Privacy policy

Clutch Creator, Inc., a Delaware corporation at 9337 Katy Fwy, Ste B, PMB 8001, Houston, TX 77024, United States ("Clutch", "we" or "us"), is the controller of the personal data this policy describes. It covers clutch.io, the Clutch app, the Clutch agent wherever you talk to it, AI assistants you connect to Clutch, the grader and Journey, and our dealings with Customers, partners and prospects (together, the "Services").

Customer Sites. Our Customers build and publish their own websites with the Services. When someone visits a Customer Site, fills in its forms or asks it questions, we process that Visitor Data for the Customer as its processor and service provider, under the processing terms in our Terms. The same applies to personal data in a Customer's content and Connected Accounts. The Customer's own privacy policy applies, so send questions about a Customer Site to the business that runs it; we pass on any request we receive.

Workspaces. A Customer holds a Workspace, and its Authorized Users can see and change its sites, each site's conversation with the agent, its Connected Accounts and the agent's shared memory; a chat started outside a site is visible only to its author. Other capitalized words are defined in our Terms.

From you:

• Account: your name, email address, profile picture and, if you set one, a password, which we store only as a one-way hash.
• Workspaces and sites: your Workspace's name, members, roles and invitations, and your sites and every version of them, with the content, files, forms, skills, settings and domains you or the agent create.
• Chats: what you and your Authorized Users tell the agent, in the app, over MCP or in a messaging channel, the files and pages you give it, its replies and actions, and the notes it keeps in your Workspace's memory.
• Messaging channels: for Slack, your messages to Clutch, Slack IDs and display names; for email to your Workspace's address, each message's text, subject and sender, but not attachments; for texts, your phone number and messages.
• Support and the grader: what you write to us, problems you report, the addresses you grade and the sites you monitor.

From the Services:

• Device and log data: the IP address and browser of each signed-in session and of each request to our servers, with the page and time.
• AI assistants you connect: the name and contact details an assistant registers with, the access you approve for it and the tasks it sends.
• Where you came from: the website or campaign link that first brought you to the app, kept with your account if you sign up, with your choice about tips and news.
• Usage: records of AI usage and of the plans and funds you buy.

From others:

• Google: if you sign in with Google, your name, email address, profile picture and Google account ID. See Google data.
• Connected Accounts: the tokens or keys that let the agent use a service you connect, the data it reads there to do what you ask, and a log of its calls.
• Polar: your plans, orders and subscription status. Polar holds your card details; to start a checkout we send it your name, email address, organization and the site the plan is for.
• Public sources: details about people at businesses we may offer the Services to. See Outreach.

We do not ask for sensitive data such as health, financial account, government ID, precise location or biometric data, and ask you not to send it beyond your sign-in and connection credentials. What we process on Customer Sites is in Visitor Data.

Where the EU or UK GDPR applies, the legal basis for each purpose is in parentheses.

• Providing the Services (our contract with the Customer, or legitimate interests for Authorized Users who are not party to it): accounts, the agent, building, hosting and publishing sites, the Agent Actions you ask for, form delivery, payment through Polar, and support.
• Security (legitimate interests and legal obligation): authenticating sign-ins, limiting request rates, stopping spam, fraud and abuse, and enforcing our Terms.
• Communication (contract or legitimate interests, and consent for marketing where the law requires it): sign-in links, form, billing and policy notices, and any tips and news, which you can turn off.
• Improvement (legitimate interests): aggregated, de-identified measures of use, such as how many publishes fail. Your data never trains AI models; see AI.
• Marketing measurement (legitimate interests): learning which websites and campaigns bring the people who sign up.
• The grader and outreach (legitimate interests): measuring and publishing public websites, and contacting businesses about them. See Grader and Journey and Outreach.
• Legal duties (legal obligation and legitimate interests): tax and accounting records, lawful requests, and legal claims.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object as Your rights describes. You can withdraw consent at any time, without affecting earlier processing. Without your name, email address and payment we cannot open an account or sell you a plan.

The agent and some of our tools run on other companies' AI models, and each receives only what its task needs:

• Anthropic runs the agent on its Claude models. It receives your chats and files, the content the agent reads and writes and the results of its tools, including Connected Account data, and stores agent sessions, Workspace memory and skills for us. Claude models also describe uploaded images, classify sites for the grader and run Journey.
• TypeSafe, through Cloudflare, answers questions typed into a Customer Site's search from that site's pages, and makes some grader judgments.
• xAI, through Cloudflare, generates images from the agent's prompts and any reference images it chooses, which can come from your site or Connected Accounts.

