Privacy Policy

Controller

[Full name or sole proprietorship], [address in Switzerland]. Contact: support@cleansaas.io

Data we collect

Account: email address. Profile: onboarding answers (level, time, budget, preferences, exclusions, niche). Usage: journal, coach conversations, metrics you enter or connect. Payments: handled by Stripe; we never store your card. Technical: IP address, used temporarily to limit abuse.

How we use AI

To generate content and run Anat, excerpts of your data are sent to our AI provider (Anthropic). We minimize this data: your name and email are never sent.

Your data is never used to train an AI model.

AI analysis of your journal requires your explicit, revocable consent. You can exclude any entry from analysis.

Before you create an account

Onboarding answers stay in your browser's local storage until you sign up. To refine your niche and comment on your profile, some answers (audience, time, budget, preferences, exclusions, niche, founder profile) are sent to the AI, without your name or email.

Processors

Hosting: Vercel (United States). Database and authentication: Supabase (servers in the European Union). AI: Anthropic (United States). Payments: Stripe. Abuse rate limiting: Upstash (European Union). Transfers to the United States rely on the EU-US and Swiss-US Data Privacy Framework where the provider is certified, and on standard contractual clauses otherwise. [To be checked for each provider.]

Connected payments (Pro plan)

If you connect your Stripe account, you provide a read-only restricted key. It is encrypted (AES-256) and cannot charge, refund or change anything. We read your subscriptions, failed payments and refunds to compute totals (MRR, customer count, new and cancelled customers) and we keep only these totals, never your customers' names, emails or details. You can disconnect at any time: the key is deleted immediately, and the history of totals too if you ask.

Retention

For as long as your account is active. When you delete your account, your data is erased within [30] days, except where the law requires otherwise (billing).

Your rights

Access, correction, deletion, portability, objection and restriction. Export and delete your data from your account, or email support@cleansaas.io. You can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local authority. Processing follows the Swiss FADP and the GDPR. [Add applicable US state privacy rights, e.g. CCPA.]

Security

Each user can only access their own data (database-level access control). Data is encrypted in transit and at rest (hosting provider disk encryption).