Privacy Policy

• Account: your name, email address and password. Passwords are stored only as a one-way hash.
• Identity verification: your ID document and selfie go to our identity verification provider, Stripe or Didit, which checks them. The verification screen names the one running your check. We receive the outcome and a reference to the check, not copies of your ID or selfie.
• Payments: Stripe handles your card. We keep a Stripe customer reference and each line’s subscription status.
• Texts your lines receive: the sender, the message, when it arrived and any code we detect in it. Calls to and from your lines are recorded, after a short notice that the call may be recorded, and transcribed. We keep the recording and the transcript with the number on the other end of the call.
• Settings and teams: email-forwarding choice, your Telegram chat if you connect one, webhook URLs, API key names (keys themselves are stored only as hashes), workspace members and invite emails.
• Security data: to stop abuse we count requests per IP address and account. These counters store only one-way hashes and are deleted when their time window ends. Our hosting providers also keep standard request logs.
• Email we send you: who it went to, when, its subject and whether it was delivered, kept for a year so we can help when one doesn’t arrive. Never what it said; for texts forwarded to you by email, not even the subject.
• Waitlist: your email, if you ask to hear about Cleat Full.
• Visits to our website: described in full under Visit measurement below.

• to run Cleat: set up lines, show your texts and deliver them where you ask;
• to verify identities and prevent fraud and abuse;
• to bill you;
• to send account email, such as password resets, security notices and team invites;
• to understand which pages and campaigns bring people to Cleat, and to test versions of our pages;
• to meet legal obligations.

On our public pages (the home page, pricing, trust, guides, comparisons, audience pages, sign-up, log-in and these legal pages, in every language) we measure visits ourselves: to learn which pages and campaigns lead to sign-ups and payments, and to test versions of those pages. It runs on Cleat’s own servers and stays in Cleat’s own database. No analytics company receives any of it. Separately, and only as described under Advertising measurement, Meta and OpenAI receive a narrow set of events to measure our ads.

• Every page view: the page and its language; your country, state or province, and city, from our hosting provider’s network location (never a street or a precise position); the address of the site you came from (its domain only, never the page); your device type and your browser and operating system families (never versions or the full browser string); and a code made from your IP address with a key that changes every day and is never stored, so the code can’t be linked from one day to the next. We never store your IP address.
• Time on page and scroll depth: how many seconds a page was open in a visible tab while you were using it, and how far down you scrolled, in percent. Never what you typed, where you moved the pointer, or anything you read or selected.
• With a visitor cookie (cleat_vid, see Cookies): a random id that groups your visits into sessions; the campaign tags in the link you followed (such as utm_source); which buttons you click, which sections of the page you scroll to and which questions you open; and which version of a page you were shown. When you sign up or log in, we link that id to your account, so we can see which visits and campaigns led to accounts and payments.
• Ad click ids (such as gclid or fbclid in a link from an ad) are kept only outside the EU/EEA, the UK, Switzerland and Quebec, never when your browser sends Global Privacy Control or Do Not Track, and only for 90 days. We don’t send them anywhere; Meta’s and OpenAI’s own cookies do that job, as described under Advertising measurement.
• Automated traffic such as search-engine crawlers is recognised by its browser string, its behaviour and its request rate, and left out of our figures.

Where we ask first. In the EU/EEA, the UK, Switzerland and Quebec, no visitor cookie is set and nothing that identifies your browser is kept until you choose Accept on the banner. Accept all there also allows ad measurement with Meta and OpenAI, and Choose lets you allow visit measurement without it. Until then, and if you choose Decline, we record only the page view as described in the first point, and you always see the standard version of our pages. Everywhere else, measurement is on by default, on the basis of our legitimate interest in understanding and improving our website, and you can turn it off below at any time: that removes the cookie, and from then on we keep only page views without an identifier. Your choice is remembered for 6 months.

When you arrive from a link that carries campaign tags and then sign up, we keep the campaign’s name with your account so we know which of our campaigns brought customers; we don’t use cookies for this, we don’t share it with advertising platforms, and we do it on the basis of our legitimate interest.

When you use the chat on our website or in the app, we keep:

• the messages you and our team write, and the email address you leave for us to follow up, if you leave one;
• which account you’re signed in to, if you are, so we can see what you’re asking about;
• your IP address, kept for 90 days to prevent abuse and fraud and then erased, with the country, state or province and city it places you in, your device type, your browser and operating system families, your language and the page you started the chat on;
• a cookie, cleat_support, that keeps your conversation in your browser. The chat needs it to work, so it’s set when you send your first message, whatever you chose on the banner, and lasts 90 days.

Answers may come from an AI assistant. It reads the conversation and, if you’re signed in, looks up your account’s lines (their numbers, status and renewal dates, never the texts they receive), your billing and invoices, and where your identity check stands. It can point you to your billing page and email you a copy of one of your invoices; it can’t change your plan, charge you or refund you. Our team can read every conversation and take it over at any time. To have a conversation deleted, email contact@cleat.so.