We do not use Customer Content, Visitor Data, chats or Connected Account data to train or fine-tune any AI model, ours or anyone else's, and our AI providers may not train on what we send them. We may review a session for support, a fault or abuse and improve our software, prompts and skills as a result, but we never copy your content into material for other customers.

No automated decisions about people. The agent builds websites and acts on your instructions; it makes no decisions with legal or similarly significant effects on anyone, such as on a rental application, a loan or a job. It can make mistakes, and our Terms explain who is responsible for its work.

You can sign in with Google and connect Google services to Clutch. This is what we access and why:

• Sign in with Google: your name, email address, profile picture and Google account ID, only to create your account and sign you in.
• Google Drive, Sheets and Docs: the agent finds, reads, creates and updates your files, spreadsheets and documents when you ask, for example to bring a document's text or a folder's images into your site.
• Google Analytics and Search Console: read-only access to your properties, reports, search performance, sitemaps and URL inspection results, to answer your questions and improve your site.
• Google Ads: the agent reads your accounts, campaigns, performance, keywords, search terms and change history, and can check proposed changes, such as pausing a campaign or changing a budget, without applying them. It cannot change anything in Google Ads today.
• Google Places and PageSpeed Insights: when the agent looks up a place, we send Google the search text and area under the Google Privacy Policy and keep Google's place ID with your site. The grader sends PageSpeed Insights each address it measures.

How we use it. Only to provide the features you see and use in Clutch: signing you in, and the agent's work for you on the services you connect. We do not use it to serve or target advertising, we do not sell it, and we do not use it to judge creditworthiness or for lending.

Who receives it. Only Anthropic and Cloudflare, which run the agent and host our services; xAI, when you ask for images made from your files; DataForSEO, for keyword research you ask for; and the destinations you tell the agent to use, such as your site or another Connected Account. We transfer it to no one else, except to comply with law, for security purposes, or with your explicit prior consent in a merger, acquisition or sale of assets.

Who reads it. No person at Clutch reads it unless you give us your affirmative agreement to view specific data, it is needed for security purposes such as investigating abuse, the law requires it, or it has been aggregated and anonymized for internal operations.

No AI training. We do not use Google user data, including data from Google Workspace APIs, to develop, improve or train generalized AI or machine learning models.

Where it is kept. Connection tokens are stored with your Workspace or site at our hosting provider. What the agent reads stays in your agent sessions at Anthropic and in your Workspace, with a short log of calls, and goes into a site only when you ask.

How to stop it. Disconnect the service on the Connections page in Clutch, and we delete its tokens and call log at once. That does not yet withdraw the permission you gave Google, so also remove Clutch's access at myaccount.google.com/permissions. To have us delete Google user data held in your agent sessions or Workspace, write to privacy@clutch.io and we will do it within 30 days.

Limited Use. Clutch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace. Clutch's use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

New uses. Before we use Google user data in a new way or ask for new Google permissions, we update this policy and ask for your consent in the product.

• Service providers listed in Service providers, under contract and only to provide their services to us.
• Your Workspace: its Authorized Users, as Scope describes.
• Polar, which sells you the plan as merchant of record under its own privacy policy.
• Services you connect, when you or a form send them data, such as a submission to your CRM; they act under their own terms as your provider, not ours.
• The public: published Customer Sites and grader results.
• The law and safety: when the law or a public authority's valid request requires it, or to protect the rights, safety or property of our Customers, the public or Clutch.
• Business transfers: to the other party in a merger, acquisition, financing or sale of assets, under this policy, and we tell you before a different policy applies. Google user data transfers only with your explicit prior consent.

No selling, no sharing for ads. We do not sell personal data or share it for cross-context behavioral advertising, as California law defines those terms, and we run no advertising pixels or third-party trackers on clutch.io, the app or the Customer Sites we host. Scripts a Customer adds to its own site are its responsibility.

• Cloudflare, Inc. (United States, data centers worldwide): hosting, storage, email, site analytics, request logs and AI model hosting, for every category of data in this policy.
• Anthropic, PBC (United States): the Clutch agent and its stored sessions, memory and skills, image descriptions, grader classification and Journey.
• TypeSafe, through Cloudflare: site search answers and some grader judgments.
• xAI, through Cloudflare: image generation.
• Polar Software, Inc. (United States): merchant of record for checkout, payments, invoices and sales tax.
• Google LLC (United States): Places search, PageSpeed Insights, and the Google Workspace that hosts our own email.
• Browser Use, Inc. (United States): the cloud browser that opens public pages for the grader and Journey.
• DataForSEO OÜ (Estonia): keyword and ranking data, from keywords and website addresses only.
• Slack Technologies, LLC (United States): Slack messages, only if you add Clutch to Slack.
• Photon, with Apple's iMessage: text messages, only where texting is turned on.

