1. Introduction
Cleariflow (“Cleariflow”, “we”, “us”) provides hosted REST APIs and related developer tools for validation, lookup, and generation use cases—for example email and phone validation, IP geolocation, exchange rates, VAT and bank-account checks, and avatar generation—as further described on https://cleariflow.com and our documentation.
This Privacy Policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and what rights you may have. It applies to visitors of our marketing website, users of account dashboards and billing portals, and customers integrating our APIs.
2. Who we are (privacy contact)
Cleariflow is run by its operators while formal operator registration is still being arranged; nothing in this Policy confirms that commercial registration is already complete. For privacy and data‑protection questions, contact privacy@cleariflow.com. Where applicable law refers to a controller of personal data, that role is fulfilled by the party operating these Services as described here (except where we act solely as your processor on your documented instructions when you send end‑user data through our APIs; see Section 5).
3. Categories of personal data
Account and authentication: name, email address, organisation name, credentials, multi‑factor authentication factors where enabled, and internal identifiers.
Billing and administration: billing contact details, invoices, payment status, and limited payment metadata. Card payments are handled by PCI‑DSS compliant payment service providers; we do not store full payment card numbers.
API usage and security: API keys (stored using appropriate security measures such as hashing or vaulting where applicable), request metadata (for example timestamps, client IP, endpoint identifiers, HTTP status, approximate request size and latency indicators), and quotas or rate‑limit counters.
Payloads you send to our APIs: depending on the product you call, your requests may contain identifiers and related data (such as email addresses, telephone numbers, IP addresses, VAT or tax identifiers, IBAN/BIC values, or parameters for generating images). You decide what to submit; we process such content only to perform the API operation you request and for associated service delivery, abuse prevention, troubleshooting, and legal compliance.
Support and communications: messages, attachments, and contact information you provide when you email support or interact with us.
Technical data on our sites: IP address, device and browser characteristics, coarse location derived from IP, and cookies or similar technologies where we use them (for example for security, session continuity, or optional analytics on marketing or account pages).
4. Purposes of processing
We use personal data to create and administer accounts; authenticate users; deliver, monitor, and improve the APIs; enforce plans, quotas, and technical limits; detect and prevent fraud, abuse, and security incidents; communicate service messages; handle billing; comply with applicable law; respond to lawful requests; and defend legal claims.
5. Roles: controller and processor
Where you integrate our APIs into your own application and send data relating to your end users, you are typically the controller of that data and Cleariflow processes it as a processor to the extent we act solely on your instructions in providing the Services defined in our agreement with you (including these Terms). You are responsible for establishing a lawful basis vis‑à‑vis your end users and for providing any required notices.
Where we determine the purposes and means of processing—for example account records, billing across our platform, global platform security, and product analytics at aggregate or account level—we act as a controller as described in this Policy.
6. Legal bases (EEA, UK, and similar regimes)
Where GDPR or equivalent laws apply, we rely on one or more of: performance of a contract with you; our legitimate interests balanced against your rights (security, improvement, fraud prevention); compliance with legal obligations; and consent where we are required to ask for it (for example certain optional marketing cookies or communications).
7. Recipients and subprocessors
We engage trusted service providers for cloud hosting, logging, observability, payment processing, email delivery, customer support tooling, and similar functions. They may process personal data on our behalf under written agreements that require appropriate confidentiality and security measures. We may also disclose information if required by law, or to protect the rights, property, or safety of Cleariflow, our customers, or the public.
8. International transfers
We may process or store data in the European Economic Area and other countries. Where we transfer personal data from the EEA, UK, or Switzerland to countries not deemed adequate, we implement appropriate safeguards such as Standard Contractual Clauses (or successor mechanisms) supplemented by technical and organisational measures where appropriate.
9. Retention
We keep personal data only as long as necessary for the purposes described, unless a longer period is required or permitted by law. Retention periods vary by data category (for example billing records, aggregated statistics, raw API logs, security logs). We periodically review and delete or anonymise data that is no longer needed.
10. Security
We implement technical and organisational measures designed to protect personal data from unauthorised access, loss, or alteration. No service transmitted over the Internet can be guaranteed fully secure; you are responsible for safeguarding API keys and account credentials.
11. Your rights
Depending on your jurisdiction, you may have rights to access, rectify, erase, restrict, or object to certain processing, to data portability, and to withdraw consent where processing is consent‑based. You may also lodge a complaint with a data protection supervisory authority. To exercise rights, contact privacy@cleariflow.com. We may need to verify your identity before responding.
12. Children
The Services are directed to businesses and developers, not to children. We do not knowingly collect personal data from anyone under 16. If you believe we have received such data, please contact us so we can delete it.
13. Changes
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, where changes are material, provide additional notice (such as posting on the website or emailing the account contact on file).
14. Contact
Privacy enquiries: privacy@cleariflow.com. General support: support@cleariflow.com.