Privacy Policy

CloviReach

Effective date: draft — set on review

Generated: 2026-06-10T00:00:00.000000+00:00

This document was machine-generated from a template and IS NOT LEGAL ADVICE. It is a starting draft that requires review by a qualified attorney before publication.

1. Introduction and Controller Identity

This Privacy Policy ("Policy") is issued by CloviTek AI ("we," "us," "our"), the operator of CloviReach. It explains how we collect, use, disclose, and protect personal data in connection with the CloviReach platform and its related services. For privacy inquiries or to exercise your rights, contact us at enable JavaScript to view. We may update this Policy from time to time; material changes will be communicated to you, and where required by law, we will seek renewed consent. Detailed retention periods for each data category are set out in our Data Handling and Deletion Schedule.

2. Definitions

Personal Data: any information that identifies or can reasonably identify a natural person.
Processing: any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
Controller: CloviTek AI, which determines the purposes and means of processing your Personal Data.
Processor: a party that processes Personal Data on our behalf under our instructions.
Data Subject: the individual whose Personal Data is processed.
Contact Data: personal data you upload about your own contacts or leads for the purpose of operating outreach campaigns through CloviReach.
Data Handling and Deletion Schedule: our separate document specifying retention periods and deletion procedures for each data category.

3. Data We Collect and Why

We collect personal data through your interactions with CloviReach. Retention periods for each category are detailed in our Data Handling and Deletion Schedule.

Category	Examples	Purpose	Lawful Basis
Contact & Identity Information	Name, email address, job title, company	Account creation, authentication, support	Contract, Legitimate Interests
Account & Profile Data	Username, hashed password, subscription tier, user ID	Account management, security, personalization	Contract, Legitimate Interests
Billing & Payment Data	Billing address, payment method last four digits, transaction history	Payment processing, invoicing, tax compliance	Contract, Legal Obligation
Usage & Activity Data	Login timestamps, IP address, browser/device info, features accessed, campaign metrics	Analytics, security monitoring, service improvement	Legitimate Interests, Consent (analytics)
Contact Data (User-Uploaded)	Recipient names, email addresses, phone numbers, custom fields	Enabling outreach campaigns on your behalf	Contract (we act as Processor for this data; you are Controller)
Campaign Content	Message templates, subject lines, sequences, attachments	Service delivery, campaign execution and history	Contract
AI-Generated Outputs	AI-suggested copy, personalization tokens, engagement summaries	Service delivery, output history	Contract, Legitimate Interests
Support & Communications	Support tickets, email correspondence, chat transcripts	Support delivery, dispute resolution, service quality	Contract, Legitimate Interests
Marketing & Preferences	Email opt-in status, campaign interactions, subscription preferences	Marketing (with consent), preference management	Consent, Legitimate Interests
Cookies & Tracking Data	Session cookies, analytics identifiers, referral sources	Site functionality, analytics, security	Consent (non-essential), Legitimate Interests (essential)
Legal & Compliance Data	Consent records, data subject requests, audit logs	Regulatory compliance, legal defense	Legal Obligation, Legitimate Interests

4. User-Uploaded Contact Data — Dual Role Notice

When you upload contact lists or import recipient data into CloviReach, you act as the data Controller for that Contact Data, and CloviTek AI acts as a Processor on your behalf. You are responsible for ensuring you have a lawful basis (e.g., consent, legitimate interest) for processing each recipient's personal data and for honoring all applicable rights and obligations under data protection law. Our processing of Contact Data is governed by the data processing terms incorporated into our Terms of Service.

5. How We Use Your Information

We process your personal data only for the purposes described in this Policy and in accordance with applicable law:

Create, manage, and authenticate your account;
Deliver, operate, and improve CloviReach features and AI capabilities;
Execute outreach campaigns and sequences on your instructions;
Process subscription payments and manage billing;
Provide customer support and respond to inquiries;
Monitor platform security and prevent fraud or abuse;
Send transactional and account-related communications;
Send marketing communications where you have consented or where permitted by law;
Comply with legal obligations and enforce our Terms of Service;
Conduct aggregate analytics to improve the Service (using anonymized or aggregated data).

