Privacy policy

1. Who we are

Klarvo is operated by Open Digital WEB LTD trading as Klarvo, registered at 36 Tyndall Court, Lynchwood Business Park, Peterborough, PE2 6LR, United Kingdom. We act as the data controller for personal data we collect about visitors to klarvo.io and account holders on app.klarvo.io.

For any privacy enquiry, email hello@klarvo.io.

2. What data we collect

Four categories, no more:

• Account data. Name, email, organisation, role. Provided by you at signup or by your admin when they invite you.
• Enquiry data. If you contact us or ask for a one-off follow-up after a free tool, we collect your email address and the page or tool you used. We do not receive your checker answers through that form, and a one-off follow-up request does not add you to a marketing list.
• Compliance content. The AI-system descriptions, classifications, obligations, evidence files, and policies you create in Klarvo. Held in your private organisation workspace; invisible to other organisations.
• Operational and analytics metadata. Server logs (IP, timestamp, request path), error reports, billing records, audit logs, and — only after analytics consent — page URLs, browser/device details, approximate location, pseudonymous analytics identifiers, and the product events listed in our analytics contract.

3. Why we collect it

• To provide the service. Classifications, evidence storage, billing.
• To answer you. We use enquiry data to respond to the question or one-off follow-up you requested.
• To meet legal obligations. Tax and accounting retention; security and abuse prevention.
• To improve Klarvo. Consent-based usage analytics showing which pages, free tools, and product flows help. We do not use these analytics for advertising or personalisation.

We rely on the GDPR lawful bases of contract and steps taken at your request before a contract (operating your account and answering requested product follow-ups), legal obligation (tax and accounting), legitimate interests (security, abuse prevention, and answering general enquiries — assessed and balanced against your rights), and consent for Google Analytics.

4. KlarvoEngine and AI processing

When you classify an AI system, the description you provide is sent to KlarvoEngine for classification. KlarvoEngine processes the description, returns the verdict, and we store the verdict and the input in your private workspace.

The underlying capability provider receives the description as transient input to produce the classification. Your data is not used to train any model. We never share your evidence file contents with any external party — the engine reads metadata only.

AI privacy controls in Settings let your organisation reduce what is sent (minimal mode) or disable AI processing entirely on a per-feature basis.

5. Data sharing

We share data with a small list of processors only to operate the service:

• Supabase — primary database, authentication, file storage (EU region).
• Stripe — billing and payment processing.
• Resend — transactional email (account confirmations, deadline reminders).
• Cloudflare — hosting and CDN for klarvo.io.
• The AI capability provider behind KlarvoEngine — for the duration of each classification call.

Each processor is bound by a Data Processing Agreement that mirrors the requirements of GDPR Articles 28–29.

6. Retention

Account and compliance content — held for the life of your account and 90 days after deletion (so accidental deletion can be reversed).

Audit logs — held for 12 months in identifiable form, then pseudonymised, then hard-deleted at 7 years (legal-defensibility window for AI Act enforcement).

Billing records — held for 7 years to meet UK / EU tax retention requirements.

Server logs — held for 30 days.

Enquiry records — kept only for as long as needed to answer and manage the requested follow-up. They are not used for general marketing. You can ask us to erase yours at any time.

7. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (subject to the limited retention periods above).
• Restrict or object to processing.
• Receive your data in a portable format.
• Lodge a complaint with your local supervisory authority (e.g. the UK ICO; the relevant Member State data protection authority in the EU).

Email hello@klarvo.io to exercise any right. We respond within 30 days.

8. International transfers

Where data leaves the European Economic Area (e.g. some processors hosted in the United States), we rely on the European Commission's Standard Contractual Clauses (or successor mechanisms) and run a transfer impact assessment per the EDPB guidance.

9. Cookies & analytics

We use essential storage and, only after you consent, Google Analytics 4 on klarvo.io and app.klarvo.io. See the cookies policy for the cookie names and controls.

Analytics events carry product facts only. We do not send Google your email, name, organisation name, AI-system descriptions, checker answers, or other free text. Declining analytics does not affect Klarvo, and you can withdraw consent at any time.

10. Updates

We update this policy when the product or the legal framework changes. The effective date at the top reflects the most recent change. Material changes are notified to account holders by email.