Privacy Policy

1. General — who we are and what this covers

ClawEX ("the Service", "we", "us", "our") is an AI-powered build platform operated from Israel by Dror (sole proprietor). This policy covers personal data collected through clawex.chat, all sub-domains, and the ClawEX platform — including the Build engine, the conversational composer, the Visual Editor, the Auto-Admin Panel, and Hosting-tier Project Pods.

It does not cover end-user projects you build on top of ClawEX and host yourself: in those projects you are the data controller for your own end-users, and ClawEX is the processor under our DPA. By using the Service you confirm that you have read this policy.

2. What data we collect

We collect only the data we need to operate the Service, secured by the principle of data minimisation. The Service offers anonymous browsing of the marketing site, legal documents, gallery and blog, plus price estimates without creating an account. In anonymous mode we hold only a session cookie, your country (4-letter code derived from the Cloudflare cf-ipcountry header — not from a GeoIP database we run), and your language / currency preference. Use of the Build engine, the Visual Editor, the composer and all AI features requires signup with an email address (via Supabase Auth or Google OAuth). After signup, the Free tier allows 50 AI actions per month; Pro and Business tiers require a paid subscription via PayPal. Display name is always optional. Categories:

• Account data — email address, optional display name, language preference, account creation date, last sign-in timestamp.
• Authentication data — session cookies (essential, first-party), OAuth tokens when you sign in with Google, hashed refresh-token identifiers. We never see your provider password.
• Usage data — projects you create, prompts you submit to the Build engine, AI-generated outputs we return, feature interactions (which tabs you open), credit balance changes.
• Brain memory data (opt-in/opt-out, per plane) — for platform users we run six per-user memory planes: User Personal Brain (preferences/facts), Build (your prior builds), Library (re-use signal), Jarvis (voice agent context), Chat (composer turns), Support (ticket history). You can opt out, export, or delete-all from the wallet ("ARNAK") tab. Phone-agent and SMS-agent memory planes belong to your end-user projects — for those, you are the controller and ClawEX acts as processor under the DPA.
• Invite data — when you invite a teammate to a project we hold the invitee's email address until the invite is accepted, revoked, or expires. Legal basis: legitimate interest in supporting collaboration; the invitee can opt out by ignoring the link.
• Payment data — handled directly by PayPal. We see only the PayPal transaction ID, the amount, the currency and the resulting credit balance update. We never see card numbers or PayPal account credentials.
• Technical data — for each request to our API we keep, for 90 days, the time, the method, the route template (for a route that does not exist, the length of the path and, only when it begins like one of our routes, that route's prefix, instead of the template, and the number of unrecognised query parameters), the response status, size and duration, the caller's class, the names of the query parameters, and keyed hashes of the IP address and of certain identifiers (not the address itself), to defend against abuse. When certain account or administrative actions are performed, we record the action in an audit log and, where a person performed it, their IP address and user-agent string; the IP address and user-agent string in an audit entry are removed after 24 months. When you accept the Terms, change your consent settings, ask us to delete your account, ask us to correct an AI output, or join or are referred through the affiliate programme, we record the IP address (for the affiliate programme, a salted hash of it) and, where recorded, the user-agent string with that request; they are removed after 24 months.
• Error telemetry — when a server error fires, we may capture the stack trace + request context + your user-id / email / IP via Sentry (sentry.io). This is enabled only in environments where SENTRY_DSN is configured, and is restricted to error events — not normal traffic.
• Communications — emails you send to [email protected], [email protected], [email protected], or [email protected]; in-app feedback you submit through the Feedback widget — which captures the description you write, your email if signed in, your chosen display name, the page URL, and your user-agent string.
• Project content — the source code of the apps you build, the Supabase credentials you provide for the Auto-Admin Panel (encrypted at rest with AES-128 + HMAC-SHA256), the custom domains you connect.

3. Why we collect — legal basis for processing

Under GDPR Article 6, every processing activity must rest on a documented legal basis. Ours are:

• Performance of contract (Art 6(1)(b)) — to deliver the Service you signed up for: account, builds, billing, support.
• Legitimate interest (Art 6(1)(f)) — to defend the Service against abuse, fraud, automated attacks; to keep an audit trail; to monitor reliability and performance. We have run a balancing assessment for each.
• Consent (Art 6(1)(a)) — for Brain memory storage, optional analytics cookies, and any future marketing email. You can withdraw consent at any time without affecting the lawfulness of past processing.
• Legal obligation (Art 6(1)(c)) — to retain financial records for 7 years (Israeli tax law), to respond to lawful requests from competent authorities, to honour data-subject access requests within statutory deadlines.

