Privacy Policy

We collect account information such as your email address and authentication identifiers, integration connection metadata such as provider name and connected account labels, encrypted provider credentials stored on ClawLink servers to run the integrations you authorize, and operational logs required to keep the service working.

When you use Gmail through ClawLink, ClawLink may process message metadata and message content returned by the Gmail API only to fulfill the actions you request, such as listing messages, reading a message, drafting an email, or sending an email.

We use your information to authenticate you, establish and maintain integration connections, execute actions you request through ClawLink, troubleshoot failures, enforce plan limits, and protect the security and reliability of the service.

We do not use Gmail data or other Google API data for advertising. We do not sell Google API data. We do not use Google API data to train generalized AI or machine learning models.

ClawLink's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For Gmail, ClawLink requests only the scopes needed for the user-facing features currently offered in the product. For the initial hosted Gmail flow, that means reading messages, creating drafts, and sending email on behalf of the user who connected the account.

ClawLink encrypts stored integration credentials before persistence and decrypts them only to execute integration requests you trigger or to maintain the connection, such as token refresh. Access to operational systems is restricted to the minimum needed to run and support the product. No security measure is absolute, but we design the service to reduce unnecessary access and retain only the data needed to operate the integration.

We share information only with service providers and infrastructure vendors that help us operate ClawLink, such as hosting, authentication, billing, logging, and managed connection providers, or when required by law. For most integrations that use OAuth, the provider connection is established and the access tokens are held by Composio, a managed connection provider; ClawLink stores only an opaque reference to that connection, not the underlying tokens. We do not sell personal information.

The full list of subprocessors, our security controls and our documents are on the ClawLink Trust Center.

Some ClawLink data tools look up public and business information about companies, creators and people (for example a company profile, a creator's audience statistics, or a person's work email) through licensed data providers, only when your agent runs such a tool at your request. ClawLink does not keep a database of people: each lookup is sent to the provider at that moment and the answer is returned to you.

You are responsible for using this information lawfully, including data protection and anti-spam rules that apply to you. Lookup results appear in your execution log so you can review what your agent did. A person who wants their information removed can contact us and we will point them to the provider's removal process and delete the records we hold.

We retain account and connection data for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. You can disconnect integrations from the ClawLink dashboard. You can also request account or data deletion by contacting us.

Questions about this policy or requests related to privacy and deletion can be sent to hello@claw-link.dev.