Clanker CloudPrivacy Policy
This policy explains how Clanker Cloud handles account, billing, analytics, social sign-in, and related service data. Version 2026-09-18.
2026-09-18
This policy applies to Clanker Cloud accounts, desktop downloads, optional supporter billing, analytics cookies, and related hosted services.
Who we are and our role
Clanker Cloud is a product of Nov 1337 Labs, Inc. We are a controller for account administration, website, security, support, and business records. When we process customer content on a business customer’s documented instructions through Standard hosted inference, sandboxes, the remote relay, or a contracted protected service, the applicable service agreement and executed Data Processing Addendum must define our processor or service-provider role and the customer’s instructions. Publishing this policy does not mean that a DPA, BAA, CJIS agreement, certification, or protected environment already exists for any customer.
Account and service data we collect
We collect the information needed to operate Clanker Cloud: email or username, display name, password hash or linked OAuth metadata, session and security metadata, account tier, transaction references, selected region, the yes-or-no sensitive-data onboarding answer, protection status, device enrollment and remote-action metadata, support communications, and waitlist email, optional name or message, and submission metadata. We do not ask which profession, case, patient, investigation, or regulated-data category is involved in the onboarding answer.
Hosted prompts, responses, and diagnostics
Clanker stores Workspace conversations, messages, tool results, uploaded files, generated artifacts, selected memory, and execution or recovery state to provide the service. This storage is separate from model-provider retention. The inference metering record does not retain prompt and response bodies by default. For Standard accounts, content explicitly submitted as feedback or diagnostics may be retained for up to 30 days. An activated restricted Business data profile disables content diagnostics. Business subscriptions using Standard processing retain the normal diagnostic settings. Saved Workspace content follows the applicable deletion and project-retention controls, including when Gemini ZDR is active. We do not use Business customer content to train our own or general-purpose foundation models.
Business Gemini ZDR and data controls
Business data controls and Gemini ZDR require separate enrollment, agreement, provider verification and activation. New Business subscriptions continue using Standard processing and existing Workspace settings. A subscription alone does not change the data profile. When separately enrolled in the restricted Business data profile, approved Gemini requests use a verified Vertex AI project, location, and model allowlist. Activation requires an applicable abuse-monitoring exemption and verified request-logging and cache settings. If verification expires or eligibility lapses, affected model requests stop without provider fallback. ZDR covers this model-provider processing, not Clanker storage or customer-selected external services. Owners and administrators control memory and learning, sharing, managed connections, and whole-project retention. The creator’s Business eligibility supplies organization features. Every member of a ZDR organization must also have Business eligibility; we check current membership and plan eligibility to control access. Losing eligibility suspends access while stored content, restrictions and retention remain. These controls do not constrain internet access from customer scripts or computers. Voice, authenticated Marketplace features, media analysis, AI document indexing, App builds, and managed BYOA inference are unavailable under this profile pending compatible routes. Business uses shared infrastructure; Enterprise deployment and residency commitments require separate agreement and activation.
Purposes and legal bases
We process data to perform the service contract and requested actions; protect accounts, users, and infrastructure under our legitimate interests and corresponding customer interests; meet legal obligations; and, for optional analytics or other consent-based features, based on consent. You may withdraw analytics consent at any time without affecting earlier lawful processing. The sensitive-data answer recommends an infrastructure boundary; it is not used to inspect or restrict the substance of your work.
Connected infrastructure and credentials
Clanker Cloud is designed to keep cloud credentials and infrastructure control local-first. Credentials and operational context should remain on your machine unless you explicitly submit data to our hosted services or support channels. Desktop workspace and chat content is stored in local application files and SQLite and is not application-level encrypted today. Organizations handling regulated data must enforce managed full-disk encryption, device access, backup, recovery, and wipe controls on approved endpoints.
Connected Google Workspace files
Google Workspace is an optional connection that is separate from Google social sign-in. If you connect it, Clanker stores your Google account identifier, email, granted scope metadata, and an encrypted OAuth refresh token while the connection exists. Clanker requests the drive.file scope and uses Google Picker so you choose the individual Drive files made available to the app. Agents can use a reviewed allowlist of tools from Google’s official Drive, Docs, and Sheets remote MCP servers only after you assign the connection to that Agent, and connector actions require confirmation. If a reviewed tool is absent from a reachable preview MCP catalog, Clanker may use the equivalent bounded Google Workspace API operation; it does not retry a failed or uncertain MCP write through that fallback. Clanker does not automatically copy or index your Google Drive. MCP and Google API results are processed transiently to answer your request; a summary you choose to keep in a Workspace conversation remains part of that conversation. We use Google user data only to provide or improve this user-facing connection, do not use it for advertising, do not sell it, and do not use it to train generalized AI models. Human access is prohibited except with your affirmative agreement for support, when necessary for security or abuse investigation, or when required by law. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Disconnecting revokes the Google token and removes the live connection record; you can also revoke access in your Google Account. Account deletion attempts revocation before the account record is removed.
