Privacy Policy

This Privacy Policy explains how CLARUS LLC (“Clarus,” “we,” “us,” or “our”) collects, uses, and shares personal information when you use the Clarus application at askclarus.com and our website (together, the “Service”). It should be read with our Terms of Service and our Cookie Notice.

Clarus is a business service. Our customers are organizations (each a “Customer”), and the people who use Clarus are their leaders, employees, and advisers. For the information a Customer puts into the Service about its business and people, we act as the Customer’s service provider (in some laws, a “processor”), and the Customer decides how that information is used. For account, billing, website, and security information, we decide how it is used. Counsel: Confirm the controller/processor split and whether a data processing addendum is offered to customers.

1. Information we collect

Account information. When you sign up, are invited, or use the Service: your name, work email address, password (held by our authentication provider, not by us), the company you belong to and your role in it, and settings you choose, such as your time zone, city, and display theme. If you turn on two-step sign-in, an authenticator-app factor is registered with our authentication provider and we store hashed recovery codes.

Company and financial information. The information you and your colleagues enter about your business: company details, financial statements and figures you type in or import, Core Drivers, plans, simulations, Signal entries, and answers to diagnostics and to Clarus’s questions.

Documents. Files you upload, such as PDFs, spreadsheets, presentations, and images. We extract their text, read scanned pages and tables with an AI model, and create thumbnails, so the documents can be searched and used by Ask Clarus for people in your company.

Meeting transcripts. Transcripts you import, including the names of speakers and what they said, and the summaries generated from them. Each meeting has a visibility setting that controls who in your company can see it. The person importing a transcript is responsible for having the right to share it. Counsel: Meeting capture is behind a per-company switch and off by default. Confirm the wording on participants’ consent and on recording laws in two-party-consent states.

AI conversations. What you type into Ask Clarus and the other conversational features, and the replies generated for you. See Section 3 for who can see them.

Billing information. When your company subscribes, the Account Owner’s billing name, email address, billing address, and any tax ID are collected by our payment processor, Stripe. Card and bank details go directly to Stripe and never reach Clarus. We keep the Stripe customer and subscription identifiers, the plan, Seat count, and payment status.

Usage, device, and log information. When you use the Service, our servers and hosting provider record technical information such as your IP address, browser type, the pages and features you use, the date and time of requests, and errors. We keep an audit record of actions taken in the Service (for example, that a document was uploaded or a conversation turn happened), which does not contain the words of your Ask Clarus conversations. On the free-trial sign-up form, we keep only a keyed one-way hash of your IP address, to limit abuse. See our Cookie Notice for what is stored in your browser.

Communications. Emails and messages you send us, and records of the emails we send you, such as invitations, sign-in codes, and reminders.

Public information about your company. During setup, Clarus may read your company’s own public website to draft a first description of the business. Our crawler identifies itself and respects robots.txt; see About the Clarus Bot.

We do not knowingly collect information from anyone under 18, and the Service is not intended for children.

2. How we use information

We use personal information to:

• provide, maintain, and secure the Service, including signing you in, showing your company’s information to the right people, and generating AI replies, summaries, and suggestions;
• process payments, manage subscriptions, trials, and Seats, and send billing notices;
• send service emails, such as invitations, sign-in and verification codes, password resets, trial and billing reminders, and security alerts;
• provide support and respond to your requests;
• monitor, debug, and improve the Service, using usage information and aggregated or de-identified data;
• detect and prevent fraud, abuse, and security incidents, and enforce our Terms; and
• comply with legal obligations.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use Customer content to train AI models. We do not use advertising or analytics trackers in the Service.

3. Who can see your information inside your company

Most of what you enter, such as financial figures, Core Drivers, plans, and documents, is visible to the other Authorized Users of your company according to their roles, because the Service exists to share it with your leadership team.

Your Ask Clarus conversations are private to you. Nobody else at your company can open them, including Account Owners and Admins. A conversation leaves your account only if you choose to copy, print, download, or share it. Your answers to the questions Clarus asks you are different: they are read by your leadership team (Account Owners and Admins), and the Service says so where you answer.

Within Clarus, a small number of authorized personnel can access stored data, including conversations, when needed to provide support you ask for, keep the Service secure and working, or comply with the law. The text of a conversation is also processed by our AI provider to generate replies (Section 4). Counsel: Verified in code: every read of an Ask Clarus conversation is filtered to the signed-in person; the history route returns only the asker’s own turns; the audit ledger records that a turn happened, not its words. Confirm the description of Clarus personnel access (engineering has operator access to the database for support and recovery).

