Privacy Policy

Last updated: November 2026

1. Controller

Catalina Rojas Ugarte, trading as ClapNClaw
Gneisenaustrasse 51, Apt. 9, 10961 Berlin
Email: [email protected]
Website: https://clapnclaw.io

For data protection inquiries, please contact: [email protected]
(A statutory data protection officer is not required, as fewer than 20 persons are engaged in the automated processing of personal data.)

2. Data Collected, Purposes and Legal Bases

2.1 Registration and Conclusion of Contract

Data: Name, email address, company name, password (hashed).
Purpose: Creation and administration of your user account, fulfilment of the usage contract.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Retention period: Term of contract + 3 years

2.2 Use of the AI Platform

Data: Prompts and documents you submit for processing; communication data from connected integrations (Gmail, Slack, etc.) only after explicit authorisation by you.
Purpose: Provision of the AI services in accordance with your instructions.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Retention period: With AI processing (AWS Bedrock, Frankfurt), inputs are not stored (0 days). Conversation history on our server: for the contract duration — you can delete it at any time; complete deletion 30 days after contract end.

2.3 Technical Log Data

Data: IP address, timestamps, error messages, token usage.
Purpose: Operation, security and debugging of the platform.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system security)
Retention period: 30 days

2.4 Payment and Invoicing Data

Data: Billing address, payment method, transaction identifiers. Credit card data is processed exclusively by Stripe — we do not store credit card numbers.
Purpose: Processing of payments, issuance of invoices, tax documentation.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract); § 147 AO (statutory retention obligation)
Retention period: 10 years (tax-law retention obligation pursuant to § 147 AO)

2.5 Transactional Emails (Onboarding, Notifications)

Data: Email address, name.
Purpose: Sending of welcome emails, system notifications, invoices, security alerts.
Processing: System emails are sent exclusively through our self-hosted email server (Postal, own Hetzner infrastructure in Nuremberg); no external email service provider is involved. Incoming emails are also received via Postal.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Retention period: Delivery logs on our own infrastructure: 30 days

2.6 Marketing Emails

Data: Email address, name.
Purpose: Sending of product news and offers.
Legal basis: Art. 6(1)(a) GDPR (express consent following double opt-in, § 7 UWG)
Retention period: Until withdrawal

3. Processors

We have concluded contracts pursuant to Art. 28 GDPR with the following processors:

Optional integrations: If you choose to connect third-party services (e.g. Gmail, Outlook, Slack, Notion, Google Drive, HubSpot), data is transmitted to the respective provider — for US providers only after your explicit consent to the third-country transfer (Art. 44 et seq. GDPR; the provider's EU-US DPF/SCCs). Without such a connection, no such transfer takes place.

4. Retention Periods — Overview

5. Your Rights as a Data Subject (Art. 15–22 GDPR)

You have the right to:

• Access (Art. 15): What data we have stored about you
• Rectification (Art. 16): Correction of inaccurate data
• Erasure (Art. 17): „Right to be forgotten“
• Restriction (Art. 18): Limitation of processing
• Data portability (Art. 20): Export of your data on request at [email protected]
• Objection (Art. 21): Against processing based on legitimate interest
• Withdrawal: At any time for consents granted

Contact for all requests: [email protected]
We respond within 30 days, in complex cases within 90 days (Art. 12(3) GDPR).

You can request or have your data deleted on request at [email protected] (within 30 days pursuant to Art. 12 GDPR).

6. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61 · 10555 Berlin
Telephone: +49 30 13889-0
[email protected] · www.datenschutz-berlin.de

7. Social Media and External Channels

We operate the following external channels for marketing and public communication:

• Instagram: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. When interacting with our page, Meta processes data in accordance with its privacy policy. Legal basis: Art. 6(1)(f) GDPR.
• Telegram: Public channel. Messages are public. No customer data is processed via Telegram. Direct inquiries are forwarded to [email protected].

Important: No customer data is processed via these channels. For support inquiries, please use exclusively [email protected].

8. Cookies and Tracking

We use exclusively technically necessary cookies:

In addition, we use your browser's localStorage for settings (e.g. color theme, language preference, last workspace used). Your login is not stored in localStorage — it lives only in the HttpOnly cookie clapnclaw_session, which browser scripts cannot read. The localStorage data remains in your browser, is not transferred to third parties, and can be deleted at any time via your browser settings.

Web analytics: On our public website we use Umami — a self-hosted, cookie-free web analytics tool running on our own infrastructure. No cookies are set, no user profiles are created, and no data is transferred to third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement).

No third-party tracking, no advertising cookies. A cookie banner is not required for exclusively technically necessary cookies (cf. § 25(2) TDDDG).