Privacy Policy

Clarivex Limited
Data Controller — Registered in England and Wales — Company No. 17289498
Last updated: 24 August 2026 | Effective date: 24 August 2026

    Summary in plain English. Clarivex is built by data governance professionals who take data protection seriously. We collect only what we need to run the service. We do not sell your data. We do not share it with advertisers. Pack generation uses the Anthropic Claude API — your input is processed on Anthropic's servers and retained for up to 30 days for abuse detection but is not used to train AI models. You have full rights over your data under UK GDPR.
  

1. Who We Are

Clarivex is operated by Clarivex Limited, a company registered in England and Wales under company number 17289498. We are the data controller for personal data processed through the Clarivex platform at useclarivex.com.

Registered office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.
ICO data protection registration: ZC179720.
Contact: hello@useclarivex.com

2. What Data We Collect

Account data

Name and email address — collected at registration
Password — stored as a hashed value, never in plain text
Account type and subscription tier
Date of registration and last login

Pack and session data

Data elements, sector, and regulation you enter when generating a pack
Session notes you capture during governance discovery sessions
Pack names, status, and metadata
Export history and Field Mapper configurations

Payment data

We do not store card details. All payment processing is handled by Stripe Inc.
We store your Stripe customer ID and subscription status to manage your account

Usage data

Number of packs generated and exports made
Feature usage patterns for product improvement
Error logs for debugging purposes

Trainer and educator application data

Organisation name, role description, and intended use submitted via the Trainer Programme application form
LinkedIn profile or programme website URL provided for verification

3. How We Use Your Data

To provide and operate the Clarivex service
To process your subscription payments via Stripe
To send account-related emails — welcome, verification, password reset, and subscription notifications — via Brevo
To send onboarding email sequences relevant to your account tier — you can unsubscribe at any time
To improve the Clarivex platform based on usage patterns
To respond to support requests and feedback
To comply with legal obligations

4. Legal Basis for Processing

Contract performance — processing your account data and pack data to provide the service you have subscribed to
Legitimate interests — usage analytics and product improvement, security monitoring and fraud prevention
Legal obligation — retaining financial records as required by law
Consent — marketing email sequences, where you have opted in

5. AI Processing — Anthropic Claude API

How pack generation works. When you generate a governance interview pack, the data element name, sector, regulation, role, and any context you provide is sent to the Anthropic Claude API for processing. Anthropic acts as a data processor under a Data Processing Addendum that includes UK GDPR Standard Contractual Clauses and the UK International Data Transfer Addendum (UK IDTA).

Data retention by Anthropic. Anthropic retains API inputs and outputs for up to 30 days for trust and safety monitoring. Anthropic does not use API data to train its AI models. You can review Anthropic's privacy practices at anthropic.com/privacy.

What this means for you. Do not include personal data — names, addresses, NHS numbers, financial identifiers — in the data element or context fields when generating packs. Pack generation is designed for governance framework information, not personal records.

6. Third Party Processors

Stripe Inc. — Payment processing

Stripe processes subscription payments and stores card details. Stripe is PCI DSS compliant. Data transferred to the USA under Standard Contractual Clauses. Stripe Privacy Policy

Brevo (Sendinblue SAS) — Email delivery

Brevo sends transactional and onboarding emails on our behalf. Your name and email address are shared with Brevo for this purpose. Data transferred under Standard Contractual Clauses. Brevo Privacy Policy

Anthropic PBC — AI pack generation

Anthropic processes pack generation inputs via their API. Data transferred to the USA under the UK IDTA and Standard Contractual Clauses. Anthropic does not train on API data. Anthropic Privacy Policy

Amazon Web Services — Hosting

Clarivex is hosted on AWS infrastructure in the EU (London region where possible). AWS is certified under ISO 27001 and SOC 2. AWS Privacy Policy

7. Data Retention

Account data — retained for the duration of your account plus 2 years after closure
Pack and session data — retained for the duration of your account and deleted within 90 days of account closure on request
Payment records — retained for 7 years as required by UK tax law
Application data — trainer and educator applications retained for 2 years
Server logs — retained for 90 days for security monitoring

8. Your Rights Under UK GDPR

As a data subject under UK GDPR you have the following rights:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate personal data
Right to erasure — request deletion of your personal data where there is no legal basis for continued processing
Right to restrict processing — request that we limit how we use your data
Right to data portability — request your data in a structured, commonly used format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — withdraw consent for marketing emails at any time via the unsubscribe link

To exercise any of these rights contact hello@useclarivex.com. We will respond within 30 days.

9. Cookies

Clarivex uses session cookies essential to the operation of the platform — authentication, theme preference, and session state. We do not use advertising cookies or third-party tracking cookies. No consent banner is required for essential cookies under UK PECR.

10. Security

Clarivex implements the following security measures:

AES-256-GCM encryption for sensitive credentials stored at rest
HTTPS enforced across all pages
Password hashing using bcrypt
Rate limiting on authentication and generation endpoints
HTTP security headers including Content-Security-Policy and X-Frame-Options
Webhook signature verification for Stripe events

11. International Data Transfers

Clarivex uses third-party processors located in the USA — Anthropic, Stripe, and Brevo. All transfers are protected by Standard Contractual Clauses approved by the UK Information Commissioner and where applicable the UK International Data Transfer Addendum. Details of transfer mechanisms are available on request.

12. Children

Clarivex is a professional B2B platform intended for data governance practitioners. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has registered please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email at least 14 days before they take effect. The current version is always available at useclarivex.com/privacy.php.

14. Complaints

If you are unhappy with how we handle your personal data you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We would always prefer to resolve concerns directly first — please contact us at hello@useclarivex.com before escalating to the ICO.

15. Contact

Clarivex Limited
Registered office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom
Company No. 17289498 | ICO registration: ZC179720
Email: hello@useclarivex.com
Website: useclarivex.com