subpoena, court order, etc.).
• Acquirers. If Clarovo is acquired, your data transfers to the acquirer under this same privacy policy (you'll be notified).

5. Data retention

Active workspaces: data is retained for the duration of the subscription. Deleted workspaces: data is tombstoned within 30 days of the delete request. Anonymized telemetry (e.g. aggregate sub-agent latency) may be retained indefinitely.

6. Your rights

You can:

• Access your data at any time via the dashboard.
• Export your data (workplan XLSX, decisions + risks JSON, PDFs, share tokens).
• Delete your workspace at any time (cancels the subscription + tombstones the data within 30 days).
• Request a copy of your data in a portable format (email privacy@clarovo.xyz).

7. Security

Supabase Postgres + RLS. Every table has a workspace-scoped RLS policy. JWT auth on every endpoint. The Harness's audit trail (agent_runs + sign_offs + agent_run_citations + methodology_steps) records every sub-agent output for the partner-attestation defense. See /responsible-ai for the full security + responsibility surface.

8. International data transfers

We are headquartered in the United States. By using the Service, you understand that your data may be transferred to, stored, and processed in the United States. Sub-processors (Supabase, Stripe) may also store data in the EU depending on your plan.

9. Children

The Service is not intended for children under 16. We do not knowingly collect data from children under 16.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via the /changelog and via email to the workspace owner at least 14 days before they take effect.

11. Contact

Questions about this Privacy Policy: privacy@clarovo.xyz.