Connected Gmail
Gmail is an optional connection separate from Google files and Google social sign-in. If you connect Gmail, Clanker stores the Google account identifier, email address, granted scopes, and an encrypted OAuth refresh token while the connection exists. Clanker requests gmail.readonly to search and read the authorized mailbox and gmail.compose to create drafts. Mailbox access is broader than the selected-file drive.file permission. The reviewed Gmail tool allowlist supports searching conversations, reading messages and threads, listing drafts and labels, and creating drafts; you review and send those drafts in Gmail. Gmail content retrieved for your requests may be provided to the model configured for your Session. Saved conversations, summaries, and outputs follow normal Workspace retention. Clanker does not automatically mirror or index your mailbox. The Google user data protections, Limited Use requirements, restrictions on advertising, sale, generalized AI model training and human access, and disconnect and account-deletion controls described above also apply to Gmail. Gmail credentials remain on the backend and are not provided to the Google file picker.
Current subprocessors and service providers
Current providers include Cloudflare for website delivery, the Worker proxy, Workers AI voice and document indexing on supported Standard features, shared Workspace compute, browsers, queues, indexes, and object storage; Supabase for the website waitlist; Google Cloud for the Standard account control plane, Cloud SQL Workspace and remote-relay storage, hosted-inference transport, legacy GCP runtime or state where applicable, and future contracted protected runtimes; Google Gemini Developer API, OpenAI API, and Moonshot AI for selected Standard hosted inference; Google Cloud Vertex AI for approved Business Gemini processing when active; Google Workspace APIs and official remote MCP services for the optional user-connected Drive, Docs, Sheets, and Gmail features; Google and GitHub for optional social sign-in; Google Analytics and OpenAI Ads measurement only after opt-in; Stripe for payments; and the customer’s selected infrastructure or model providers when explicitly connected. See the public Subprocessor and Transfer Register for purposes, data categories, and boundary details. A protected order identifies the approved subset, locations, support access, and replacement process.
Web-to-desktop remote control
When you enable web access to an enrolled Secretary or Cerebro desktop, the relay temporarily processes the instruction, enrolled instance identifier, response, status, actor, and limited diagnostics. Requests stop being accessible after their two-minute expiry; physical cleanup follows the once-per-minute cleanup cycle. Response content is removed after delivery, while orphaned terminal rows become cleanup-eligible after one hour. Security and action audit metadata contains no instruction or response payload by default and is retained for 90 days unless a protected customer contract sets another period. Protected and sovereign accounts currently reject remote relay use.
Analytics and cookies
With your analytics opt-in, Clanker measures campaign visits, signup-button clicks, completed new-account registrations, and whether those accounts have a saved successful Workspace task. A random visit ID expires in your browser after 30 minutes; a consenting clicked visit can be attributed to a new account created within 24 hours. Campaign records contain the campaign page, timestamps, limited source, medium, and campaign tags, plus an internal account link for measuring task activation. We do not send this internal link to advertising providers or store raw IP addresses, prompts, task content, or full URLs in campaign records. The account link is removed when the account is deleted, and campaign records are removed by the regular retention cleanup after 90 days. Returning logins and button clicks are not counted as completed registrations. Withdrawing analytics consent stops future campaign attribution. Google Analytics is not loaded before you opt in and is never loaded on the authenticated portal origin or sensitive account, Secretary, Cerebro, sandbox, or portal routes. If you accept analytics on the public website, Google may use cookies and process pages viewed, approximate location, device and browser signals, and interaction timing. On the portal account experience only, the OpenAI Ads measurement SDK may load after a separate affirmative ads-measurement opt-in to preserve ad attribution and measure a valid Lite, Pro, or Business Stripe checkout start. Clanker sends the selected plan slug, name, and price plus network, browser, device, attribution, and page metadata; it does not manually pass an email, account identifier, signed checkout reference, prompt, response, credential, or raw backend error. If automatic advanced matching is enabled in OpenAI Ads, the SDK may detect supported account-page information and send SHA-256 hashes generated in the browser, not the raw values. Declining or withdrawing in Cookie settings sends a denied consent state to the measurement provider and stops future event pings. YouTube videos are click-to-load from youtube-nocookie.com; the page warns before loading because Google/YouTube will then receive network and device information.
