Privacy Policy

For the account data of businesses that sign up to Clarly, and for people who join our waitlist or contact us, we are the controller.

For the messages, contact details and order data of a business's own customers, the business is the controller and Clarly processes that data on the business's behalf and on its instructions, under our Data Processing Agreement. If you are a customer of a business that uses Clarly, that business decides how your data is used; contact it about your data, and we will help it answer your request.

• Account data: name, work email, business name, password (stored hashed by our authentication provider), two-factor authentication settings, team members and their roles.
• Billing data: plan, invoices and payment status. Our merchant of record and its card processor handle card details; we never see or store full card numbers.
• Connected-channel data from Meta: when a business connects WhatsApp, a Facebook Page or an Instagram professional account, we receive the business account, phone number, page and Instagram account identifiers and names, and access tokens. Tokens are stored encrypted.
• Conversation data processed for businesses: messages, images, voice notes and other media their customers send on WhatsApp, Messenger, Instagram or the website chat; the customer's name, phone number, Meta page-scoped ID or website-chat visitor ID; comments on the business's Facebook and Instagram posts; and whether the customer has agreed to or refused marketing messages.
• Commerce data: products, stock, prices, orders, bookings, delivery addresses and delivery status from the stores and couriers a business connects.
• Technical data: IP address, browser type, pages visited in the console, and error reports used to keep the service working.
• Waitlist and contact forms: the name, email and business name you submit.

We use personal data only for the purposes below, each with the legal basis the PDPL allows:

• Providing the service to a business: receiving customer messages, drafting and sending replies, handing conversations to the business's team, taking orders and bookings, and tracking deliveries. Basis: our contract with the business. For its customers' data, the business is responsible for its own legal basis.
• Running the business account: sign-in, billing, support and service emails about the account. Basis: our contract with the business.
• Keeping records and answering lawful requests, such as tax and accounting records and orders from competent authorities. Basis: legal obligation.
• Keeping the service secure and reliable: preventing abuse and fraud, investigating errors and monitoring performance. Basis: our legitimate interest in a safe, working service.
• Sending waitlist updates and product news. Basis: your consent, which you can withdraw at any time (section 6).

We do not sell personal data. We do not use conversation data or data received from Meta for advertising, and we do not use it to train AI models.

Data we receive through WhatsApp, Facebook and Instagram APIs is used only to provide the messaging, comment-reply and channel-management features to the business that connected the account. We do not share it with third parties except the service providers listed in section 8 that help us run those features, and we do not combine it with data from other sources to profile people. We handle it in line with the Meta Platform Terms and Developer Policies.

Replies to a business's customers may be generated automatically. Incoming messages, images and voice notes are processed by AI language, vision and speech-recognition models to understand the request and draft a reply from the business's own product, price and policy information.

Automated replies can answer questions, take orders and bookings, and agree a price within limits the business sets in advance, such as a minimum price or a maximum discount. Clarly does not take decisions that have legal effects on a person, or similarly significant effects, by automated means alone: the business sets the rules, can review every conversation and take over at any time, and a customer can ask to speak to a person at any time.

Replies are instructed never to diagnose and never to give medical, medication or treatment advice, and to hand those questions to the business's staff. They do not give legal or financial advice.

We send waitlist updates and product news only to people who asked for them. You can withdraw that consent at any time by replying to any of those emails or writing to us. Service emails about your account, such as security alerts and billing notices, are part of the service and are not marketing.

Businesses decide whether to send marketing messages to their own customers and must have the customer's opt-in first. A customer can stop a business's marketing on WhatsApp at any time by replying "STOP MARKETING" or "UNSUBSCRIBE"; replying "STOP" stops all messages from that business. Clarly records the choice and blocks further marketing messages to that customer.

Our website and console use only the cookies and browser storage needed to work: remembering your language, keeping you signed in, and remembering your cookie choice. The website chat on a business's site stores a visitor ID in the visitor's browser so the conversation continues across pages. We use no advertising or analytics cookies. Details are in our Cookie Notice at https://clarly.esap.ai/legal/cookies.

