Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information. When you create an account we collect your email address and authentication identifiers. Authentication is handled by our provider (Supabase); we do not store your password.
• Workspace & client content you provide. Information you enter about the brands and clients you manage — for example brand names, website URLs, brand briefs, and notes.
• Publicly available website content. When you add a client, we retrieve and analyze publicly accessible pages from the website URL you provide in order to generate research and creative recommendations.
• Advertising data from Meta. If you connect a Meta account, we access advertising data through the Meta Marketing API as described in Section 2.
• Usage & device data. Standard log information such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service.

2. Information from Meta (Facebook & Instagram)

The Service integrates with the Meta Marketing API. When you choose to connect your Meta account, you authorize us — through Meta’s OAuth flow — to access certain data associated with the ad accounts you select. Depending on the permissions you grant, this may include:

• Your Meta user ID and basic profile information returned by the login flow;
• The list of ad accounts, Pages, and businesses you have access to;
• Advertising objects and performance insights — campaigns, ad sets, ads, ad creatives (including creative copy and asset references), spend, impressions, and other performance metrics;
• OAuth access tokens used to make authorized API requests on your behalf.

We use this data solely to provide the Service to you — for example, syncing ad performance, analyzing creative, and producing strategy recommendations within your workspace. We do not sell Meta data, and we do not use it for advertising or share it with data brokers. Our access, use, and storage of data obtained through the Meta Marketing API also complies with the Meta Platform Terms and Developer Policies. You can revoke our access at any time (see Section 8).

3. How we use information

• To provide, operate, and maintain the Service and your workspace;
• To generate research, audience profiles, creative angles, scoring, and other analytics from the content and advertising data described above;
• To sync and display your Meta advertising performance;
• To authenticate you, secure the Service, and prevent abuse;
• To communicate with you about the Service, including support and service notices;
• To comply with legal obligations and enforce our terms.

We use third-party AI providers to process content you submit and data retrieved on your behalf in order to generate analysis and recommendations (see Section 6). We do not permit these providers to use your data to train their models.

4. Legal bases for processing

Where the GDPR or similar laws apply, we process personal data on the basis of: performance of our contract with you (to provide the Service); your consent (for example, connecting a Meta account); our legitimate interests (to secure and improve the Service); and compliance with legal obligations.

5. How we share information

We do not sell your personal information. We share information only as follows:

• With service providers and subprocessors who process data on our behalf under contract (Section 6);
• Within your workspace — content and results are visible to authorized members of the workspace to which they belong;
• For legal reasons — to comply with law, enforce our agreements, or protect the rights, safety, and security of users and the public;
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Service providers & subprocessors

We rely on the following providers to operate the Service. Each processes data only as needed to provide their function:

• Supabase — database, authentication, and storage;
• Railway — application hosting and delivery;
• Inngest — background job orchestration;
• Anthropic (Claude) — AI analysis of submitted content;
• Perplexity — AI-assisted market research;
• Firecrawl — retrieval of publicly available website content;
• Meta Platforms — the source of advertising data you connect.

7. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When you disconnect a Meta account, we stop making API requests and delete or revoke the associated access tokens. When you delete content or your account, we delete the associated data within a commercially reasonable period, except where retention is required by law.

8. Your rights & data deletion

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise these rights as follows:

• Disconnect Meta / revoke access. You can disconnect your Meta account in the app at any time, or remove Clarity from your Meta account under Settings & privacy → Settings → Business integrations. Revoking access immediately stops further data access.
• Delete your data or account. Email privacy@clarity.app with the subject “Data deletion request,” and we will delete your personal data and any data obtained via the Meta Marketing API associated with your account, subject to legal retention requirements.
• Other requests. Contact us at privacy@clarity.app to exercise any other right. We will respond within the timeframe required by applicable law.

For step-by-step deletion options, see our dedicated Data Deletion page.

9. Security

We use administrative, technical, and organizational measures designed to protect your information, including encryption in transit, access controls, and scoped credentials for third-party integrations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International data transfers

We and our service providers may process and store information in countries other than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers of personal data.

11. Children’s privacy

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at:

Clarity
privacy@clarity.app