Privacy Policy
Last updated: October 7, 2026
This policy explains how cletus labs ("we", "us", "our") collects, uses, stores, and shares personal information, and your rights under applicable laws including the EU General Data Protection Regulation ("GDPR", Regulation (EU) 2016/679), the UK GDPR (Data Protection Act 2018), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA", Cal. Civil Code § 1798.100 et seq.), and other applicable privacy laws.
1. Data Controller
cletus labs is the data controller for personal data processed through this platform. For GDPR purposes, you may contact us at privacy@cletuslabs.live. We do not currently have a designated Data Protection Officer (DPO); if required by applicable law, one will be appointed.
2. What We Collect and Why
Account information
Email address and password (stored hashed by our authentication provider), plus the profile you fill in during onboarding (name, organization, intended use), when you accepted the Terms of Service, and your dashboard preferences.
Legal basis (GDPR Art. 6(1)(b)): necessary to provide the account and service. CCPA category: identifiers.
Training data (tabular files and image archives)
The files you upload to train a model (CSV, Excel, JSON, JSONL, Parquet, HDF5, SQLite, or a .zip of images). They are stored in Supabase Storage and used only to train the model you asked for and to show you its training data. We do not analyze, sell, or share them. Deleting the model deletes the file.
Legal basis (GDPR Art. 6(1)(b)): necessary to perform the service you requested. If your data contains personal data about other people, you are responsible for having a lawful basis to upload it (GDPR Art. 6) and any consents it requires.
Model artifacts
The trained model weights, preprocessing statistics (such as column medians, category lists, and scaling factors), and an evaluation summary, stored under your account. Only you (and members of a team you assign the model to) can see them; predictions require the model's API key.
Legal basis (GDPR Art. 6(1)(b)): contract performance.
Prediction requests
Values you send to a model's prediction endpoint, and files you upload to “Score a file”, are processed in memory to produce the result and are not stored. We keep request metadata only: time, HTTP status, latency, success, and how many rows were scored. This metadata powers your usage page and monthly quota.
Legal basis (GDPR Art. 6(1)(f)): legitimate interest in reliability, abuse prevention, and enforcing plan limits. CCPA category: internet/network activity.
AI chat conversations
When you use the AI assistant on a model, your messages and a description of the model (its name, columns, and metrics, never your raw training rows) are sent from our server to Ollama (ollama.com), which generates the reply. Conversations are saved to your account so you can reopen them, and are deleted with the model or your account.
Legal basis (GDPR Art. 6(1)(b)): necessary to provide the chat feature you chose to use.
Team content
If you use teams: team names, membership and roles, team chat messages, and notes on models. These are visible to the members of that team.
Legal basis (GDPR Art. 6(1)(b)): contract performance.
Website analytics
We use Vercel Web Analytics to understand how the site is used. It records anonymized page views and basic technical details, such as the page visited, referrer, country, browser, operating system, and device type. It does not use cookies or store identifiers in your browser, and it does not track you across other websites. Visitors are counted using a short-lived hash that cannot be used to identify you, and the data is not combined with your account or training data.
Legal basis (GDPR Art. 6(1)(f)): legitimate interest in understanding and improving the service. CCPA category: internet/network activity.
Security records
An internal log of sensitive account actions, such as deleting models, creating or revoking API keys, and joining or leaving teams, kept to investigate abuse and disputes.
Legal basis (GDPR Art. 6(1)(f)): legitimate interest in security.
3. Legal Bases for Processing (GDPR)
Where GDPR applies, we rely on the following legal bases under Article 6:
- Art. 6(1)(b) — Contract: Processing necessary to provide the service you signed up for (training, inference, team features).
- Art. 6(1)(a) — Consent: Where you explicitly consent to optional data uses (e.g., team-shared analytics). You may withdraw consent at any time.
- Art. 6(1)(f) — Legitimate interest: Service security, abuse prevention, and aggregate usage analytics. You may object to processing based on legitimate interest; contact us to exercise this right.