6. International Data Transfers

CloviTek AI is based in the United States. Your personal data may be transferred to and processed in countries outside your country of residence, including the United States. For users in the EU, EEA, or UK, transfers to third countries rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, adequacy decisions, or other appropriate safeguards as required by applicable law. Details of transfer mechanisms for individual sub-processors are available upon request at enable JavaScript to view.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your personal data, including encryption of data in transit (TLS) and at rest, strict access controls and authentication requirements, regular security assessments and vulnerability management, contractual security and data processing requirements imposed on all sub-processors, and incident response procedures compliant with applicable breach notification laws. No transmission over the internet is completely secure; while we work to protect your data, we cannot guarantee absolute security.

8. Data Retention and Deletion

We retain personal data only as long as necessary for the purposes described in this Policy or as required by law. Full retention periods for each category are specified in our Data Handling and Deletion Schedule. Upon expiry of the applicable retention period or upon a verified deletion request, personal data is securely deleted or irreversibly anonymized. Deletion actions are logged and periodically audited. To submit a deletion request, contact enable JavaScript to view.

9. Sharing Your Information

We share personal data only as described below. We do not sell personal data to third parties.

Category	Purpose	Safeguards
Cloud Hosting and Storage	Infrastructure, file storage, content delivery	Encryption at rest and in transit; DPA in place
AI and Language Processing	AI-assisted copy generation and personalization	No-training terms; DPA in place; minimal data shared
Payment Processing	Subscription billing, invoicing, refunds	PCI DSS compliant; DPA in place; card data not stored by us
Email and Notification Delivery	Transactional emails, system notifications	Encryption; DPA in place
Analytics and Error Monitoring	Platform performance, error diagnostics	Aggregated or pseudonymized data; DPA in place
Legal and Regulatory Authorities	Compliance with legal obligations, law enforcement requests	Disclosed only as required by law or valid legal process
Business Transfers	Merger, acquisition, or sale of assets	Successor bound by terms at least as protective as this Policy

10. Children's Privacy

CloviReach is not directed to individuals under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact enable JavaScript to view immediately and we will take steps to delete such data.

11. Cookies and Tracking Technologies

We use essential cookies necessary for the Service to function, as well as functional and (with your consent) analytics cookies. Essential cookies do not require consent; non-essential cookies are set only following your affirmative consent through our cookie consent banner. You may withdraw consent or manage cookie preferences at any time through your browser settings or our consent interface. See our Cookie Policy for full details.

12. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any right, contact enable JavaScript to view. We will verify your identity and respond within the legally required timeframe (30 days for GDPR; 45 days for CCPA).

Right to Access — request a copy of the personal data we hold about you;
Right to Rectification — request correction of inaccurate or incomplete data;
Right to Erasure (Right to be Forgotten) — request deletion of your personal data;
Right to Restriction — request that we limit processing in certain circumstances;
Right to Data Portability — receive your data in a structured, machine-readable format;
Right to Object — object to processing based on legitimate interests or for direct marketing;
Right to Withdraw Consent — where processing is based on consent, withdraw at any time without affecting prior processing;
Right to Opt Out of Sale/Sharing (CCPA/CPRA) — we do not sell or share personal data;
Right to Non-Discrimination — we will not discriminate against you for exercising your rights;
Right to Lodge a Complaint — with your local supervisory authority (e.g., a data protection authority in the EU/EEA/UK).

13. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, USA. For users in the EU, EEA, or UK, applicable data protection law (including GDPR and UK GDPR) also governs our processing activities to the extent required.

14. Contact

For privacy inquiries, data subject requests, or to reach our data protection contact, write to: enable JavaScript to view. We aim to acknowledge all requests within 5 business days.