Privacy policy

This policy explains what myclever AI collects, how we use it, and your choices.

Last updated: October 2026

1. Who we are

myclever AI is based in the United Kingdom. We are the data controller for personal data collected through the myclever AI platform.

For privacy questions, contact privacy@myclever.ai.

2. Data we collect

Account information

We collect information you provide when registering and using the service. This includes:

• Your name and email address.
• Your business name, type, industry and country.
• Business information you enter, including revenue ranges, margins and goals.
• Subscription, billing and marketing preferences.
• Support requests and other messages you send us.

If you create a password, we store a salted password hash, not the password itself.

If you sign in with Google, we receive the profile information needed to identify you and link your account, including your Google account identifier, name and email address.

Connected business data

When you connect a business tool, we collect the information needed to analyse your business. Depending on the tool, this may include:

• Accounting, invoice, payment and expense information.
• Sales, orders, products and customer information.
• CRM contacts, deals and pipeline information.
• Email campaign and audience performance.
• Advertising performance.
• Read-only Google Analytics 4 reporting data, including sessions, users, traffic channels, top page titles and key events.

We also store connection details. These include provider identifiers, connection status, OAuth tokens and, where applicable, your selected account or property ID.

The Google user data section below explains our GA4 access in more detail.

Service and usage information

We store goals, generated insights, suggested actions and action-completion status.

We also process technical information needed to operate the service, such as session identifiers, request information and security-related events.

3. How we use your data

• Create and manage your account.
• Connect to the business tools you authorise.
• Generate business insights and action plans.
• Save your goals, insights and progress.
• Manage subscriptions and payments.
• Send account, verification, billing and service emails.
• Respond to support requests.
• Protect the service from misuse.
• Measure Reddit advertising where you give marketing consent.
• Provide the limited benchmarking described below.

We do not sell connected business data.

AI processing

Production insights use Anthropic Claude, accessed through Replit’s AI gateway.

We send relevant business context, goals and selected information from your connected tools to generate your insights and action plans.

Some customer, contact and deal names are replaced with labels before they are sent. This is partial pseudonymisation, not full anonymisation. Other information, including free text and page titles, may still identify a person or business.

We do not use customer data to train AI models. We use our AI provider to process this information only to generate the user’s insights.

4. Data usage by plan

Core plan benchmarking

Benchmarking compares counts of goals created, connected tools and actions marked as completed.

The comparison pool excludes Pro and Scale workspaces. Comparisons generally use businesses with the same industry or business type. If neither is set, the comparison can use the wider eligible pool.

Benchmarks are shown only when there are at least five other eligible workspaces.

The calculation does not read financial figures, GA4 reports or other content returned by Google APIs. It uses service-level counts, not the contents of connected accounts.

A connected Google tool may count as one connected tool, but its reporting data is not included.

Pro and Scale plans

Pro and Scale workspaces are excluded from the benchmark comparison pool.

All plans still require us to process information to operate accounts, generate insights, handle billing and provide the service described in this policy.

5. Legal basis for processing

Under UK GDPR, the relevant legal bases are:

• Contract: Processing needed to provide your account, connected-tool features, insights and subscription.
• Consent: Optional marketing communications and consent-controlled advertising technologies.
• Legitimate interests: Operating and securing the service, and proportionate service measurement, subject to your rights.
• Legal obligations: Processing required by applicable law.

You can withdraw consent where processing relies on it. This does not affect processing that was lawful before withdrawal.

6. Your rights under UK GDPR

Depending on the circumstances, you may ask us to:

• Provide access to your personal data.
• Correct inaccurate information.
• Delete personal data.
• Restrict processing.
• Provide a portable copy of your data.
• Stop processing based on legitimate interests.
• Withdraw consent.

Contact privacy@myclever.ai to make a request.

We may need to verify your identity. We will explain any legal reason that limits what we can delete or provide. UK GDPR normally requires a response within one month, with extensions allowed in certain circumstances.

7. Data security

• AES-256-GCM encryption for stored OAuth tokens.
• Salted password hashes for password-based accounts.
• HTTPS for the published service and external API connections.
• Authentication and workspace access checks to restrict access.