- Art. 6(1)(c) — Legal obligation: Where required by applicable law (e.g., retaining records for tax or legal compliance).
4. Data Storage and Security
Your data is stored in Supabase (PostgreSQL with encryption at rest and TLS in transit). Row-level security policies ensure users can only access their own data. API keys are stored as SHA-256 hashes — we cannot recover raw keys if lost.
We apply technical and organizational measures proportionate to the risk, including access controls, audit logging, and minimal data collection. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
5. International Data Transfers
cletus labs and its infrastructure providers (Supabase, Render) are based in or transfer data to the United States. If you are located in the European Economic Area (EEA), UK, or Switzerland, your personal data may be transferred to countries that may not provide the same level of data protection as your jurisdiction.
We rely on Standard Contractual Clauses (SCCs, Commission Decision 2021/914/EU) for transfers from the EEA to the US. Where applicable, we also implement supplementary measures such as encryption and access controls. You may request a copy of the relevant safeguards by contacting us.
6. Data Sharing
We do not sell, rent, or share your personal data or training data with third parties, except:
- Supabase: Storage and database provider. Data processed under a data processing agreement (DPA).
- Render: Backend hosting. Processes your API requests; does not have access to your training data or model artifacts.
- Vercel: Frontend hosting and CDN. Serves the web application, routes all browser requests, and provides Vercel Web Analytics (anonymized, cookieless page-view statistics). Does not have access to your training data or model artifacts.
- Ollama: Generates AI chat replies. Receives your chat messages and a description of the model, only when you use the AI assistant.
- Legal requirements: If compelled by law, court order, subpoena, or regulatory authority. We will notify you to the extent permitted by law.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before transfer and before your data becomes subject to a different privacy policy.
For CCPA purposes: we do not "sell" or "share" personal information as defined under Cal. Civil Code § 1798.140(ad) and § 1798.140(ah).
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide services. Training data and model artifacts are retained until you delete the associated model or close your account. Inference logs are retained for 12 months. After account deletion, data is purged within 30 days, except where retention is required by applicable law.
8. Your Rights
Depending on your jurisdiction, you may have the following rights:
GDPR rights (EU/UK — Arts. 15–22)
Access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), rights related to automated decision-making (Art. 22). You also have the right to lodge a complaint with your national supervisory authority (Art. 77).
CCPA/CPRA rights (California — § 1798.100 et seq.)
Know what personal information is collected (§ 1798.100), delete personal information (§ 1798.105), correct inaccurate information (§ 1798.106), opt-out of sale/sharing (§ 1798.120 — we do not sell), limit use of sensitive personal information (§ 1798.121), non-discrimination for exercising rights (§ 1798.125).
To exercise your rights, delete your models and data from the dashboard, or contact us at privacy@cletuslabs.live. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before fulfilling a request.
9. Automated Decision-Making
We do not make solely automated decisions about you that produce legal or similarly significant effects (GDPR Art. 22). The ML models you train are tools you control; their predictions are not used by us to make decisions about you.
10. Cookies and Local Storage
We use browser localStorage to store your session token, basic account details (email, name, onboarding status), and whether the sidebar is open. We do not use tracking cookies, analytics cookies, third-party advertising cookies, or any cross-site tracking. Our website analytics (Vercel Web Analytics, see Section 2) is cookieless and stores nothing in your browser. No cookie consent banner is required because we use only strictly necessary storage.
11. Children's Privacy
cletus labs is not directed to or intended for users under 13 years of age (or 16 in certain EEA jurisdictions). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.
12. Changes to This Policy
We will notify registered users by email of material changes to this policy at least 30 days before they take effect. The updated policy will be posted here with a revised "Last updated" date. Continued use of the Service after the effective date constitutes acceptance.
13. Supervisory Authority
If you are in the EU/EEA or UK and believe we have violated applicable data protection law, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU). We encourage you to contact us first so we can address your concerns directly.
14. Contact
Privacy questions, data subject requests, or concerns: privacy@cletuslabs.live. We aim to respond within 72 hours for urgent matters and 30 days for formal requests.