Our processing terms incorporate this list, and we email Workspace owners at least 15 days before a new provider starts processing Customer personal data.

clutch.io is a site hosted on Clutch, so it sets no cookies of its own and counts page views without cookies or stored IP addresses.

app.clutch.io uses only first-party cookies and browser storage that keep you signed in, protect sign-ins and connections in progress, remember settings and your choice about tips and news, and record the website and campaign that first brought you.

Customer Sites set no cookies by default. A site sets one only when a visitor asks a form to remember them or a signed-in editor opens it, and keeps small things such as a visitor's last search in browser storage. A Customer's own scripts may set their own.

Fonts and icons. The app and our emails load fonts from Google Fonts and website icons from Google, and design boards load fonts from jsDelivr; your browser sends those companies its IP address and user agent, and an icon request names the website shown. No other third party collects data about your activity on our websites.

Do Not Track and Global Privacy Control. We do not track you across other companies' websites, so a Do Not Track signal changes nothing, and we treat a Global Privacy Control signal as an opt-out of sale and sharing, which we do not do anyway.

When someone visits a Customer Site, we process for the Customer that runs it:

• Page views: the page, referring website, campaign, approximate location inferred from the IP address, and whether the visitor is a verified bot. We do not store the IP address, set a cookie or link one visit to another.
• Clicks, forms and downloads: that a visitor followed a link off the site, sent a form or downloaded a file.
• Search questions and agent calls: what visitors ask the site's search, what AI assistants ask or do on the site, and what the site answered.
• Form submissions: every field submitted, with the page, the time and our spam check, stored with the site and delivered where the Customer chooses, such as a confirmed email address, a webhook or a connected service.
• Remembered visitors: the values a visitor asks a form to remember.

We use each request's IP address, without storing it, to limit form sending and stop spam. We use Visitor Data only to serve the Customer, and in aggregated, de-identified form to keep the Services working, never to profile visitors, sell or advertise. The Customer controls it and must describe it in its own privacy policy, and visitors should send requests to that business; we pass on any we receive and help it respond.

The grader measures a public website's speed, accessibility and how well search engines and AI assistants can read it. Journey has an AI agent try a visitor's task on a site, such as finding a price, and records each step.

What we collect. The address you submit, the site's public pages and screenshots, PageSpeed Insights measurements, the businesses a site names as its manager, agency or platform, and for Journey the task, steps and agent's trace. You need not say who you are, and we use your IP address only to limit scans, without storing it.

What we publish. Results are public: each graded site gets a page on clutch.io that search engines may index, and public tables rank sites, agencies and platforms. A screenshot or result can show a name from a site's public pages, and we remove personal data about you from any grader page on request.

Corrections and removal. Each grade page shows when the site was scanned and the checks behind its grade. Clutch competes with some of the platforms and agencies we grade. If you show us a factual error, we correct it within 30 days or tell you why we will not. If you own or run a graded site, we remove its grade page and table entry from clutch.io on request and ask search engines to drop the page. Write to legal@clutch.io from the site's domain, or with other proof that you run it.

Monitoring. Where we offer monitoring and you monitor a site, we keep your account, the domain and its grades, and email you when the grade changes. To stop, write to privacy@clutch.io.

If you work at a business whose website we graded or that we may offer the Services to, we may collect from public sources your name, job title, employer, work email and phone number, professional social media accounts and follower counts, career history, public posts, talks and events, and our notes on the topics, vendors and views you discuss publicly, including whether a post is positive or negative. We note where and when we found each detail.

We use this, on our legitimate interest in offering the Services to businesses, only to decide whether and how to contact you, to send your business's website report, to follow up and to record whether you replied. Our first message says where we found your details and links here.

Opting out. Reply to any message or write to privacy@clutch.io and we stop, keeping your address on a suppression list so we do not contact you again. You can also ask us to delete what we hold; see Your rights.

Tips and news. Any tips and news we send account holders have an unsubscribe link and can be turned off in settings. Service messages, such as sign-in links and billing notices, continue while you have an account.

