Privacy Information

We collect:

• Account data: name, email, role, organisation, locale, language;
• Authentication data: hashed credentials, login timestamps, device/browser metadata;
• Customer business data: the records you create on the platform (clients, products, pipeline, files);
• Usage data: pages visited, features used, error logs;
• Cookie data: see our Cookie Preferences page for details.

We use personal data to:

• Provide, secure and improve the service;
• Authenticate users and protect accounts;
• Provide support and respond to your requests;
• Send service-related notices (you cannot opt out of essential service notices);
• Comply with legal obligations.

Where GDPR applies, we rely on:

• Performance of a contract (operating the service for our customers);
• Legitimate interests (security, service quality, fraud prevention) balanced against your rights;
• Consent for non-essential cookies and direct marketing;
• Legal obligation (tax, accounting, response to lawful requests).

We do not sell your data. We share it only with:

• Sub-processors who help us deliver the service, under contractual data-protection terms. The ones we use today are named below;
• Authorities when required by law or to protect rights, safety or property;
• A successor entity in the event of merger, acquisition or asset transfer (with notice).

Our current sub-processors:

• Supabase — database, file storage and authentication infrastructure. Processes your account data and the business records you create in the platform.
• Resend — transactional email delivery (sign-up, password reset, invoices, notifications). Processes recipient names, email addresses and the content of those messages.
• Anthropic — the AI features. When you use the AI assistant, AI offer drafting or AI insights, the relevant business data from your workspace is sent to Anthropic so the model can answer. AI features are optional: if you do not use them, nothing is sent. Anthropic does not use data submitted through its API to train its models.

We will update this list before adding a new sub-processor.

Your data may be processed in Türkiye and other jurisdictions where our sub-processors operate. Where personal data of EU/UK residents is transferred outside the UK/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses).

We apply administrative, technical and physical safeguards proportionate to the data we hold, including encryption in transit, role-based access, audit logs, regular backups and monitored infrastructure. No system is perfectly secure; if you suspect a vulnerability or incident, please report it to hello@clavix360.app — see our Responsible Disclosure page.

We retain account and customer business data for as long as your account is active. After cancellation, we keep data for a limited period to allow recovery and to comply with legal/accounting requirements, after which it is deleted or anonymised.

Subject to applicable law (including GDPR for EU/UK users and KVKK (Law No. 6698) in Türkiye), you may:

• Access the personal data we hold about you;
• Request correction or deletion;
• Request restriction or object to certain processing;
• Request data portability (where applicable);
• Withdraw consent where processing is based on consent;
• Lodge a complaint with a supervisory authority.

To exercise your rights, email hello@clavix360.app — see our Your Privacy Choices page for the process.

We use a small number of strictly necessary cookies — your signed-in session, security, and your language choice. We do not use advertising cookies, and we do not currently run any third-party analytics or tracking scripts.

Optional functional and analytics categories exist on our Cookie Preferences page so the controls are already in place, but no script is loaded against them today. If that changes, we will ask for consent before any non-essential script runs.

The platform is intended for business use. We do not knowingly collect data from anyone under 16. If you believe we have, please contact us so we can delete it.

We may update this Privacy Information from time to time. Material changes will be notified by email or in-product notice before they take effect.

When you use Clavix360° to hold information about your own clients, employees or suppliers, you are the controller of that data and we act as your processor. A Data Processing Agreement covering that relationship — confidentiality, security measures, use of sub-processors, assistance with data-subject requests, breach notification, and return or deletion of data on termination — is available to business customers on request.

Ask for one at hello@clavix360.app and we will send the current version.

Privacy questions or requests: hello@clavix360.app.

Data controller: [COMPANY LEGAL NAME as registered], [FULL REGISTERED ADDRESS — street, district, city, postal code], Istanbul, Türkiye. VERBİS: [VERBİS REGISTRATION NUMBER].

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the EU/UK, with your local supervisory authority.