Token encryption does not mean every database field is encrypted by the application. Account information, goals and generated insights are stored in our database.

No online service can guarantee absolute security.

8. Third-party services

We use the following services to operate myclever AI:

• Replit — hosting and AI gateway: Processes website and API requests, application data and operational logs to host the service. Its AI gateway handles prompts and responses used to generate insights.
• Neon/PostgreSQL database hosting: Stores account and workspace records, encrypted connection tokens, goals, generated insights, actions and billing references.
• Anthropic Claude: Receives relevant business context and selected connected-tool information through the AI gateway to generate insights and action plans.
• Stripe: Processes checkout and payment details, subscription information and billing identifiers. Where available, an analytics client identifier may also be stored in Stripe session or customer metadata.
• Resend: Receives recipient details and email content to deliver verification, account, billing and service messages.
• Cloudflare Turnstile: Processes browser challenge information and verification tokens, and may receive an IP address, to detect automated abuse.
• Google — sign-in and connected APIs: Processes authentication and authorised API requests. We receive sign-in information and data from Google services you connect.
• Google Fonts: Receives browser requests and associated network information to deliver website fonts.
• Reddit Ads: Receives browser identifiers and advertising-event information when you give marketing consent, to measure our advertising.
• Your connected service providers: Receive authenticated requests and account or resource identifiers needed to retrieve the information you authorise. These may include accounting, CRM, commerce, email-marketing, payment and advertising providers.

Connecting your own Mailchimp account is separate from subscribing to a myclever AI mailing list.

9. International transfers

Some service providers may process information outside the UK.

The locations and applicable transfer safeguards depend on the provider and the service agreement. Contact privacy@myclever.ai for information about the arrangements that apply to your data.

10. Data retention and deletion

We store account records, connection details, goals and generated insights to provide the service.

Generated insights remain in your account until they are deleted. Disconnecting a tool does not delete insights already generated from its data.

GA4 reports are fetched when an analysis runs. The connector does not maintain a separate persistent cache of those raw reports. Information derived from them may remain in saved insights and actions.

You can request deletion by emailing privacy@myclever.ai. We will delete the requested personal data from our live systems within 30 days, unless we must retain specific information to meet a legal obligation. We will explain any exception. This timeframe does not promise immediate removal from backups or third-party systems.

11. Cookies and similar technologies

We use essential cookies and browser storage for sign-in, security and preferences.

Reddit advertising tracking is enabled only with marketing consent.

See our Cookie Policy for details and controls.

12. Google user data

What we access

When you connect Google Analytics 4, we request read-only Analytics access. You select the property we use for reporting.

During setup, we retrieve account and property information so you can select a property.

For the selected property, we read:

• Active users, sessions and page views.
• Bounce rate and average session duration.
• New users and key-event counts.
• Up to ten top page titles, with page views, active users and bounce rate.
• Up to eight default traffic-channel groups, with sessions, active users and key-event counts.
• Previous-period active users, sessions, page views and bounce rate for comparison.

The current report covers the period from 30 days ago through today. The comparison report covers 60 days ago through 31 days ago.

We do not request permission to edit your GA4 property.

How we use it

We use connected Google reporting data only to generate your insights and action plans.

Relevant information is sent through Replit’s AI gateway to Anthropic for that purpose. Hosting and database providers process information as needed to operate the service and store your resulting insights.

We do not use this data to train AI models. We do not sell it, use it for advertising or include it in benchmarking. We do not share it with other customers or unrelated third parties.

Disconnecting

When you disconnect GA4, we request token revocation from Google and clear the stored access token, refresh token and selected property ID.

If Google’s revocation request fails, we still clear those stored connection details. You can also revoke access directly at Google Account permissions.

Insights already generated remain in your account until they are deleted or you ask us to delete them.

myclever AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to this policy

We may update this policy as the service changes. The “Last updated” date shows when the wording was last revised.

14. Complaints

Contact privacy@myclever.ai if you have concerns about how we handle your data.

You can also complain to the UK Information Commissioner’s Office: ico.org.uk. Telephone: 0303 123 1113.

15. Contact us

For privacy questions and data-rights requests: myclever AI, privacy@myclever.ai.