4. How we use your data

We use the data we collect to:

• Provide and operate the Service — generate AI builds, render the Visual Editor, run the Auto-Admin Panel, route custom domains.
• Authenticate you and protect your account — session management, suspicious-login detection, rate limiting.
• Bill correctly — translate your usage into credit deductions and surface the cost so the "Know the Cost" promise is real.
• Improve the Service — aggregated, anonymised metrics on which features get used. We do not train our own models on your prompts.
• Communicate operationally — send transactional emails (sign-up confirmation, billing receipts, password reset, security alerts).
• Comply with our legal obligations — tax records, lawful disclosure requests.
• We do not sell personal data, do not share with advertisers, do not use it for retargeting, and do not use AI prompts to train our own models.

5. Sharing — subprocessors and disclosure

To run the Service we rely on a small set of subprocessors, each engaged under a written DPA except where the entry below says otherwise. The full live list with regions, purposes and data flows is on our Security page. The current roster:

• Anthropic — Claude API for AI generation. Default 30-day retention; "zero retention" available on enterprise tiers.
• RunPod — cloud compute (GPU/CPU) for the platform backend and Hosting-tier Project Pods.
• Cloudflare — CDN, DDoS protection, R2 object storage (encrypted backups), Tunnel, optional Custom Hostnames.
• PayPal — payment processing for ClawEX credits. The only processor available to Israeli sellers.
• Google Drive — outbox for asynchronous job dispatch between claude.ai and the platform (operational, not user data).
• Resend — transactional email delivery. Resend hands delivery to Amazon SES, its own sub-processor; mail for clawex.chat leaves from the ap-northeast-1 (Japan) region.
• Twilio (Verify) — SMS one-time codes for phone-number verification. Receives the telephone number you submit.
• Telegram — operational alerts to the ops team. Alert bodies can contain personal data, including a recipient's email address in mail-delivery alerts. Not a customer-facing channel; Telegram publishes no Article 28 data-processing agreement.
• Sentry (sentry.io) — error telemetry. When enabled, captured error events are tagged with the user's email and IP so we can correlate a crash to its session. Active only in environments where the DSN is configured.
• Supabase Auth — sign-up / sign-in (email + password, OR Google OAuth). We hold only a refresh-token identifier; the credential itself stays at Supabase / Google.
• We do not sell, rent, or trade personal data with anyone. We disclose to law enforcement only on a valid legal order, and we publish a transparency note when we are legally permitted to do so.

6. International data transfers

Personal data may be processed in the United States (Anthropic, RunPod default region, PayPal, Twilio Verify, Resend), in Japan (Amazon SES — the delivery infrastructure Resend uses for clawex.chat mail), in the European Union (Cloudflare regions, RunPod EU when selected), and in Israel (our operations). For transfers from the EEA / UK to non-adequate jurisdictions we rely on:

• Standard Contractual Clauses (Module 2: Controller-to-Processor; Module 3: Processor-to-Processor) — included in our subprocessor agreements where the receiving country lacks an adequacy decision.
• Supplementary measures — encryption in transit (TLS 1.3) and at rest (AES-128 / AES-256 depending on the data class).
• For enterprise customers with stricter residency requirements we offer EU-region pinning at provision time. The chosen data_region is recorded against every project and surfaced in the Security page.

7. Data retention

We keep data only as long as we need it. Default retention windows:

• Account data — until you delete your account, then 30 days in soft-delete (so you can change your mind), then permanent erasure.
• Projects and builds — until you delete them; backup copies roll off after up to 8 weeks.
• Brain memories — per the retention policy you choose: session-only / 30 days / 90 days / 1 year / forever. You control this in the wallet ("ARNAK") tab.
• Audit log (account and administrative actions) — kept in our primary database; the IP address and user-agent string in an entry are removed after 24 months. Copies of these entries in backups are removed when the backup copy expires. When you accept the Terms, change your consent settings, ask us to delete your account, ask us to correct an AI output, or join or are referred through the affiliate programme, we record the IP address (for the affiliate programme, a salted hash of it) and, where recorded, the user-agent string with that request; they are removed after 24 months. Operational request log — 90 days. Logs preserved for a security investigation — up to 12 months.
• Payment records — 7 years (Israeli tax law).
• Backups — encrypted before they leave the server; database copies are kept for up to 8 weeks, media copies for up to 8 weeks.
• Support and legal correspondence — until the matter is resolved, then archived for 3 years.

