Privacy Policy

Arthur de Paula Filiberto (Sole Trader) (ABN 42 627 319 380) ("Claq", "we", "us", "our") operates the Claq service, an AI-powered avatar and video generation platform for digital marketing. We respect your privacy and handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles ("APPs"), the Notifiable Data Breaches scheme, and — where applicable — the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA").

This Privacy Policy explains what we collect, why, who we share it with, and the choices you have.

1. Information we collect

1.1 Information you give us

• Account information: name, email address, password (hashed), and optional profile details.
• Billing information: name, billing address, country, and tax IDs where applicable. Full payment card numbers are handled directly by our payment processors (see Section 4) and are not stored on Claq's servers.
• User Content: prompts, scripts, text, images, audio, and any other content you upload or generate through the Service.
• Communications: messages you send to support, feedback, and survey responses.

1.2 Information collected automatically

• Usage data: features used, generation counts, session duration, timestamps, and in-product events.
• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, and crash logs.
• Cookies and similar technologies: see Section 7.

1.3 Sensitive and biometric information (where applicable)

Where the Service permits — now or in future — upload of facial images, voice recordings, or other biometric identifiers for avatar creation, this constitutes sensitive information under the Privacy Act. We will:

• Collect it only with your explicit, informed consent at the point of upload.
• Use it strictly for the avatar/video generation purpose you requested.
• Not disclose it to third parties except sub-processors strictly necessary to deliver the Service (see Section 5).
• Allow you to delete it at any time from your account settings.
• Apply additional security controls (encryption at rest and in transit, access restrictions).

If a likeness belongs to another person, you must have that person's verifiable, informed, written consent before uploading. See our Terms of Service, Section 4.

2. How we use information

We use personal information to:

• Provide, operate, and maintain the Service, including generating Output.
• Authenticate you and secure your account.
• Process payments and manage subscriptions.
• Communicate with you about the Service, including updates and support.
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with legal obligations.
• Improve and develop the Service through aggregated, de-identified analytics.

AI model training. We do not use your User Content (including any likeness data) to train, fine-tune, or improve our AI models or any third-party AI models, unless you have given explicit opt-in consent through a clearly-labelled setting. You may withdraw consent at any time, and we will stop using your User Content for training going forward. Withdrawal does not affect training already completed where individual contributions cannot be technically reversed.

3. Legal bases for processing (GDPR users)

If you are in the EU/UK, we rely on the following bases under the GDPR:

• Contract: to provide the Service you signed up for.
• Consent: for biometric data, opt-in model training, and non-essential cookies.
• Legitimate interests: for security, fraud prevention, analytics, and product improvement (where these do not override your rights).
• Legal obligation: for tax records, responding to lawful requests, and similar.

4. Payment processing

Payments are processed by third-party payment providers, which may include:

• Stripe — stripe.com/privacy
• Razorpay — razorpay.com/privacy
• Paddle — paddle.com/legal/privacy
• PayPal — paypal.com/au/legalhub/privacy-full
• Other processors as enabled, listed on our website.

These providers receive your payment details directly and process them under their own privacy policies. We receive limited information from them (e.g., transaction ID, last four digits of card, country) for our records.

5. Sharing and sub-processors

We do not sell your personal information.

We share information with:

• AI model providers — to generate Output (e.g., OpenAI, Anthropic, ElevenLabs, and other model/inference providers used by the Service). We select providers that contractually agree not to use customer data to train their models.
• Cloud and infrastructure providers — for hosting, storage, and content delivery (e.g., AWS, Google Cloud, Cloudflare).
• Analytics and product tools — for usage analytics and crash reporting (e.g., PostHog, Sentry, or similar).
• Customer support tools — for handling support tickets and communications.
• Payment processors — as listed in Section 4.
• Authorities or other parties — where required by law, in response to valid legal requests, or to protect rights, safety, and property.
• Successors — in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.

A current list of sub-processors is available in the sub-processors section of this page and is updated when material changes occur.

Sub-processors currently in use

• Google LLC (Gemini / Vertex AI) — AI generation
• Supabase Inc. — database and authentication
• Vercel Inc. — hosting and edge functions
• Stripe, Inc. — payment processing
• Cloudflare, Inc. — CDN and storage

6. International data transfers

Claq is based in Australia, and our service providers may be located in the United States, the European Union, India, and other jurisdictions. When personal information is transferred outside Australia, we take reasonable steps to ensure it is handled consistently with the APPs (APP 8), including by using providers that offer comparable protections or contractual safeguards (such as Standard Contractual Clauses for EU transfers).

7. Cookies and similar technologies

We use cookies and similar technologies for:

• Strictly necessary purposes (authentication, security, session management) — always on.
• Functional purposes (remembering preferences).
• Analytics purposes (understanding aggregate usage).

You can manage cookies through your browser settings. Disabling strictly necessary cookies will affect Service functionality. Where required by law, we present a cookie banner and obtain consent for non-essential cookies.

8. Data retention

We retain personal information only for as long as needed to:

• Provide the Service to you.
• Comply with legal, tax, and accounting obligations (typically 5–7 years for financial records under Australian law).
• Resolve disputes and enforce our agreements.

When you close your account:

• User Content (including any biometric data) is deleted from active systems within 30 days.
• Backups are purged on standard rolling cycles (typically within 90 days).
• Limited account and transaction records may be retained where required by law.

9. Security

We implement reasonable technical and organisational measures to protect personal information, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, audit logging, and regular security reviews.

No system is perfectly secure. If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required under the Notifiable Data Breaches scheme.

10. Your rights and choices

You have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your account and associated personal information (subject to legal retention obligations).
• Withdraw consent for processing based on consent (e.g., biometric data, model training opt-in, marketing).
• Object to or restrict certain processing (GDPR users).
• Data portability — receive a copy of your data in a structured, machine-readable format (GDPR users).
• Lodge a complaint with the OAIC (www.oaic.gov.au) if you believe we have mishandled your information. EU/UK users may also complain to their local data protection authority.

To exercise these rights, contact us at hello@claq.ai. We will respond within 30 days, or sooner where required by law.

11. Children's privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact hello@claq.ai and we will take steps to delete it.

12. Direct marketing

We may send you Service-related communications (e.g., billing, security, product updates) that you cannot opt out of without closing your account. For marketing communications (e.g., newsletters, promotional offers), we will obtain consent where required and you can unsubscribe at any time via the link in the email or in your account settings, in accordance with the Spam Act 2003 (Cth).

13. AI-specific transparency

Because Claq is an AI service, please also note:

• AI-generated Output may contain errors, biases, or artefacts. You should review Output before relying on or publishing it.
• We log prompts and metadata to operate the Service, prevent abuse, and improve reliability.
• Where Output includes a person's likeness, you are responsible for disclosure obligations (e.g., labelling synthetic media) under applicable laws and platform policies.

14. Changes to this Policy

We may update this Policy from time to time. For material changes, we will provide reasonable notice (for example, by email or in-app notice) before they take effect.

15. Contact us

For privacy questions, access requests, or complaints:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992