Clausely Privacy Policy

1. Who we are

Clausely is operated by Golden Genesis UK, a company registered in England. For the purposes of UK GDPR, the data controller is Golden Genesis UK, registered with the Information Commissioner’s Office under registration reference ZC148776. Contact for data matters: support@clausely.co.uk.

2. What personal data we collect

When you use Clausely, we collect: your name, work email address, business name and address, job title of the person accountable for AI use in your business, and details about your organisation’s AI use (sector, headcount, AI tools declared, high-risk categories declared). We also collect payment information via Stripe. We never see or store your card details; Stripe handles this directly.

3. Lawful bases for processing

We process your personal data under two lawful bases: performance of a contract (to deliver the pack you purchased) and legitimate interest (to communicate with you about your order and improve our service).

4. How we use your data

We use your data solely to: generate the compliance documents you purchased, deliver the documents to you, communicate with you about your order, send you the optional annual update notification (if you have not opted out), and comply with our legal and accounting obligations.

5. Who we share your data with

We share your data only with the third-party processors required to deliver the service: Stripe (payment processing), Anthropic (AI document generation; data is not used by Anthropic for model training under our API terms), Resend (transactional email delivery), and Supabase (secure data storage, EU-hosted). We do not sell, rent, or share your data for marketing purposes with any third party.

6. Third Party Services

We use the following data processors to operate Clausely. Each is bound by a data processing agreement and processes your data only as needed to deliver our service:

• Mailchimp (email marketing): processes your email address, business name, and compliance risk level to send you the optional Clausely newsletter and compliance updates you have opted in to receive.
• Resend (transactional email): processes your email address and the contents of order, delivery, and account-related emails so we can send you your compliance pack and order confirmations.
• Stripe (payment processing): processes your name, email address, billing address, and payment card details to take and reconcile your payment. We never see or store your card details.
• Google Analytics (website analytics): processes pseudonymous usage data (pages viewed, device, approximate location) to help us understand how visitors use the site. IP addresses are anonymised. We operate a single GA4 property.
• Google Ads (advertising measurement): processes pseudonymous click and conversion data so we can see which adverts lead to enquiries or purchases.
• Google Tag Manager (tag management): loads and manages the analytics and advertising scripts listed here.
• LinkedIn Insight Tag (advertising measurement): processes pseudonymous visit data to measure LinkedIn campaign performance and support audience matching.
• Microsoft Clarity (behaviour analytics): processes pseudonymous session replay and heatmap data, including clicks and scrolling, to show us where the site is unclear.
• Trustpilot (reviews): loads the Trustpilot review widget and processes the request data needed to display it.
• Anthropic Claude API (document generation): processes the business and compliance details you submit in the intake form to generate your tailored compliance documents. Under our API terms, your data is not used to train Anthropic’s models.
• Hotjar/Contentsquare (behaviour analytics): processes pseudonymous usage data including mouse movements, clicks, scroll depth, and page interactions to help us understand how visitors use the site. Data is anonymised and aggregated. Hotjar does not collect personally identifiable information. You can opt out at: https://www.hotjar.com/legal/compliance/opt-out.

The analytics and advertising services listed above only run if you accept optional cookies in our cookie banner. Until then they are not loaded, and Google Consent Mode signals a denied state for analytics and advertising storage.

7. International transfers

Some of our processors are based outside the UK or EU. Where this is the case, we rely on UK-approved transfer mechanisms including adequacy decisions and standard contractual clauses.

8. Retention

We retain your order data and generated documents for 30 days after delivery on our live systems. After 30 days, download links expire. We retain records of your transaction for 6 years as required by UK tax law. You can request deletion of your personal data at any time, subject to our legal retention obligations.

9. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict processing of, object to processing of, and port your personal data. To exercise any of these rights, emailsupport@clausely.co.uk. We will respond within one calendar month. If you are unhappy with our response, you can complain to the Information Commissioner’s Office at ico.org.uk.

10. Cookies

See our Cookies Policy.

11. Changes to this policy

We may update this policy from time to time. Changes take effect when published on this page.