Privacy policy

• Account data (email, name, authentication credentials): Collected when you create an account or sign in, including with Google. You need to give us your email address to create an account. Everything else is optional. Lawful basis: performance of a contract (cloud synchronisation service) and legitimate interests (account security and service provision).
• Reading text and audio: Natural voice runs in your browser. The voice software is downloaded from jsDelivr (cdn.jsdelivr.net) and the voice model and voices from Hugging Face (huggingface.co). These providers see your IP address and browser details when they deliver the files, but not your reading text. Your reading text for read-aloud is processed on your device. Ask Clariva, writing support and translation send the chosen text to OpenAI. The files are stored in your browser so they only download once; you can remove them by clearing this site's data in your browser settings. Clariva's font is loaded from rsms.me, which sees your IP address and browser details. Lawful basis: performance of a contract (text-to-speech service) and legitimate interests (delivering the voice files efficiently).
• Transcription audio: Sent to OpenAI's speech-to-text service only when you press Transcribe. Used solely to generate your requested transcript. Lawful basis: performance of a contract (transcription service).
• Library, notes, preferences: Stored in your private cloud account (Supabase) when you sign in with Pro or Business. Lawful basis: performance of a contract (cloud sync).
• Text you ask the AI to work on: When you use Ask Clariva, writing support or translation, we send the text you choose, and your question, to OpenAI to produce the answer. We use it only to give you that answer. Lawful basis: performance of a contract (providing the feature you asked for).
• Usage records: We record which features you use, how much and when, linked to your account. We use this to apply your plan's limits, prevent misuse and improve Clariva. Lawful basis: performance of a contract (plan limits) and our legitimate interests (preventing misuse and improving the service).
• Payment data: Processed by Stripe (card details are not stored by Clariva). Lawful basis: performance of a contract (subscription billing).

• OpenAI (United States): transcription, Ask Clariva, writing support and translation. OpenAI may keep what we send, and its replies, for up to 30 days to provide the service and check for misuse, and then deletes them unless the law requires it to keep them. OpenAI does not use data sent through its business service to train its models.
• Cloudflare: delivery and protection of Clariva.
• Stripe: payments. Stripe also acts as an independent controller for some payment data, under its own privacy policy.
• Google: if you choose Sign in with Google. Google acts as an independent controller under its own privacy policy.
• Hosting provider: Our app is hosted by a specialist hosting and database provider. Our database is stored in the United Kingdom (London), but the provider is based in the United States and may access your data from there to run and support the service. We are working to put a formal transfer safeguard in place with it.
• Jina AI (part of Elastic): fetching the text of a public webpage you ask us to import. Only the page address is sent, under Jina's own terms rather than a processor contract with us. This may be processed in the United States.
• Microlink HQ (Spain): fallback webpage reader for "read from website". Data sent: page URL and standard request details (kept for up to 24 hours). Location: United States and other countries (Microlink's hosting and logging providers).
• rsms.me: delivers the Inter font Clariva uses. It sees your IP address and browser details, and works under its own terms rather than a processor contract with us.

For OpenAI, we protect transfers to the United States with the standard contractual clauses approved by the European Commission, as amended by the UK International Data Transfer Addendum issued by the Information Commissioner. Stripe, Google and Cloudflare are certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). Microlink is based in Spain and processes requests using hosting and logging providers in the United States and other countries, under its own contracts with those providers. You can ask us for a copy of the safeguards we rely on by emailing support@clariva.live.

• Account data: Retained while your account is active. When you request deletion: Your account will be deleted in 30 days. Sign in before then to restore it. After that, your data is permanently deleted.
• Transcripts: Stored locally in your browser until you remove them. Not synchronised to your account.
• Usage records: Kept while your account is open, and deleted when your account is permanently deleted.
• Text sent to OpenAI: Kept by OpenAI for up to 30 days, then deleted. Clariva does not keep your Ask Clariva questions, the text you send for writing support or translation, or the AI answers on its servers, unless you choose to save something to your library and your plan includes device sync.
• Payment records: Retained for 7 years to comply with tax and accounting obligations.

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data (right to be forgotten), subject to legal obligations.
• Restrict processing: Limit how we use your data in certain circumstances.
• Data portability: Receive your data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, email support@clariva.live or write to the data controller at the registered office above. We will respond within one month.