Retention schedule and deletion
Account profile and authentication records are kept while the account exists and removed from live systems promptly after verified account deletion. Connected Google Workspace token and account metadata is kept only while that connection exists and is removed from live systems when it is disconnected or the account is deleted; Google’s own records remain subject to Google’s policies and the user’s Google Account controls. The database currently retains 14 successful automated backups, normally about 14 days at the daily schedule. The seven-day soft-delete recovery window applies only to deleted Google Cloud Storage object generations. Live Cloudflare R2 objects are removed through the applicable cleanup process; derived indexes, runtime state, queues, and provider recovery copies follow their separate cleanup or recovery windows. A deletion request is not an immediate physical-erasure guarantee. Manual backups, outages, legal holds, and provider recovery behavior can change the final deletion date and are handled under the applicable contract. These recovery copies are not used for analytics or restored except for disaster recovery or legal necessity. Waitlist entries are kept until launch outreach is complete, the person asks us to remove the entry, or the entry is no longer needed. Business using Standard processing saves content under the normal Workspace settings and deletion controls. The future restricted Business data profile saves content until explicit deletion unless an administrator enables whole-project retention of 30, 90, or 365 days. Existing projects receive the selected period from the policy change and new projects from creation, regardless of subsequent editing. General, unassigned content, global Agents and Skills stay until explicitly deleted. Whole-project cleanup includes owned Sessions, files and revisions, derived indexes, and related runtime state; failures remain pending for retry. Copies already imported or downloaded by recipients and copies at customer-selected services are not recalled. Automatic retention continues after subscription downgrade. Policy-change audit records are retained for 365 days. Business agreement receipts record the data owner, accepting actor, agreement version and acceptance time, and remain while the account exists. Standard opt-in diagnostic content is retained for at most 30 days. Application action and security audit metadata is retained for 90 days by default. Separately, restricted cloud-provider administrative and data-access audit logs are retained for 365 days as security and compliance evidence. The application does not intentionally add prompt or response bodies to those audit records, but provider-generated fields depend on the enabled service and are reviewed as part of protected onboarding; the records may contain account, caller, or resource identifiers. Remote payload retention is described above. Transaction, tax, dispute, legal-hold, or fraud-prevention records may be retained separately for the period required by applicable law; access is restricted and they are not used for product analytics.
Your privacy rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, and portability; withdraw consent; and complain to your local data-protection authority. You can also update region and data settings, disconnect Google Workspace, disable remote desktop access, revoke analytics consent, and delete the account. We may verify identity and may decline or limit a request only where law permits or requires it.
International transfers and regional boundaries
Standard and Business use shared services; an account region or Gemini inference location does not establish residency for the whole Workspace. Providers may process data in other countries under their applicable transfer mechanisms. For protected customers, the signed order and DPA identify the approved region, subprocessors, transfer mechanism such as applicable Standard Contractual Clauses, encryption and support-access controls. A plan purchase or region selector alone does not establish this boundary.
Data Processing Addendum and protected orders
A business customer acting as controller must execute an applicable DPA with us before submitting personal data to any hosted Clanker Cloud feature. A DPA applies only when signed by authorized parties; this policy does not create one. A business associate agreement, CJIS agreement, data-residency commitment, service level, government control schedule, or other regulated-data commitment additionally requires signed terms and an associated protected environment marked active. Until those requirements are met, Standard terms apply and personal, sensitive, or regulated data covered by the missing agreement must not be submitted to hosted workflows. Contact us before procurement to review the required documents and provider eligibility.
Security and incident contact
We use access controls, encryption in transit, protected session cookies, scoped device identifiers, retention controls, and provider security features appropriate to the configured service. No system is risk-free. Protected customer incident-notification timelines and cooperation duties are defined in the signed DPA or order. Report a suspected privacy or security incident to the contact below without including secrets or affected payload content in the first message.
Policy updates
We may update this policy over time. We will publish the revised version and effective date here. If a material change requires renewed consent or contract notice, we will request it through the account or the customer’s contractual contact rather than treating silence as consent.
Questions about privacy
Contact support@novlabs.ai for privacy requests, security reports, a DPA, the current subprocessor schedule, or procurement review. Include only the account identifier and request type in the first message; do not email sensitive payloads.