Privacy Policy

ClawLink is the controller of your account, billing, support and usage data. When your agent runs a tool, data from your connected apps (for example an email it reads or a message it sends) passes through ClawLink. We process that data only to carry out the request that you or your agent made.

This policy covers claw-link.dev and its subdomains. The apps you connect (such as Gmail or Slack) and the AI agent you use have their own privacy policies.

We collect these types of data:

• Account: your email address and the identifiers from sign-in. Clerk runs sign-up, sign-in and sessions.
• Connections: the apps you connect, the connected account's name or email, the permissions you granted and the connection status. For most apps, Composio holds the provider's OAuth tokens and ClawLink stores only a reference to the connection. When an app needs an API key, we encrypt the key with AES-GCM before we store it.
• ClawLink API keys: we store only a hash of each key, never the key itself.
• Tool calls: for each call your agent makes, we log the tool name, the arguments your agent sent, the response the app returned, the status and the time it took. You can see these logs in your dashboard. They can contain content from your connected apps, such as the text of an email.
• Playground: when you use the in-app playground, we save your chats so that you can open them again.
• Billing: Polar is the merchant of record and processes your payments. We receive your plan, subscription status, payments and credit balance. We never receive your full card number.
• Support: the messages you send us in the chat or by email, and the issue reports that your agent sends through ClawLink, with the details it attaches.
• Usage and device data: the pages you visit, the features you use, your IP address, browser, device type and approximate location. For signed-in users, PostHog records session replays. Form inputs are masked in these replays.
• Marketing attribution: the campaign tags (utm values) and the Google Ads click ID in the link that brought you to ClawLink.

Some ClawLink data tools look up public and business information about companies, creators and people (for example a company profile, a creator's audience statistics, or a person's work email) through licensed data providers, only when your agent runs such a tool at your request. ClawLink does not keep a database of people: each lookup goes to the provider at that moment, and the answer comes back to you.

You are responsible for using this information lawfully, including the data protection and anti-spam rules that apply to you. Lookup results appear in your tool-call log so that you can see what your agent did. A person who wants their information removed can contact us. We will point them to the provider's removal process and delete the records we hold.

• To provide ClawLink (performance of our contract with you, GDPR Art. 6(1)(b)): create your account, connect your apps, run the tool calls that you or your agent request, bill you, and give support.
• To keep ClawLink secure and improve it (our legitimate interests, GDPR Art. 6(1)(f)): find and fix failures, prevent abuse and fraud, enforce plan limits, measure which features people use, measure which campaigns bring sign-ups, and send you tips about ClawLink. You can object to this use at any time.
• To meet legal obligations (GDPR Art. 6(1)(c)): keep accounting and tax records, and answer lawful requests from authorities.

We do not sell your personal data. We do not use Gmail data or other Google API data for advertising. We do not use data from your connected apps to train AI or machine learning models.

We send emails about your account, billing, trial and connections. During your first days we can also send a small number of tips about how to start. Each tip email has a one-click unsubscribe link.

• Necessary: Clerk sets session cookies that keep you signed in. We set a cookie for your language and short-lived cookies that remember a setup step in progress.
• Analytics and advertising: PostHog and Umami measure how people use the site. Google Ads uses cookies to tell us when a visit from an ad leads to a sign-up. Our own attribution cookie keeps the campaign tags from the link you arrived on.

You can block or delete cookies in your browser settings. If you block the necessary cookies, you cannot sign in.

• Service providers that run parts of ClawLink for us: Cloudflare (hosting, database and AI gateway), Composio (hosted OAuth and tool execution), Clerk (sign-in), Polar (payments), PostHog and Umami (analytics), Google (ad measurement), Crisp (support chat), Resend (email) and DeepSeek (the playground model). They process data only on our instructions.
• The apps you connect: when your agent runs a tool, we send that request to the app, through Composio or through the app's own server.
• Data providers: a public-data lookup goes, with the query your agent sent, to DataForSEO or to another licensed data provider.
• Legal requests and business changes: we disclose data when the law requires it or to protect our rights. If ClawLink is sold or merged, your data moves to the new owner, and this policy continues to apply to it.

The full list of subprocessors, our security controls and our documents are on the ClawLink Trust Center.

Our providers are in the United States, the European Union, Singapore and China, and Cloudflare serves requests from data centers around the world. Playground messages go to DeepSeek, which processes them in Singapore and China. When data leaves the EU, EEA or UK, we rely on the safeguards that the provider offers, such as the European Commission's Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework.

ClawLink's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you use Gmail through ClawLink, ClawLink may process message metadata and message content returned by the Gmail API only to fulfill the actions you request, such as listing messages, reading a message, drafting an email, or sending an email.

For Gmail, ClawLink requests only the scopes needed for the user-facing features currently offered in the product. For the initial hosted Gmail flow, that means reading messages, creating drafts, and sending email on behalf of the user who connected the account.

We encrypt stored credentials before we write them, and we decrypt them only to run a request that you trigger or to keep the connection active (for example, to refresh a token). Access to production systems is limited to what is necessary to run and support ClawLink. No security measure is perfect, but we design ClawLink to keep only the data it needs. The Security page tells how a connection works.

• Tool-call logs: 90 days. After that, we delete them automatically.
• Account, connection and playground data: while your account exists.
• When you delete your account: we delete your account data right away. Database backups expire within 30 days.
• Billing records: as long as tax and accounting law requires.
• Support conversations and analytics data: only as long as we need them for the purposes in section 4. Then we delete them or make them anonymous.

You can disconnect any app in your dashboard at any time. To delete your account, open Settings, then Security, then Delete account. What we delete and what we keep.

Under the GDPR and similar laws, you have the right to:

• get a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to limit how we use your data;
• object to a use based on our legitimate interests, and to all marketing;
• get the data you gave us in a machine-readable format.

To use a right, send an email to hello@claw-link.dev. We can ask you to confirm your identity first. We reply within one month.

You can also make a complaint to the data protection authority in your country. The European Data Protection Board lists them.

ClawLink is not for children under 16. We do not knowingly collect data from children. If we find that we did, we delete it.

We can update this policy. When we do, we change the date at the top of this page. If a change is important, we tell signed-in users by email or in the dashboard before the change applies.

For questions about this policy or for privacy requests, send an email to hello@claw-link.dev. To report a security issue, send an email to security@claw-link.dev.