Privacy Policy

Clause50 is currently in pre-release testing. No real customer data is processed in production, and the service is not yet open to new external users. This notice, and the “not appointed” EU-representative state below, will be updated together before that changes.

Clause50 acts as both a controller and a processor, for different data — stating one role for everything would be wrong in both directions.

As controller, for the data needed to run your account: your email address (the account identifier and credential — sign-in is a passwordless magic link), your organisation name, your role, your plan, and an append-only activity log of actions taken on your account (including by Clause50 staff, so operator access is visible to you). We also send transactional email (sign-in links, compliance-gap alert digests) via our email provider.

As processor, for whatever your own connectors or uploads bring into your AI System Record on your instructions — intake answers, connector-sourced evidence (aggregate usage counts, commit references, or your own manual imports), and the documents Clause50 generates from them. You are the controller for that data; our Data Processing Agreement is the instrument governing it.

• Contract (Art. 6(1)(b)) — account creation, plan administration, and processing your AI System Record on your instructions.
• Legitimate interests (Art. 6(1)(f)) — the application activity log (security, abuse investigation, and your own accountability evidence) and compliance-gap alert emails.
• Consent (Art. 6(1)(a)) — used only where we actually ask for it: the optional free-scan result email, which requires an explicit, unchecked-by-default consent tick and is never stored once sent.

Account and activity data is retained for the life of your account. Evidence and activity-log records are held in tamper-evident, append-only chains by design — this makes row-level deletion impossible without invalidating the chain, so retention for that data is enforced at the organisation/system level rather than the individual record (see “Your rights” below). On cancellation your organisation moves to a read-only state rather than being deleted immediately: artifacts you have already generated stay downloadable and independently verifiable for 6 months from cancellation, after which account data is deleted.

We use a small number of subprocessors to provide the service — see Subprocessors for the full list, their location, and what reaches them. We do not sell your data, and we do not use it for advertising.

Clause50 is operated from India, which has no EU adequacy decision under GDPR Chapter V. Two transfers follow from that:

• Administrative access. Clause50's operator (based in India) can, in limited, audited circumstances, read account and system metadata for support and troubleshooting. This is a transfer of data out of the EU requiring an Art. 46 safeguard, and every such access is logged into your own account's activity trail so it is visible to you.
• Processor-side transfer. If you are established in the EU/EEA, sending your data to Clause50 as a processor in India is a restricted transfer that you, as controller, must legitimise — typically via Standard Contractual Clauses. Our DPA is where this is documented.

Where practical, data at rest is kept in EU infrastructure regardless of where it is administered from — see Subprocessors for the current hosting regions.

Subject to identity verification, you can ask us to access, rectify, restrict, or object to processing of your account data, and to receive it in a portable format. Signed-in account owners can also export their own account data directly from the app (Settings → Legal).

Erasure. We do not offer self-serve account deletion. Physically deleting a row from the middle of a tamper-evident evidence or activity chain would silently break the chain for every record after it — so erasure is honoured as an operator-assisted, audited, whole-account (or whole-system) procedure instead: your account identifiers are irreversibly tombstoned, your systems' evidence and generated documents are deleted, and the chain-position for the erasure itself is recorded before anything else happens. The activity log itself is retained in pseudonymised form as our own accountability record.

To exercise any of these rights, contact admin@clause50.com. We respond within one month of a verified request, as required by Art. 12(3) GDPR.

If any of the data you are asking about was submitted to Clause50 by one of our customers (for example, inside their evidence), we act only as processor for that data and will refer you to the relevant customer as controller.

See Cookie Policy for exactly what is set today.

We will update the version and effective date above whenever this policy changes materially, and — for account holders — this is tracked against the version you most recently accepted.