Privacy Policy

1. Who we are

ClankerView is operated by Suhtok OÜ (registry code 16271304), an Estonian private limited company. References to “we”, “us”, or “our” in this policy refer to Suhtok OÜ.

Contact: hello@clankerview.com

2. What data we collect and why

Account data

When you create an account, we collect your email address. You may sign in using one or more of the following methods:

• Email one-time password (OTP): we send a short-lived code to your email address. We do not store passwords.
• Google Sign-In: if you choose to sign in with Google, we receive your email address from Google solely to identify your account. We do not receive your name, profile photo, or any other Google account data.
• Passkeys: if you register a passkey, we store a public key credential and device metadata (device type, whether the credential is backed up to a password manager, and the authenticator model identifier). No biometric data ever leaves your device.

All authentication data is necessary to provide the service. Legal basis: performance of a contract.

Review data

When you submit a URL for review, we store the URL, any instructions you give, and everything the review produces: the agents’ messages and actions, screenshots, a screen recording of each agent’s visit, and the written reviews. This data is necessary to display your results and review history. Legal basis: performance of a contract.

While an agent is working, you can watch its screen live. These live frames pass through our server and are not stored.

If you give an agent cookies or local storage to review an area behind a login, we only use them for that run and delete them as soon as it ends. What the agent sees while logged in becomes part of the review, including its recording and screenshots.

Usage analytics

We use self-hosted Plausible Analytics, a privacy-friendly analytics tool that does not use cookies and does not collect personally identifiable information. All analytics data is stored on our own servers and is not shared with any third party. Legal basis: legitimate interests in understanding aggregate usage; no personally identifiable information is collected or processed.

Payment data

Payments are processed by Paddle. We do not store your card details. Paddle acts as the Merchant of Record and handles all payment data under their own privacy policy.

Emails

We send you emails about your account and your reviews: sign-in codes, a note when a review is ready, and a warning before a review is deleted for inactivity. If you agree, we also send product updates, tips and offers. You can turn off everything except sign-in codes in Settings, or with the link in each email.

3. How long we keep your data

Reviews that nobody opens for 12 months are deleted, including their recordings and screenshots. Opening a review, or someone opening its share link, keeps it for another 12 months. We email you two weeks before a review is deleted, unless you turn that off in Settings. The record of credits you used is kept.

We keep your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g. financial records).

Our database backups are encrypted and kept for 31 days, so deleted data disappears from them within 31 days.

4. Third parties

We use the following third-party services that may process your data:

• Anthropic: AI model provider based in the United States. The pages the agents visit (screenshots and text), your review URL and your instructions are sent to Anthropic’s API to generate the agents’ reactions and reviews. This transfer to the US is made under Standard Contractual Clauses (SCCs) as required by GDPR Chapter V. Note: due to the nature of API processing, we cannot guarantee deletion of data from Anthropic’s systems following an erasure request. Please refer to Anthropic’s privacy policy(opens in a new tab) for their data retention practices.
• TypeSafe: decision model provider (TypeSafe AI, Inc., based in the United States) that chooses each agent’s next step. It receives the text of the page the agent is on, the page’s address and title, its list of links and buttons, and the agent’s current goal and recent actions. It does not receive screenshots, recordings, or the cookies you provide, and it does not use this data to train its models. This transfer to the US is made under the Standard Contractual Clauses in TypeSafe’s data processing agreement(opens in a new tab).
• Google: if you use Google Sign-In, your authentication request is processed by Google. We receive only your email address. Google’s processing is governed by the Google Privacy Policy(opens in a new tab).
• Paddle: payment processing and billing.
• Scaleway: cloud provider based in the EU (France). It runs our servers and the agents’ browsers, stores recordings and screenshots, keeps our encrypted backups, and sends our emails.

We do not sell your data to any third party.

5. Your rights under GDPR

As a data subject in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email us at hello@clankerview.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee(opens in a new tab)). If you reside in another EU/EEA member state, you may also lodge a complaint with your local data protection authority.

We do not use automated decision-making that produces legal or similarly significant effects on you.

6. Cookies

We use a single session cookie for authentication. This cookie is strictly necessary for the service to function and does not require your consent under the ePrivacy Directive. We do not use advertising or tracking cookies. Our analytics tool operates without cookies.

7. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the site. Continued use of the service after changes constitutes acceptance, except where changes affect processing based on consent. In that case we will seek your renewed consent before the change takes effect. With every update we publish a summary of what changed and a comparison with the previous version.