We keep personal data only while we need it for the purposes in this policy or the law requires it. The key periods:

• Accounts: while the account exists, with its sign-in records. We delete an account within 30 days of a verified request, except what we must keep.
• Workspace content: sites, versions, chats, form submissions and connections stay until the Customer deletes them or closes the Workspace. After closing, it has 30 days to ask for a copy of its Customer personal data, and we delete its content within 60 days. Some copies, such as a deleted site's media files and agent sessions archived at Anthropic, are deleted on request to privacy@clutch.io.
• Billing and usage records: as long as tax and accounting law requires, generally seven years.
• Logs and site analytics: for a short period set by our hosting provider.
• Grader results: while they serve as a public record of the web, or until a request under Grader and Journey is granted.
• Business contacts: 12 months after collection if we never contact you; otherwise until you opt out or ask us to delete them, and no more than two years after we last contacted you. We keep a record of an opt-out so we honor it.
• Backups: deleted data can remain in recovery copies for up to 30 days more.

We keep data longer only where the law requires it, or to resolve disputes, enforce our Terms or defend legal claims.

Our measures include HTTPS for all traffic, encryption at rest, salted one-way hashes for passwords, encryption of the API keys and tokens you give us for connections under a key held outside the database, an isolated store for each site's data, and production access limited to staff who need it. No system is perfectly secure. If a breach affects your personal data, we notify you and the authorities as the law requires, and Customers as our processing terms require.

Depending on where you live, you may have the right to know, get a copy of, correct and delete your personal data; to receive what you gave us in a portable format; to object to processing based on legitimate interests, including direct marketing, or to restrict it; to withdraw consent; to opt out of sale, sharing, targeted advertising and significant profiling, none of which we do; and to complain to a data protection authority.

How to ask. Write to privacy@clutch.io from your account's email address, or tell us which account or contact record is yours. You can change your name and marketing choice in the app's settings. The app does not yet let you delete your account or export your data yourself, so we do both on request, within 30 days of a verified request.

Verification and agents. We confirm that a request comes from you, usually through the email address we hold, and may ask for more for sensitive or extensive requests. Someone you authorize may ask for you with your signed permission, and we may still confirm with you.

Timing and appeals. We answer within one month under EU and UK law and 45 days under US state laws, extendable once where the law allows. If we decline, reply to appeal; we decide within the time your law sets, at most 60 days, and explain why, and you can then contact your state's attorney general.

Complaints. Write to privacy@clutch.io; we acknowledge a complaint within 30 days and answer without undue delay. Under EU, UK or Swiss law you can also complain to your data protection authority, in the United Kingdom the Information Commissioner's Office.

No discrimination. Using these rights never changes your price or the quality of your service. For data about visitors to a Customer Site, ask the business that runs it; see Visitor Data.

California. This policy is our notice at collection and privacy policy under the California Consumer Privacy Act. In the past 12 months we collected identifiers, customer records, commercial information, internet activity, approximate geolocation (only in Visitor Data), images and files, professional information and inferences about business contacts, and the content of messages and sites, from the sources and for the purposes above. We disclosed them for business purposes to the companies in Service providers, and to Google and jsDelivr when a page loads their fonts or icons. The only sensitive personal information we collect is sign-in credentials and connection tokens, used only to sign you in and to use the accounts you connect, so the right to limit does not apply. We have not sold or shared personal information in the past 12 months, including that of anyone under 16. See Your rights and Retention.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

Other states. Residents of states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas and Virginia, have the rights in Your rights, including appeal. We do not sell personal data, use it for targeted advertising or profile people with legal or similarly significant effects. Nevada residents may still send an opt-out request to privacy@clutch.io.

Clutch is based in the United States. We and our service providers process personal data there and wherever they operate, including our hosting provider's data centers worldwide, where data protection laws may differ from yours. A Customer that needs the EU Standard Contractual Clauses or the UK Addendum for personal data we process for it can write to privacy@clutch.io and we will sign them.

The Services are for businesses and the people 18 or older who act for them, and they are not directed to children under 13. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to privacy@clutch.io and we will delete it.

Where texting is turned on, a Workspace's members can text the Clutch agent through Photon and Apple's iMessage. We use your phone number and messages only to run that conversation for your Workspace.

We never share mobile numbers or text-message opt-in consent with third parties or affiliates for their marketing or promotional purposes. We share them only with the providers that carry the messages, to deliver them.

Message and data rates may apply. To stop texts, remove your number in your Workspace's settings, ask a Workspace admin to turn texting off, or write to privacy@clutch.io.

We post every version of this policy here with its date, and update it before we add a feature that collects new kinds of personal data. We tell account holders by email or in the app at least 30 days before a material change takes effect, unless the law requires it sooner, and ask for consent where the law requires it, always before using Google user data in a new way.

Clutch Creator, Inc. is the controller of the personal data this policy describes.

• Email: privacy@clutch.io
• Post: Clutch Creator, Inc., Attn: Privacy, 9337 Katy Fwy, Ste B, PMB 8001, Houston, TX 77024, United States