We process commercially sensitive documents. This page tells you exactly how we handle your data — where it's stored, who sees it, when it's deleted, and what we never do with it.
| Server location | Hetzner data centre, Germany (EU) |
| Data jurisdiction | European Union at all times |
| Transfer outside EU | ✗ Never |
| AI provider | Anthropic Claude API (contract text sent for analysis, not retained by Anthropic for training per their commercial API terms) |
| PDF generation | Gotenberg — self-hosted on same EU server |
| Email delivery | Brevo — EU-based provider, GDPR compliant |
| Payments | Stripe — PCI DSS Level 1 certified. We never see or store card details. |
| Contract text storage | Stored encrypted for up to 90 days to deliver your report, then automatically deleted |
| Report data | Risk metadata (score, category counts) may be retained in anonymised form for product improvement |
| Lead data | Email, name, company retained for account management and (with consent) marketing. Deletable on request. |
| AI training | ✗ Your contracts are never used to train any AI model |
| Third-party sharing | ✗ We never sell or share your contract data |
| Contract access | Only you can access your report. No Clavico staff read your contracts. |
Clavico is built to meet the requirements of EU GDPR (Regulation (EU) 2016/679). Our legal basis for processing contract data is contractual necessity — you submit a contract to receive the service you've purchased.
We do not use legitimate interests as a catch-all basis. Marketing communications are only sent with explicit consent, and you can unsubscribe at any time. Our lead supervisory authority is the Irish Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
Clavico uses the following third-party sub-processors to deliver the service. Each is bound by GDPR-compliant data processing terms.
| Hetzner Online GmbH | Infrastructure hosting — servers located in Germany (EU). Privacy policy |
| Anthropic, PBC | AI processing — contract text is sent to Anthropic's Claude API for analysis. Anthropic's commercial API terms prohibit use of API inputs to train models. Contract text is not retained by Anthropic beyond the request. For Business tier customers requiring Zero Data Retention (ZDR), an Enterprise addendum is available on request. |
| Brevo SAS | Transactional email delivery — EU-based, GDPR compliant. Privacy policy |
| Stripe, Inc. | Payment processing — PCI DSS Level 1 certified. Card data never reaches Clavico servers. Privacy policy |
| Gotenberg | PDF generation — self-hosted on the same EU server. No data leaves our infrastructure. |
| IPinfo | IP geolocation — used to identify the organisation behind site visits for lead analytics. Processes visitor IP addresses. Privacy policy |
| Companies House (HMRC) | UK public company register — queried for counterparty information when using the Counterparty Monitor feature. Public data only, no personal data transmitted. Privacy notice |
In the event of a personal data breach, Clavico will notify the Irish Data Protection Commission within 72 hours of becoming aware of the breach, where required under Article 33 GDPR. Affected customers will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
To report a suspected security vulnerability or data incident, email [email protected] with subject line "Security Incident". We target initial response within 4 hours.
Clavico logs every scan submission, report access, AI query, and account action against the authenticated user's email address and timestamp. These logs are retained for 90 days and are available to customers on request as part of a Subject Access Request under Article 15 GDPR.
A Data Processing Agreement is available for any customer whose organisation requires one — for example, as part of an ISO 27001, SOC 2, or internal vendor assessment process.
Email us with subject line "DPA Request" and we will provide a signed DPA within 2 business days. Customers on Business or Enterprise plans may request a customised DPA.
Request a DPA → [email protected]Email: [email protected]
For DPA requests, Subject Access Requests (Article 15), data deletion requests (Article 17), or security disclosures — we respond within 2 business days.
Lead supervisory authority: Irish Data Protection Commission (DPC) — dataprotection.ie
Clavico provides commercial contract intelligence only. It does not constitute legal advice. Last updated: October 2026.