Who we are
Cleotic is run by General Dataworks DWC-LLC (“we”), a company registered in the Dubai South (Dubai World Central) free zone in the United Arab Emirates.
- Licence number: 13541
- Registered address: 3rd Floor, Building A3, Business Park, Dubai South, Dubai, United Arab Emirates
- Email: privacy@cleotic.ai, for any privacy question or request
- Representative in the UK: Andrew Bright, London, reachable at privacy@cleotic.ai
- Representative in the EU: being appointed
Our two roles
For data about our customers and their users, visitors to our website, people who use our free tools, and people we talk to about sales, we decide how the data is used. We are its controller, and this policy applies in full.
Our customers also bring data to Cleotic: the prompts they track, facts about their brand, drafts, the AI answers we collect for them, and data about visitors to their websites. For that data the customer is the controller and we are their processor. We use it only to provide Cleotic to them, under our Data Processing Agreement. See If a Cleotic customer sent us your data.
What we collect and why
Most of this data comes from you. Some comes from the services we use: WorkOS, which handles sign-in, and Stripe, when you pay.
| What for | Personal data | Legal basis |
|---|---|---|
| Run your account | Name, email address, organisation, role, when you were last active, and sign-in records | Contract |
| Provide the features you use | What you add to Cleotic. In Content Studio, your name (or your email address if you have no name set) goes to the AI model with each message, so it can tell team members apart. | Contract |
| Record that you accepted our terms | Name, email address, an ID made from your user and organisation IDs, the terms version and when you accepted | Contract, and legitimate interests in being able to show who accepted which terms |
| Take payment and keep accounts | Name, email address, plan, subscription and invoices, and what you enter on Stripe’s payment page. We never see card details. | Contract, and legal obligation for accounting records |
| Send emails about your account and the service | Name, email address, and the email’s content, such as a scan result or your weekly brand overview. We tell our email provider about account events, such as sign-up, adding a brand or a site, creating a report and plan changes. | Contract. The weekly overview: legitimate interests in keeping you up to date; turn it off in Settings → Profile. |
| Send marketing emails, if you turned them on | Name, email address, and your trial status | Consent. Turn it off in Settings → Profile or with the unsubscribe link. |
| Run a free tool and email you the result | Website address, email address, time zone, the page you arrived on, the referring page and campaign tags. For the AI Visibility Checker, also your IP address. | Contract: the steps you ask us to take |
| Send occasional tips, if you ticked the box on a free tool | Email address and details of your check | Consent. Withdraw it with the unsubscribe link in any tips email. |
| Understand how the app is used, and find and fix problems | Pages you open and what you click or do, linked to your name, email address and organisation (its name, plan and trial state). Errors and browser console messages. Session recordings with all text and inputs masked. | Legitimate interests in improving Cleotic. This runs for everyone signed in, whatever they chose on our website’s cookie banner. |
| Understand how people find and use our website | Pages viewed, clicks and scrolls, the referring page, device and browser, and approximate location from your IP address. Microsoft Clarity also records sessions. | Consent in the EEA, the UK and the UAE. Elsewhere, legitimate interests in understanding our audience; you can turn it off in cookie preferences. |
| Measure which adverts bring people to us | Ad click IDs and campaign tags, and Reddit and X advertising pixels | Consent in the EEA, the UK and the UAE. Elsewhere, legitimate interests in understanding our audience; you can turn it off in cookie preferences. |
| Know which campaign led to a sign-up | Campaign tags and ad click IDs in the link you signed up through, saved with your new workspace | Legitimate interests in measuring our marketing |
| Reply to a demo request and arrange the call | Name, work email, agency website, how many clients you manage, and campaign tags | Legitimate interests in answering your request |
| Answer support requests | What you send us and our replies | Contract, or legitimate interests in helping you |
| Keep Cleotic secure and prevent abuse | An audit log of each change made in your organisation, with your user ID, IP address and browser. Request logs. Free tool rate limits. | Legitimate interests in security |
| Meet legal duties and handle legal claims | What the matter needs | Legal obligation, and legitimate interests in defending our rights |
We do not sell personal data. We do not use your data, or our customers’ data, to train AI models.
Our CLI and integrations
- CLI. The CLI keeps your sign-in in your operating system’s keychain and its settings in a file on your computer. It sends no analytics. Once a day it checks GitHub for a new version.
- Connected agents (MCP). An AI agent you connect to Cleotic signs in as you and acts with your permissions. For each call we record the tool it used, the agent’s name and version and its user agent. Changes it makes go in the audit log.
