Privacy policy.

Who this covers

This policy covers the Clarhet service and this website, provided by Clarhet Inc. Where your organisation is the customer, that organisation controls the business data connected to Clarhet, and we process it on their instructions.

What we collect

Account data: name, business email, role, organisation, and billing details needed to run the subscription.

Connected source data: the records, figures, documents, and messages you nominate as sources, plus what the agents derive from them, such as reconciled figures, citations, and the daily read.

Usage data: logs of how the product is used, including agent actions, so we can operate the service, investigate problems, and show you the trail behind each item.

How we use it

To deliver the service: reach the sources you connect, reconcile what is found, assemble the read, and keep an audit trail behind every figure.

To support and secure the account: respond to your requests, detect abuse, and meet legal obligations.

To improve the product using aggregated, de-identified operational metrics. We do not use your business data to train models, and we do not sell, rent, or share it for advertising.

Subprocessors and models

We use a small set of infrastructure and model providers to run the service. Providers are bound by contract to process data only on our instructions, and model providers are contractually barred from training on your data. A current list of subprocessors is available on request.

Today that set is Neon (database), OpenAI (models), Vercel (application hosting), and Resend (transactional email). We will publish an updated list before general availability, and we will give notice here before adding a subprocessor that handles your business data.

Retention and deletion

Connected source data is retained while the source is connected and for a short window afterwards so a read can be rebuilt. Disconnect a source and processing stops; figures that depended on it are marked unverifiable rather than estimated.

You can act on this yourself at any time from Settings: export your organisation's data as a JSON file, or delete it. Deletion covers the content the agents assembled and is limited to owners and admins. Deleted content is hidden immediately and purged after thirty days; the account and organisation record themselves remain until you close the account.

On termination we delete or de-identify customer data within thirty days, except where retention is required by law. Backups age out on their own schedule.

Security

Data is encrypted in transit and at rest. Access is scoped to your team and your sources, administrative access is limited to the people who need it, and agent actions are logged. SOC 2 is underway as we grow; a security overview is available for review.

Your rights

Depending on where you are, you may have rights to access, correct, export, or delete personal data, and to object to certain processing. If your organisation is the customer, we will refer a request to them and support them in answering it.

To exercise a right, or to ask a question about this policy, write to hello@clarhet.ai.

International transfers and cookies

Data may be processed in countries other than your own. Where that happens we rely on recognised transfer mechanisms and contractual safeguards.

This website uses only the cookies needed to run it and to understand aggregate traffic. We do not use advertising cookies or third-party trackers for profiling.

Changes to this policy

We will post changes here with a new date, and give notice of material changes before they take effect.