Privacy Policy

Clawpaths is operated by Cloud Panther LLC, a limited liability company formed in the State of Florida, United States. For any privacy question, or to exercise the rights described below, contact jorge@cloudpanther.net.

Where the UK or EU GDPR applies, we act as the data controller for account and billing data, and as a processor for the marketing content and analytics you connect to the platform.

• Account data — your name, email address, profile picture, and a hashed password. If you sign in with Google we receive your name, email address, and profile picture from Google.
• Organisation data — business name, website, physical location, brand guidelines, tone-of-voice settings, and team membership.
• Connected account data — OAuth access and refresh tokens for the services you choose to connect, and the metrics and content those services return.
• Generated content — the prompts you submit and the posts, images, blogs, videos, and reports produced from them.
• Billing data — your plan, subscription status, trial end date, and billed client count. Card details are collected and stored by Stripe; Clawpaths never receives or stores full card numbers.
• Technical data — IP address, browser and device information, and server logs.

• To provide the service: generating content, producing reports, and displaying the analytics you have connected.
• To authenticate you and keep your account secure.
• To send transactional email — verification, password resets, team invitations, and scheduled reports.
• To bill you and manage your subscription.
• To diagnose faults and keep the service reliable.

We do not use your content to train AI models. Your prompts and generated output are sent to our AI providers only to produce the result you asked for, and are not used by us to train or fine-tune any model. We do not sell personal data, and we do not use your data for advertising.

Where the UK or EU GDPR applies we rely on: performance of a contract, to provide the service you signed up for; legitimate interests, for security, fault diagnosis, and service improvement; consent, for connecting third-party accounts; and legal obligation, for tax and accounting records.

When you connect a Google account, Clawpaths requests only the scopes needed for the features you enable — Google Analytics, Search Console, Business Profile, Tag Manager, and Google Ads. We use that access solely to read and display your marketing data inside Clawpaths and, where you explicitly ask us to, to make changes on your behalf.

Clawpaths' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide the service, we do not use it for advertising, and we do not use it to train AI models.

You can disconnect a Google account at any time from your integration settings, or revoke access directly at myaccount.google.com/permissions. Revoking access deletes the stored tokens.

We do not sell personal data. We share it with the following subprocessors, each only to the extent needed to run the service:

• Vercel — application hosting and delivery.
• Neon — managed PostgreSQL database hosting.
• Microsoft Azure Blob Storage — storage of generated and uploaded media.
• Stripe — subscription billing and card processing.
• OpenAI — text and image generation from the prompts you submit.
• Google — authentication, and the Analytics, Search Console, Business Profile, Tag Manager, Ads, and Places APIs.
• DataForSEO — keyword, search volume, and rank tracking data.
• Resend and SendGrid — transactional and report email delivery.
• Luma AI — video generation, where used.
• ElevenLabs — voiceover generation, where used.
• Modash — influencer discovery data, where used.
• Meta, LinkedIn, and TikTok — publishing to the social accounts you connect.

Our infrastructure and subprocessors are located in the United States. Where we transfer personal data out of the UK or EEA we rely on the Standard Contractual Clauses approved by the European Commission and the UK Addendum.

We keep account and organisation data for as long as your account is active. When you delete your account we remove your personal data within 30 days. Deleting a user also deletes their connected accounts and stored OAuth tokens.

Billing and tax records are retained for seven years, as required by United States tax law.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to withdraw consent. To exercise any of these, email jorge@cloudpanther.net. We respond within 30 days.

If you are in the UK or EEA you also have the right to complain to your local supervisory authority. If you are a California resident, we do not sell or share your personal information as those terms are defined under the CCPA, and we will not discriminate against you for exercising your rights.

Clawpaths sets strictly necessary cookies only. These keep you signed in and protect against cross-site request forgery: authjs.csrf-token, authjs.callback-url, and the session token cookie. They cannot be disabled without breaking authentication.

We do not use analytics, advertising, or third-party tracking cookies, and we do not embed third-party trackers in the application or the marketing site.

Passwords are hashed with bcrypt and never stored in plain text. All traffic is encrypted in transit with TLS, and data at rest is encrypted by our hosting and storage providers. Access to production systems is limited to personnel who need it.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant supervisory authority without undue delay, and within 72 hours where the GDPR requires it.

Clawpaths is a business tool intended for use by adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact jorge@cloudpanther.net and we will delete it.

We will update this page when our practices change and revise the “last updated” date above. Material changes will be notified by email or in the application.

Cloud Panther LLC, Florida, United States — jorge@cloudpanther.net. See also our Terms of Service.