- WordPress plugin. The plugin sends nothing until the site owner connects it to Cleotic. When it connects, it sends the site’s name and address and the display name of the WordPress user who connected it. After that it sends visit data, described in the next section.
If a Cleotic customer sent us your data
Customers use Cleotic to see how AI assistants describe their brand and how AI systems visit their websites. Doing that can involve data about you.
If you visited a customer’s website. A customer can connect their site to Cleotic through our WordPress plugin, our code snippet or tracking pixel, or their hosting provider’s logs. For each request we then receive the page, the time, your browser’s user agent, the referring page, other request headers and your IP address.
- This data reaches us through Cloudflare, which carries traffic to our tracking service for us.
- We use the IP address to work out the country and network the request came from, then discard it.
- We keep the IP address only when the request says it comes from a known crawler or bot, such as an AI or search engine crawler, so we can check that claim. We clear it 90 days after we receive it.
- We count visitors with an ID made from the site, the IP address, the user agent and a random value that changes every UTC day. We delete a day’s value when the first request of the next day arrives. After that, an ID can’t be linked to anyone.
- We remove email addresses, IP addresses and long tokens from page addresses, referrers and titles, and drop most values in query strings.
- Our snippet and pixel set no cookies.
- We keep this data until the customer deletes their Cleotic organisation.
If you are named in what a customer tracks. Prompts, brand facts, drafts and AI answers can name people, such as a company’s founder.
The customer decides what to collect and why. To ask about this data or use your rights, contact the customer, such as the owner of the website you visited. If you contact us instead, we will pass your request to them.
Who receives personal data
- Our sub-processors, which host Cleotic and carry its traffic, sign you in, run AI models, send emails and provide product analytics. Our sub-processors page lists them, with what each receives.
- Services we use for our own business, listed below. They receive no data that customers bring to Cleotic.
- Professional advisers, such as lawyers and accountants, who must keep it confidential.
- Authorities, when the law requires it.
- A buyer or investor, if we sell or reorganise our business, under a duty of confidentiality.
| Service | What it does | What it receives |
|---|---|---|
| Stripe | Payments and invoices | Name, email address, organisation ID, and what you enter on its payment page |
| ClickTerm | Records acceptance of our terms | Name, email address, the ID made from your user and organisation IDs, and the acceptance record |
| Inth (c15t) | Our cookie banner | Your cookie choice, with your browser’s user agent and, in the EEA and the UK, your IP address and language, as a record of consent |
| HubSpot | Demo requests and call booking | What you enter in the demo form, and campaign tags |
| Tag Manager and Analytics on our website | Website usage, under the consent rules above | |
| Microsoft | Clarity on our website | Website usage and session recordings, under the consent rules above |
| Reddit and X | Advertising pixels on our website | Website visits, with advertising consent |
| GitHub | Hosts CLI releases | Your IP address when the CLI checks for an update |
International transfers
We are based in the UAE. Our application and database are hosted in the Netherlands. Some of the services we use are in the US or elsewhere; the sub-processors page shows where each one is. When personal data leaves the EEA or the UK, we rely on the EU-US Data Privacy Framework where the company is certified, or on the European Commission’s Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement. The sub-processors page shows the safeguard for each one.
For the services we use for our own business:
- Stripe, HubSpot, Google, Reddit, X and GitHub: the Data Privacy Framework, and the Standard Contractual Clauses with the UK Addendum.
- Microsoft: the Data Privacy Framework with its UK Extension, and the Standard Contractual Clauses.
- Inth: the Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement.
- ClickTerm: none needed. It is an EU company and keeps the data in the EU.
Our team works in the UAE and reaches data from there. For data we process for customers, that access is covered by the Standard Contractual Clauses, with the UK Addendum, in our Data Processing Agreement.
How long we keep it
The last column says how each kind of data is deleted: Automatic our own systems delete it, Provider setting the service that holds it deletes it on schedule, and By hand we delete it ourselves.
