Privacy Policy

Effective September 18, 2026 · version 2.0 (U.S.)

1. Who we are

Controller / Business: LEGAL ENTITY NAME, STATE, ADDRESS — FILL IN
Contact for privacy requests: todi.prof@gmail.com
This policy is written for U.S. law, primarily the California Consumer Privacy Act as amended by the CPRA (CCPA), plus other applicable U.S. state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and similar). International users: see §11.

2. Categories of information we collect

Identifiers & account data: name, email, password hash (we never see or store your plain password), company name.
Customer content you provide: deals, contacts, messages with your clients, knowledge base, uploaded files, support tickets.
Technical data: IP address, browser/device type, login history, Cloudflare Turnstile anti-bot results.
Payment data (paid plans): processed by our payment provider; full card numbers never touch our servers.

We do not collect Social Security numbers, precise geolocation, or other CCPA «sensitive personal information» beyond what is strictly needed to run your account.

3. Purposes

Operating the service (accounts, CRM, AI replies, support).
Security and abuse prevention (login protection, rate limiting, bot detection).
De-identified product analytics.
Marketing emails — only with separate opt-in, one-click unsubscribe.

4. AI processing

AI agents answer your clients using your company's data only. One company's data is never visible to another and is not used to train shared models. AI can make mistakes — verify important replies, prices and promises (see Terms).

5. No sale or sharing

We do not sell personal information and do not share it for cross-context behavioral advertising. Service providers below process data only on our instructions:

hosting infrastructure;
Cloudflare (bot protection, CDN);
Resend (transactional email);
LLM inference providers (message text for AI replies, minimized);
payment provider (billing).

B2B clients: DPAs available on request. Disclosures to authorities — only as required by law.

6. Retention

Account and content — for the life of the contract + 3 years for disputes, then deletion/anonymization.
Security logs — 1 year.
Backups — 14-day rotation.
Support tickets — 3 years.
Billing records — as required by tax law.

7. Security

HTTPS everywhere (HSTS), bcrypt password hashes, expiring revocable session tokens;
strict company isolation + role model; admin 2FA;
backups, access logging, data minimization.

No system is perfectly secure; California law requires reasonable safeguards — that is our standard. We will notify affected users and authorities of a breach as required by state breach-notification laws.

8. Cookies and tracking

Strictly necessary (always on): login session, language choice, cookie-banner flag. No advertising trackers.

Your choices: the banner offers «necessary only». Clearing site data in your browser ends the session and resets choices. We honor the Global Privacy Control (GPC) signal as an opt-out of any non-essential processing, per CCPA regulations. Policy version is dated above; new categories will trigger a fresh consent request.

9. Children (COPPA)

The service is not directed to children under 13, and we do not knowingly collect their data. Accounts for ages 13–17 require parent/guardian consent. If you learn of such an account, tell us — we will delete it.

10. Your U.S. privacy rights

Depending on your state (CA, VA, CO, CT, UT, TX, OR and similar): right to know/access, delete, correct, opt out of sale/sharing (not applicable — we don't sell, but the mechanism exists), limit sensitive data use, non-discrimination, and appeal a denial.

How: email from your account address. We verify identity against the account, then respond within 45 days (extendable once where the law allows).
Authorized agents: accepted with signed permission + your direct verification.
Appeal: reply to a denial within a reasonable time; we reconsider and explain in writing.
Account deletion with data export is also available via support within 30 days.

11. International users

Our infrastructure is U.S.-based; if you use the service from outside the U.S., your data is transferred to the U.S. EU/UK users: we apply GDPR principles (lawfulness, minimization, DPA on request); complaints may go to your local supervisory authority.

12. Changes

Material changes announced in-app or by email 14 days ahead; continued use after effect = acceptance. Archived versions available on request.

Contact: todi.prof@gmail.com, t.me/openclaw_pro. English text prevails.