8. Your rights

Subject to applicable law you have the right to:

• Access — request a copy of the personal data we hold about you. Self-service Brain-memory export is available from the wallet ("ARNAK") tab; full account export — by emailing [email protected]; we respond within 30 days (GDPR) or 21 days (Israeli law), whichever is sooner. (Self-service full-account export is planned for a future PR; today the export goes through the privacy channel.)
• Rectification — fix inaccurate data, in-product or by request.
• Erasure — "right to be forgotten". One click in account settings — 30-day cancellation window, then automatic erasure of personal data, Brain memories across all planes, and tier records. An immediate-deletion option (type-email-to-confirm) is also available there. Or email [email protected] — acknowledged within 72 hours, fulfilled within 30 days. Legal-hold and tax-record obligations may delay full erasure of certain records (audit and payment records are kept for 7 years).
• Portability — JSON export of your account, projects, and Brain memories.
• Object / restrict — pause a specific category of processing.
• Withdraw consent — anytime, without affecting prior lawful processing.
• Lodge a complaint — with the Israeli Privacy Protection Authority, or with your local EU supervisory authority if you are an EEA / UK resident.
• To exercise any right write to [email protected] — we acknowledge within 72 hours and respond in full within 30 days.

9. Automated decisions and profiling

Per GDPR Article 22 and the equivalent principles under Amendment 13 of the Israeli Protection of Privacy Law: the Service uses AI to generate content (code, text, images, video), to surface personal recommendations (Brain DNA, Library Engine), and to classify project complexity for pricing and estimation. The Service does not make automated decisions producing legal or similarly significant effects on the user — there is no account-rejection logic, no differential dynamic pricing keyed to personal profile, and no credit-style scoring that gates access. Your rights:

• Transparency — every recommendation, price estimate, and classification is shown with the context it is based on (Build, Library, Brain history).
• Human intervention — you can request human review of any AI output or pricing estimate at [email protected]; we respond within one business day.
• Contest and express your view — you can challenge any recommendation and provide additional context; we will manually reconsider.
• Not used to train models — your prompts and data are not used to train our AI models or Anthropic's (this is a contractual commitment Anthropic makes to API enterprise customers).

10. Children's privacy

The Service is not directed at and is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data without verifiable parental consent, contact [email protected] and we will delete the account and data without undue delay.

11. Security

We protect your data with engineering controls plus operational discipline. Highlights — full inventory and live status on our Security page:

• Encryption in transit — TLS 1.3 on every public endpoint, served behind Cloudflare.
• Encryption at rest — Fernet (AES-128 + HMAC-SHA256) for sensitive fields (BYO Anthropic keys, Supabase service-role keys, payment metadata); AES-256 on backups.
• Audit logging — account and administrative actions (for example consent changes, deletion requests, administrator replies, pod start and stop) are written to an audit log.
• Backup automation — encrypted database backups every day and media backups every week, kept off the server for up to 8 weeks, with a weekly restore test.
• Incident response — documented runbook (P0–P3 severity), Hebrew + English customer comms templates, post-mortem template; quarterly drill schedule pre-populated.
• Tenant isolation — application-layer row-scoping today; pod-per-project hardware isolation is provisioned and live for paying Hosting-tier customers; Free-tier projects share the platform.
• 72-hour breach notification — we commit to notifying affected users within 72 hours of confirmed material incidents, plus the Israeli Privacy Protection Authority where applicable.

12. Cookies

We use a small number of first-party cookies and a few necessary third-party cookies (Cloudflare, PayPal during checkout). Full inventory, durations and flags are on our Cookie Policy page. You can change your preferences at any time through the cookie banner.

• localStorage entries we set: clawex-cookie-consent (cookie consent record), clawex-lang (language preference), clawex_supabase_session (Supabase Auth token — necessary for sign-in), clawex_last_tab (the last tab you viewed), clawex_ref (affiliate referral code), jarvis_chat_history (last 50 voice-agent messages), jarvis_tts_engine (TTS engine preference), clawex_push_declined (memory that you declined push notifications). All first-party; clearable via browser DevTools.

13. Changes to this policy

We may revise this policy as the product evolves. For material changes — new categories of data, new subprocessors, new purposes of processing, weakened user rights — we will give 30 days advance notice via email and a banner on the Service. Non-material changes (typo fixes, clarifications) take effect on publication. We keep the last 5 revisions accessible on request.

14. Israeli law specifics

ClawEX complies with the Protection of Privacy Law, 5741-1981 and Amendment 13 (which aligns Israel's regime with GDPR-style data-subject rights effective 2025–2026). Specific to Israeli law:

• Database registration with the Israeli Privacy Protection Authority is undertaken when statutory triggers are met (database scale, sensitive categories). We maintain our own Records of Processing internally and update the registration status on request.
• Right of access under Section 13 — written request to [email protected]; Hebrew or English accepted; response within 30 days.
• Right of correction under Section 14 — same channel.
• Direct-marketing opt-out is honoured immediately on receipt.
• Disputes are governed by the Tel Aviv-Yafo District Court under Israeli law; this section does not deprive consumers of mandatory protections under their local law.

15. Contact

Privacy inquiries, data-subject requests, complaints — write to:

Data Protection contact: [email protected]
Security: [email protected]
Accessibility: [email protected]
Support: [email protected]
General: [email protected]

Postal address available on written request. Response time: 72-hour acknowledgement, 30-day full response.