4. Service providers (subprocessors)

We use the following providers to run the Service. Each processes personal information only on our instructions and under contract.

AI processing and training. Clarus’s AI features run on Google’s Gemini models through Google Cloud Vertex AI, under Google Cloud’s terms for business customers. Under those terms, Google does not use the data we send to train or fine-tune its AI models without our permission, and we have not given that permission. Counsel: Confirm against the current Google Cloud Service Specific Terms (the “Training Restriction”) and the Cloud Data Processing Addendum. Google may cache prompts briefly and log them for abuse monitoring under those terms; confirm whether to disclose this or request the zero-data-retention exceptions.

Videos. Some pages may show a video hosted by YouTube (in privacy-enhanced mode) or Vimeo (with “do not track” set). The video provider receives your IP address and browser information when the video loads. See our Cookie Notice.

Counsel: Each provider above was verified in the code and configuration on 12 Nov 2026. Stripe is integrated but switched off until the Stripe go-live. No other subprocessors were found. Confirm whether to publish a separate subprocessor list with change notifications.

5. Other sharing

We share personal information only:

• within your company, as described in Section 3;
• with the service providers in Section 4;
• for legal reasons, when we believe in good faith that the law, a court order, or a valid government request requires it, or to protect the rights, safety, or property of Clarus, our customers, or others;
• in a business transfer, such as a merger, acquisition, or sale of assets, subject to this Policy; and
• with your consent or at your direction.

6. How long we keep information

Counsel: The backup and log periods are the production settings on 12 Nov 2026. Confirm whether to state a maximum retention period for lapsed accounts.

7. Security

We protect information with measures appropriate to its sensitivity, including encryption in transit (HTTPS) and at rest (Google Cloud’s default encryption), role-based access within each company, separation of each company’s data at the application layer, optional two-step sign-in, restricted operator access, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires. Counsel: Confirm the breach-notification commitment and timing.

8. Your choices and rights

• Access and correction. You can see and update your name, city, and other profile details in Settings → My Account.
• Delete your account. You can delete your own account in Settings → My Account. Deleting it removes your sign-in, ends your memberships, and replaces your name and email address in our records. The content you created inside your company, such as documents, conversations, and figures, stays with the company, because it is the company’s data. To have that content deleted too, write to us. If you are your company’s only Account Owner, you must transfer ownership first. Counsel: Self-deletion anonymizes the account but keeps authored content, including Ask Clarus conversations, attached to the anonymized record. Confirm this meets deletion requests under applicable law, or whether conversations should be erased on account deletion (an engineering follow-up).
• Company data. Requests about a company’s data, including export and deletion, are handled with that company’s Account Owner, because the Customer controls it.
• Emails. You can turn off notification emails, such as the weekly digest and reminders, in Settings → My Notifications. Security, sign-in, and billing emails are part of the Service and cannot be turned off. We do not send marketing email from the Service. Counsel: Confirm if marketing email is planned, and the opt-out wording.

Depending on where you live, you may have additional rights, such as to know what we hold about you, to receive a copy, to correct or delete it, to object to or restrict some uses, and not to be discriminated against for using these rights. To use any of these rights, write to admin@askclarus.com. We will verify your request and respond within the time the law requires. If we process the information for a Customer, we will pass your request to that Customer.

Counsel: Clarus is US-focused and hosts data in the United States. Confirm whether the CCPA/CPRA applies (it has revenue and volume thresholds, and covers California employees and business contacts) and whether other US state privacy laws apply. If Clarus will accept customers or users in the EU, UK, or Switzerland, the GDPR or UK GDPR would require a lawful basis for each use, international-transfer safeguards, and possibly a representative; this draft does not yet include those terms.

9. Do Not Track and Global Privacy Control

The Service does not use advertising or cross-site tracking, so there is nothing to opt out of. We honor Global Privacy Control signals as a request to opt out of sale and sharing, which we do not do in any case.

10. Changes to this Policy

We may update this Policy from time to time. If a change is material, we will notify Account Owners by email or in the Service before it takes effect, and update the date at the top of this page.

11. Contact

Questions about this Policy or your information: admin@askclarus.com · CLARUS LLC, Counsel: insert business address. Counsel: Contact address chosen by engineering (admin@askclarus.com). Confirm, or name a privacy contact.