Only the providers that help us run Cleat, each for its part:

• Stripe: payments and identity verification.
• Didit: identity verification.
• Resend: sending email, including texts you choose to forward by email.
• Telegram: texts you choose to forward there.
• OpenRouter, and the AI model provider it sends requests to (Anthropic): support chat messages and, for a signed-in customer, the account details the assistant looks up (never your texts), to write its answers.
• OpenRouter, and Google through it: call recordings, to transcribe them.
• OpenAI: voicemail recordings, to transcribe them.
• Telecommunications partners: they provide the numbers and route texts and calls to us.
• Database and hosting providers: they store and serve Cleat’s data for us. Call recordings are stored with Vercel Blob.

Texts also go wherever you point them: your teammates, your webhook endpoints and apps using your API keys. We may disclose information when the law requires it, to protect people or Cleat from harm, or to a company that takes over Cleat, which would stay bound by this policy.

• Account data, texts and call transcripts are kept until you delete the workspace or your account.
• Call recordings and their transcripts are kept for two years from the call, including after a line or account is deleted, so we can answer lawful requests from authorities. They are then deleted, unless a legal hold requires us to keep them longer.
• Password-reset links expire after an hour; abuse counters are deleted when their window ends.
• Billing records are kept as long as tax and accounting law requires.
• Visit measurement: page views, sessions and campaign visits are deleted after 25 months, and visits from automated traffic after 90 days. Ad click ids are removed 90 days after the visit. A visitor id not seen for 25 months is deleted, unless it’s linked to an account. Records of which page version someone saw are deleted 6 months after the test ends. When you delete your account, the links between it and your visits are deleted too.
• Backups held by our providers can persist for a limited time after deletion.

• If you’re an affiliate: your code, the legal name, address, tax number and bank account you give for payouts, and each withdrawal. Bank details are stored encrypted and read only by our team to make a transfer you’ve requested, which is recorded. Payout invoices are kept as accounting records, including after you delete your account; your bank details are deleted with it.
• If you came through an affiliate: we record which affiliate and when. They see a masked version of your email address (like ma•••@gmail.com) and the amounts their commissions come from, never your texts, number or full address.

To see which of our ads on Meta (Facebook and Instagram) and in ChatGPT (OpenAI) lead to sign-ups and purchases, our public pages load Meta’s and OpenAI’s pixels, and our servers send them the same events through their Conversions APIs. In the EU/EEA, the UK, Switzerland and Quebec this happens only after you accept it on the banner (Accept all, or advertising under Choose); elsewhere it runs unless you turn it off under Visit measurement. Never when your browser sends Global Privacy Control or Do Not Track, and never for automated traffic.

• What Meta and OpenAI receive: views of our public pages; that an account was created; that a checkout was started, with its plan and price; and that a purchase was completed, with its amount. With these, your IP address and browser string, their own cookies, and your email address and account id as one-way hashes. Never your texts, your phone number, your identity documents or your card.
• How they use it: to report on and improve the delivery of our ads, under their own terms and privacy policies (Meta, OpenAI).
• Your choice: turn ad measurement off on its own under Visit measurement, or turn visit measurement off to stop both. Global Privacy Control is honoured as an opt-out of sharing for advertising.

Cleat sets its own cookies. Where advertising measurement runs, Meta and OpenAI set their own too.

• Needed for Cleat to work: one keeps you signed in, one remembers which workspace you’re viewing, and one remembers a language you chose.
• cleat_vid: a random visitor id for visit measurement and page tests, as described above. It lasts 13 months from your first visit and isn’t extended when you come back. In the EU/EEA, the UK, Switzerland and Quebec it’s set only after you accept; anywhere, you can turn it off under Visit measurement.
• cleat_consent: remembers your visit-measurement choice for 6 months. It’s set only once you make one.
• cleat_via: the affiliate code in a link you followed, so the affiliate is credited if you sign up. It lasts 60 days and is set only where visit measurement is allowed.
• cleat_support: keeps your support chat open in your browser. It’s set when you send your first message, is needed for the chat to work, and lasts 90 days (see Support chat).
• _fbp and _fbc: set by Meta’s pixel, only where advertising measurement runs, to connect a visit or an ad click to a later sign-up or purchase. _fbp lasts 90 days.
• __oppref and __obref: set by OpenAI’s pixel, only where advertising measurement runs, to connect a visit or an ad click in ChatGPT to a later sign-up or purchase. __oppref lasts 30 days, __obref a year.

• Update your name, turn email forwarding off, disconnect Telegram or revoke API keys in Settings.
• Delete your account in Settings; it removes the workspaces you own and their texts.
• Turn visit measurement on or off for this browser under Visit measurement. We treat Global Privacy Control and Do Not Track as a request not to keep ad click ids, wherever you are.
• Ask for a copy of your data, a correction or a deletion by writing to contact@cleat.so. Depending on where you live, for example California, the EU or the UK, you may have further rights, and we’ll honour them as the law requires.

Connections are encrypted, passwords and keys are hashed, webhooks are signed, and texts are visible only to members of the workspace that owns the line. No system is perfectly secure; if we learn of a breach that affects you, we’ll tell you as the law requires.

Cleat isn’t for anyone under 18. We process data in the United States. If we change this policy in a meaningful way, we’ll tell you by email or in the app first. The Terms of Service also apply.

Questions or requests about privacy: contact@cleat.so.