Draft — reviewed by the owner; not yet legal advice. Have a professional review before public launch.
Privacy
How Cluvia handles your data, in plain language. See also Cookies and our Subprocessors.
Who we are
Cluvia (operated by Adam Idrissi, United Kingdom) — “we”, “us”. Cluvia is a web app that runs a company of AI agents for you. Contact: usecluvia@gmail.com.
We are the data controller for the account and company data described here. This policy is written to the UK GDPR and the Data Protection Act 2018, with EU GDPR in mind as well.
What we store, and where it lives
| Data | What it holds | Where it lives |
|---|---|---|
| Account and sign-in | Your email address and session tokens. | Our authentication service. |
| Bot check at sign-in | When you sign up or sign in, Cloudflare Turnstile checks that you are a person, not an automated script. We use it to stop automated sign-ups. The check uses your IP address and technical details of your browser and connection. Cloudflare also uses these signals, as a separate controller, to improve its bot detection, under its Turnstile privacy addendum. | Cloudflare's global network. |
| Billing | Your plan, its status and billing dates, your credit balance and usage, and the records Whop sends us about your payments, refunds and disputes. These may include details you gave Whop at checkout, such as your email and country. We never receive your full card number. | Our PostgreSQL database in the UK (London). Payments themselves are handled by Whop (see below). |
| Company data | Your companies with their agents, tasks, outputs, chats and activity. | An encrypted PostgreSQL database in the UK (London), reached through a secure proxy. |
| Files and site files | Files you upload, and the files of the websites your company builds. | Cloud object storage. |
| AI processing | The text you and your agents send to generate work is processed by model providers to produce the reply. Voice: the natural reply voice sends the reply text — never your microphone — through our Worker to a speech provider; the on-device speech models process audio locally in your browser. | Processed by providers under contract; we share only what a task needs. |
| Visit statistics | Which Cluvia screens were viewed (landing page, sign in, sign up, onboarding, the app) and for how long they were visible, the referring site and campaign tags, the country and the device and browser type. No cookies. Your IP address and browser details are never stored: they are combined with a random value that changes every day and hashed, so a visit is counted once per day but cannot be linked to you later. | Our PostgreSQL database in the UK (London). |
| Published sites | Websites your company publishes are served from a global content network. What their visitors do — page views, contact messages — is stored in that site's own database. | The content network and your company's site database. |
We do not run advertising trackers, and we do not sell your personal data. The providers we use — what each one does for us and the data it handles — are named on our Subprocessors page.
Payments through Whop
Paid plans and top-ups are paid through Whop (whop.com), based in the United States. To open a checkout, we send Whop only your Cluvia account ID and what you are buying, so the purchase reaches the right account. At checkout you give your payment details, billing email and country to Whop directly. Whop uses them to take the payment, send your receipt and prevent fraud. Your country is also used to work out any tax that applies. Whop handles these details under its own privacy policy. Whop then sends us the billing records described above.
Why we use it
- To provide the service (contract): run your companies, store your work, connect the tools you connect, publish what you approve.
- To bill you and keep records (contract, and our legal duties for tax and accounting): your plan, credits, payments and refunds.
- To keep it safe and working (legitimate interests): security, abuse prevention (including the bot check at sign-up and sign-in), debugging, service integrity.
- To understand how the site is used (legitimate interests): anonymous, cookieless visit statistics, as described on our Cookies page. Browsers that send Do Not Track or Global Privacy Control are not counted.
- With your consent where a feature asks for it (for example microphone access); you can turn it off at any time.
- To meet the law where it applies.
Retention and deletion
Your data stays while your account exists. Deleting a company deletes that company's data as described in the app's Companies guide; deleting your account removes your data from the live service. Billing records (your plan history, payments and refunds) are kept for as long as tax and accounting law requires, even after your account is deleted. Backups rotate out on a short schedule.
Your rights
Under the UK GDPR you can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interests. Email usecluvia@gmail.com to exercise them. You can complain to the ICO (UK) or your local data protection authority.
Where data goes
Company data is stored in the UK (London). Our subprocessors may operate beyond the UK/EEA; where they do, the transfer relies on appropriate safeguards such as the UK International Data Transfer Addendum or standard contractual clauses. Each provider — and the data it handles — is listed on the Subprocessors page.
Security
Data is encrypted in transit and at rest. Access to production systems is restricted, and credentials are stored server-side, never in chat.
Children
Cluvia is a business tool and is not intended for children under 13.
Changes
If this policy changes materially, we will say so in the app. Last updated: 7 October 2026.