We share data only with providers that process it for us under contract. Each is listed with what it does and where it processes data:

• Meta Platforms: WhatsApp Business Platform, Messenger and Instagram: sending and receiving messages, United States and global.
• Google (Gemini API): AI models that read messages, images and voice notes and draft replies; search indexing of knowledge documents and product photos, United States and global.
• Cohere: Ranking knowledge search results, United States and Canada.
• Supabase: Database, authentication and file storage, Japan (Amazon Web Services, Tokyo).
• Render: Application servers and job queues, Singapore.
• Vercel: Website and console hosting, United States and global edge network.
• Polar (with Stripe as card processor): Subscription billing and payments as merchant of record, United States and European Union.
• Resend: Service emails, United States.
• Sentry: Error monitoring (personal data scrubbed before sending), United States.
• Web3Forms: Website waitlist form, United States.

Businesses that accept our Data Processing Agreement are told before a provider is added or replaced. We may also disclose data where the law requires it, to a competent authority with a lawful request, or to protect the rights and safety of our users or the public.

Personal data is processed outside Saudi Arabia, in the countries listed in section 8, including Japan (database and files), Singapore (application servers) and the United States (AI models, email and monitoring). No personal data is hosted in Saudi Arabia today. We make these transfers under the conditions set by the PDPL and its regulation on transferring personal data outside the Kingdom, relying on the providers' data processing terms and, where required, the standard contractual clauses issued by the Saudi Data & AI Authority (SDAIA). Each provider receives only the data it needs for its task.

• Conversation transcripts, including media: deleted automatically 90 days after the customer's last message in that conversation.
• Raw notifications received from Meta, stores and couriers: emptied after 7 days. A receipt record without message content is kept for 90 days to stop duplicates.
• Short-lived working data, such as agreed price quotes, product drafts and chats with the console assistant: deleted automatically after 30 to 90 days.
• Knowledge documents, products and policies a business uploads: kept until the business deletes them or closes its workspace.
• Meta access tokens: kept until the channel is disconnected, the connecting user removes Clarly from their Facebook settings, or a deletion request is received.
• Audit log of actions in the console: kept while the workspace exists.
• Workspace export files: downloadable for 7 days, then deleted.
• A closed workspace: all of its data is erased 30 days after closure.
• Account and billing data: kept while the account is active and afterwards for as long as tax and accounting law requires.
• Waitlist entries: deleted when you ask or when no longer needed.
• Backups: deleted data can remain in our database provider's encrypted backups until they expire on its rolling schedule.

Data is encrypted in transit with TLS. Access tokens and other credentials are encrypted at rest. Each business's data is kept apart from every other business's by database access rules. Console users can turn on two-factor authentication. Access to production data is limited to staff who need it to run the service, and message content is never written to our application logs.

If a personal-data breach affects data we process for a business, we tell that business within 48 hours of confirming it. Where the PDPL requires, we notify SDAIA within 72 hours, and we tell affected people without undue delay when the breach may harm them.

Under the PDPL you have the right to be told how your data is processed, to access it and obtain a copy, to have it corrected or completed, to have it destroyed when it is no longer needed, and to withdraw any consent you gave. You can use these rights in any of these ways:

• Email privacy@clarly.esap.ai, from the address on your account if you have one. We may ask for information to confirm it is you. We answer within 30 days, free of charge; if the law allows us more time, we will tell you why.
• Business admins can download a full copy of their workspace data from the console's data-export settings, and close the workspace from the console. A closed workspace can be reopened for 30 days, after which all of its data is permanently erased.
• If you connected a Facebook Page or Instagram account: open Facebook Settings → Apps and Websites, remove Clarly, and choose to send a deletion request. We erase the access tokens tied to you immediately, and Meta gives you a confirmation code and a link where you can check the status.
• If you are a customer of a business that uses Clarly, send your request to that business. If you write to us instead, we pass your request to the business and help it answer.

Withdrawing consent does not affect processing that already took place, and we may keep data the law requires us to keep.

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Saudi Data & AI Authority (SDAIA), the competent authority under the PDPL, at https://sdaia.gov.sa, or to the data-protection authority where you live.

Clarly is a business service and is not directed to children under 18. We do not knowingly collect their data for our own purposes.

If Clarly is involved in a merger, acquisition, restructuring or sale of all or part of its business, personal data may pass to the new owner as part of that deal, subject to the law and to protections at least as strong as those in this policy. We will tell account owners before their data becomes subject to a different privacy policy.

We will post any change to this policy on this page and update the date above. If a change is significant, we will also notify account owners by email before it takes effect.

Questions about this policy or your data go to our privacy team: privacy@clarly.esap.ai. Empowering Energy Contracting Company, 7384 King Abdul Aziz Road, Al Murooj District, 4349, Riyadh 12282, Saudi Arabia. Phone: +966 55 329 1748.