Privacy Policy — Clarion AI

1. Who We Are

Clarion AI is operated by ClearConsent DataSec Pvt Ltd, a company incorporated in India. We provide trust-labeled AI responses with PII protection, compliance analysis, and multi-model routing.

For any privacy-related questions, contact our Data Protection team at hello@clarion-ai.io.

2. Data We Collect

We collect only the minimum data necessary to operate the Service:

Data Category	What	Purpose	Retention
Account	Name, email, hashed password	Authentication & communication	Until account deletion
Usage	API call counts, token usage, model used, timestamps	Billing, rate limiting, analytics	24 months
Billing	Plan, payment transaction IDs (via Razorpay)	Subscription management	As required by tax law (min 7 years)
Session	Conversation history, trust scores, PII flag counts	Session continuity, audit trail	90 days (configurable)
Audit	Action logs, IP addresses, timestamps	SOC 2 compliance, security	12 months minimum
Organization	Org name, member roles, workspace config	Multi-tenant features	Until org deletion

3. Data We Do NOT Collect or Store

We want to be explicit about what we do not retain:

Prompt content -- Your prompts are processed in real time and passed to AI model providers. We do not store raw prompt text beyond the session history you choose to keep.
PII detected in your data -- When our PII detector identifies personal information, we flag it and return the category (e.g., "EMAIL_ADDRESS"). We do not store the actual PII values found.
BYOK API keys in plaintext -- Bring Your Own Key credentials are encrypted at rest using a dedicated encryption key. We cannot read your keys.
Passwords in plaintext -- All passwords are hashed with bcrypt before storage.
Payment card details -- All payment processing is handled by Razorpay. We never see or store card numbers, CVVs, or bank account details.

4. Third-Party Data Sharing

We share data with third parties only as necessary to provide the Service:

AI Model Providers -- Google (Vertex AI) and AWS (Bedrock) receive your prompts for inference. Both operate under enterprise terms that prohibit using customer data for model training. If those are unavailable, Claude requests may fall back to Anthropic's API, processed per Anthropic's usage policy.
Payment Processor -- Razorpay processes payments under their own privacy policy.
Email Provider -- Resend delivers transactional emails only (OTP, password reset, billing receipts).
Infrastructure -- We use cloud providers (Google Cloud Platform) for hosting. Data is processed in the asia-southeast1 region by default.

We do not sell, rent, or trade your personal data. We do not use your data for advertising.

5. Security Measures

All data in transit is encrypted via TLS 1.2+
BYOK keys are encrypted at rest with dedicated encryption keys
JWT tokens expire after 24 hours with refresh rotation
Rate limiting at user, API key, and organization levels
Immutable audit logs (SOC 2-ready) with hash chaining
Per-org sovereign data controls for Enterprise plans
Regular security reviews and dependency audits

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

Right	GDPR (EU)	DPDPA (India)
Access your data	Art. 15	Sec. 11
Correct inaccurate data	Art. 16	Sec. 12
Delete your data	Art. 17	Sec. 13
Data portability	Art. 20	--
Withdraw consent	Art. 7(3)	Sec. 6(6)
Nominate (deceased)	--	Sec. 14

To exercise any of these rights, email hello@clarion-ai.io with the subject line "Data Rights Request." We will respond within 30 days (or 72 hours for urgent deletion requests).

7. Cookies & Tracking

The Service uses minimal client-side storage:

localStorage -- JWT token for authentication (expires 24h)
Theme preference -- Light/dark mode selection

We do not use third-party tracking cookies, advertising pixels, or analytics services that track individual users.

8. Children's Privacy

The Service is not intended for use by individuals under 16 years of age. We do not knowingly collect data from children. If you believe a child has created an account, contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

10. International Data Transfers

Your data may be processed in India, Singapore, and the United States (where our AI model providers operate). We ensure appropriate safeguards are in place per applicable laws.

11. Data Protection Officer

For privacy-related queries, contact our Data Protection Officer at dpo@clarion-ai.io.

12. Grievance Redressal

Under the DPDP Act 2023, you may raise grievances with our Grievance Officer at grievance@clarion-ai.io. We will respond within 30 days.

Privacy questions?

Email our Data Protection team at hello@clarion-ai.io

ClearConsent DataSec Pvt Ltd · Bangalore, India

Create your account