Privacy Notice

Clauzo (“we”, “us”) provides the Clauzo service. For the personal data described here we act as the data controller - we decide why and how it is processed. For the client details you enter into your documents, you decide what to collect and we process it on your behalf in order to run the service for you. You can contact us about privacy at o.alqamara@gmail.com.

Because we are established in the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is our lead supervisory authority. We do not need a Data Protection Officer, so privacy requests go straight to the email address above.

Clauzo · Chamber of Commerce (KVK) number 42135759 · VAT identification number (BTW-ID) NL005526069B68

• Account data - your email address, password credentials (stored hashed), and name. Used to create and secure your account and to sign you in. Legal basis: performance of our contract with you.
• Business profile - your business name and logo. Used to brand the documents and PDFs you generate. Legal basis: contract.
• Document content - the job details, terms, and client name and email you enter, plus generated document text. Used to generate your documents, store them in your dashboard, and send signature links. Legal basis: contract.
• Signature records - the name your client types, the timestamp of their agreement, and a log of when a signing link was created, viewed, emailed, and signed. Used to evidence the signature. Legal basis: contract and our legitimate interest in a reliable audit trail.
• Billing records - plan and subscription status, purchase and credit history, and payment provider identifiers. Used to give you the right access and show your billing history. Legal basis: contract and legal obligation. Card details are collected by our payment provider, not by us.
• Technical and usage data - IP address, device and browser information, and logs of errors and requests. Used for security, fraud prevention, troubleshooting, and improving the product. Legal basis: legitimate interests.
• Support messages - what you send us by email. Used to answer you. Legal basis: legitimate interests.

• Service providers that host our application and database, deliver our emails, and help us operate and support the service. They act on our instructions under contract.
• Hosting and platform infrastructure provided by Lovable and its underlying cloud and database providers, which run the application, store your account, documents, and signature records, and process our email delivery. They act as our processors under a data processing agreement.
• Paddle.com, our Merchant of Record, for the sale of our plans, subscription management, payments, tax compliance, and invoicing.
• Your clients, who receive the signature link and document you choose to send them.
• Professional advisers such as legal and accounting advisers, where needed.
• Authorities, where we are required to disclose data by law.
• Google (Google Ireland Limited and Google LLC), for advertising through Google AdSense and for website measurement through Google Analytics 4, but only on our public pages and only if you accept the advertising or analytics cookie categories.

We never sell personal data, and the contracts, client details and signature records inside your account are never shared with advertising or analytics providers.

Our public pages, such as the homepage, can display ads served by Google AdSense (publisher ID pub-9281992057838661). Ads help us keep a free contract available. Ads are never shown inside your signed-in account, on signing links, or in the documents you generate.

If you accept advertising cookies, Google and its partners may set cookies or similar identifiers and receive your IP address, device and browser information, and the pages you view on our site. They use this to select and measure ads, which may include personalised advertising based on your activity across sites. Legal basis: your consent, which you can withdraw at any time.

If you decline advertising cookies, we do not load the Google AdSense script at all, so no ad cookies are set. You can also review Google's own controls at policies.google.com/technologies/ads and opt out of personalised ads at myadcenter.google.com.

If you accept analytics cookies, we use Google Analytics 4 to understand how the site is used - which pages are visited, how visitors arrive, and whether key steps such as creating an account or downloading a contract were completed. We use this only in aggregate to improve the product. Legal basis: your consent.

Google Analytics processes your IP address (shortened by Google before storage), device and browser information, approximate location derived from the IP address, and the events described above. We do not send your name, email address, client details, or any document content to Google Analytics. Analytics data is retained for at most 14 months.

If you decline analytics cookies, the Google Analytics script is never loaded and no measurement takes place.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards, such as an adequacy decision or Standard Contractual Clauses, to protect the data.

We keep your account, documents, and signature records for as long as your account is active, so your contracts remain available to you.

• Account, documents and signature records: for the life of your account, then deleted or anonymised within 30 days of you closing it.
• Billing and transaction records: 7 years after the transaction, as required by Dutch tax law (fiscale bewaarplicht).
• Email delivery and signature audit logs: 12 months.
• Technical and security logs: up to 90 days.
• Support email correspondence: 24 months after the conversation ends.

Under the GDPR you have the right to access your data, correct it, have it deleted, restrict or object to processing, receive a portable machine-readable copy, and withdraw consent where we rely on it. Email o.alqamara@gmail.com with the subject line “Data request” and we will respond within one month. You can also complain to the Autoriteit Persoonsgegevens in the Netherlands or to the supervisory authority where you live.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls so each account can only reach its own records, hashed passwords, and private storage for uploaded logos. No system is completely secure, so please use a strong, unique password.

We use cookies and similar local storage in three categories. Strictly necessary cookies keep you signed in, secure your session, and remember your language and currency; these are always active and the service cannot work without them. Analytics cookies (Google Analytics 4) and advertising cookies (Google AdSense) are optional and load only after you allow them.

When you first visit the site we ask for your choice in a cookie banner. Nothing optional is loaded before you accept. You can change or withdraw your choice at any time using the “Cookie preferences” link in the site footer, or by clearing cookies in your browser settings.

If we change this notice we will update the date at the top of this page and, for significant changes, let you know in the app or by email.