Privacy Information

We collect:

• Account data: name, email, role, organisation, locale, language;
• Authentication data: hashed credentials, login timestamps, device/browser metadata;
• Customer business data: the records you create on the platform (clients, products, pipeline, files);
• Usage data: pages visited, features used, error logs;
• Cookie data: see our Cookie Preferences page for details.

We use personal data to:

• Provide, secure and improve the service;
• Authenticate users and protect accounts;
• Provide support and respond to your requests;
• Send service-related notices (you cannot opt out of essential service notices);
• Comply with legal obligations.

Where GDPR applies, we rely on:

• Performance of a contract (operating the service for our customers);
• Legitimate interests (security, service quality, fraud prevention) balanced against your rights;
• Consent for non-essential cookies and direct marketing;
• Legal obligation (tax, accounting, response to lawful requests).

We do not sell your data. We share it only with:

• Sub-processors who help us deliver the service, under contractual data-protection terms. The ones we use today are named below;
• Authorities when required by law or to protect rights, safety or property;
• A successor entity in the event of merger, acquisition or asset transfer (with notice).

Our current sub-processors:

• Supabase — database, file storage and authentication infrastructure. Processes your account data and the business records you create in the platform.
• Resend — transactional email delivery (sign-up, password reset, invoices, notifications). Processes recipient names, email addresses and the content of those messages.
• Anthropic — the AI features. When you use the AI assistant, AI offer drafting or AI insights, the relevant business data from your workspace is sent to Anthropic so the model can answer. AI features are optional: if you do not use them, nothing is sent. Anthropic does not use data submitted through its API to train its models.

We will update this list before adding a new sub-processor.

Your data may be processed in Türkiye and other jurisdictions where our sub-processors operate. Where personal data of EU/UK residents is transferred outside the UK/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses).

We apply administrative, technical and physical safeguards proportionate to the data we hold, including encryption in transit, role-based access, audit logs, regular backups and monitored infrastructure. No system is perfectly secure; if you suspect a vulnerability or incident, please report it to info@clavix360.app — see our Responsible Disclosure page.

We retain account and customer business data for as long as your account is active. After cancellation, we keep data for a limited period to allow recovery and to comply with legal/accounting requirements, after which it is deleted or anonymised.

Subject to applicable law (including GDPR for EU/UK users and KVKK (Law No. 6698) in Türkiye), you may:

• Access the personal data we hold about you;
• Request correction or deletion;
• Request restriction or object to certain processing;
• Request data portability (where applicable);
• Withdraw consent where processing is based on consent;
• Lodge a complaint with a supervisory authority.

To exercise your rights, email info@clavix360.app — see our Your Privacy Choices page for the process.

We use a small number of strictly necessary cookies — your signed-in session, security, and your language choice. We do not use advertising cookies.

We also use Google Analytics 4, and only with your consent. Nothing optional runs before you choose: Google’s script is not requested from our pages at all until your consent is recorded, so there is no stage at which a tag is loaded and asked not to measure. You can change or withdraw your choice at any time from the “Manage preferences” link in the footer of any page, and our Cookie Policy names every cookie and storage key individually, with its lifetime.

The platform is intended for business use. We do not knowingly collect data from anyone under 16. If you believe we have, please contact us so we can delete it.

We may update this Privacy Information from time to time. Material changes will be notified by email or in-product notice before they take effect.

When you use Clavix 360° to hold information about your own clients, employees or suppliers, you are the controller of that data and we act as your processor. A Data Processing Agreement covering that relationship — confidentiality, security measures, use of sub-processors, assistance with data-subject requests, breach notification, and return or deletion of data on termination — is available to business customers on request.

Ask for one at info@clavix360.app and we will send the current version.

Privacy questions or requests: info@clavix360.app.

Data controller: HUBLİNKLY AI YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ, Istanbul, Türkiye. Registered office address: Vadistanbul Park, 7C Blok, No: 7D/15, Ayazağa Mah., Kemerburgaz Cad., Sarıyer / İstanbul, Türkiye. VERBİS registration number: to be confirmed.

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the EU/UK, with your local supervisory authority.