| Data | How long | Deleted |
|---|---|---|
| Your account and your organisation’s data | Until the organisation’s owner deletes it, or 60 days after its subscription or trial ends. We email the owner when it ends and 7 days before we delete. Deleting removes everything in our database for the organisation, including members, brands, prompts, answers, reports, AI traffic data and the audit log. Our service providers delete their copies within 30 days, except where our sub-processor page says otherwise. If you still belong to another organisation, your sign-in account, email contact and analytics profile stay until you leave it. Billing records are kept as below. | Automatic |
| Database backups | Up to 89 days. Railway backs up our database every day, week and month, and keeps those backups for 6, 27 and 89 days. It also keeps a continuous archive of changes for about 4 weeks, so we can restore the database to any moment in that time. | Provider setting |
| Billing records | 7 years, as UAE tax law requires | By hand |
| Terms acceptance records | Our copy: until the organisation is deleted. ClickTerm’s copy: under ClickTerm’s own terms. We’ll add the period here once ClickTerm confirms it. | Automatic |
| Free tool checks, with the email and IP address given | 12 months, then the check, email address and IP address are deleted | Automatic |
| Free tool rate limits | Up to a day, as a keyed hash of your IP address, email address and website | Automatic |
| Email contacts, preferences and delivery events | If you have an account: deleted within 30 days of your account being deleted. If you only used a free tool: deleted 30 days after you unsubscribe, or 2 years after your last check, open or click | Automatic |
| Session recordings (PostHog) | 30 days | Provider setting |
| Other product analytics (PostHog) | One year. That is how long PostHog keeps events on our plan. | Provider setting |
| Website analytics (Google Analytics, Microsoft Clarity) | Microsoft Clarity: session recordings for 30 days, and click and heatmap data for 9 months. It keeps a small sample of recordings, and any we save, for up to 9 months. Google Analytics: 14 months. | Provider setting |
| Your cookie choice | One year, then we ask again | Automatic |
| Demo requests (HubSpot) | 2 years after our last contact | By hand |
| Support emails | 7 years after the last message | By hand |
| Server logs (Railway, Vercel) | 30 days | Provider setting |
Your rights
Under the GDPR and the UK GDPR you have the right to:
- get a copy of the personal data we hold about you;
- have it corrected;
- have it deleted;
- have its use restricted;
- get it in a machine-readable format, or have it sent to another company;
- object to how we use it when we rely on legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, without affecting what we did before;
- complain to a data protection authority, such as the one where you live or work. In the UK that is the Information Commissioner’s Office. In the EU, find yours in the European Data Protection Board’s list.
To use a right, email privacy@cleotic.ai. We reply within one month, and may ask you to confirm who you are first. You can change your name and your email choices yourself in Settings → Profile.
Automated decisions
We don’t make decisions about people based only on automated processing that have legal or similarly significant effects on them. Cleotic uses AI to read AI answers, check websites and draft content, but those results are about brands and websites, not about you.
Cookies
We use cookies and similar storage in your browser. Some are needed to sign you in and run the site, and are always set. Others are for analytics and advertising. In the EEA, the UK and the UAE we ask before setting those. Elsewhere they are on unless you turn them off. If you decline analytics on our website, PostHog still counts the visit, without cookies.
You can change your choice at any time with Cookie Preferences at the bottom of every page on our website. If you withdraw consent, analytics and advertising tags already loaded stop when you next load a page.
| Cookie | What it does | How long | When |
|---|---|---|---|
| wos-session | Keeps you signed in | Up to 400 days | Always |
| workos-access-token | Hands your sign-in to the page, which reads and deletes it | 30 seconds | Always |
| wos-auth-verifier-… | Checks that a sign-in started on this site | 10 minutes | Always |
| aiperf_…_continuation | Returns you to what you were doing after you sign in | 30 minutes | Always |
| cleotic_signup_acquisition | Carries campaign tags and ad click IDs from your sign-up link to your new workspace | 30 days | Always, when you sign up |
| c15t | Remembers your cookie choice | 1 year | Always |
| ph_…_posthog | Product and website analytics | 1 year | With analytics consent on our website. Always when signed in. |
| _ga, _ga_… | Google Analytics | Up to 2 years | With analytics consent |
| _clck, _clsk | Microsoft Clarity | Up to 1 year | When Tag Manager loads, after you allow analytics or advertising |
| cleotic_l_attribution | Remembers ad click IDs and campaign tags from our landing pages | 90 days | With advertising consent |
| Reddit and X cookies | Advertising measurement | Set by Reddit and X | With advertising consent |
We also keep a few settings in your browser’s storage, such as your theme, the last brand you opened and your terms status. When you use a free tool, we keep the page you arrived on for that visit.
Children
Cleotic is a service for businesses and is not meant for children. We don’t knowingly collect data about children. If you think we have, email us and we will delete it.
UAE law
Because we are established in the UAE, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) also applies to how we use personal data. It gives you similar rights, and you can use them the same way.
Changes to this policy
When we change this policy we will update this page and the date at the top. If a change affects how we use your data in a significant way, we will also email account holders before it takes effect.
Contact
Email privacy@cleotic.ai, or write to General Dataworks DWC-LLC, 3rd Floor, Building A3, Business Park, Dubai South, Dubai, United Arab Emirates. To report a security issue, email security@cleotic.ai.