Privacy Policy

This policy applies to business users of Clustly GenOS and to visitors of our websites. Where a business uses GenOS to communicate with its own customers, that business controls those relationships — see Section 6 for how we handle its customers’ data, and contact the business directly for its own privacy practices.

The Clustly entity responsible for your personal data (the “data controller”) depends on where your business is located:

For the personal data of a business’s own customers, that business is the controller and Clustly acts as its processor (Section 6).

• Account data. Name, email address, and login credentials. If you sign in with Google, we receive your name, email, and profile picture from your Google account.
• Business data. Your business profile, services, opening hours, brand voice, and team members you invite.
• Content and communications. Your conversations with GenOS, drafts and published posts, message threads on connected channels such as Instagram and Facebook, bookings and calendar events, and — where you enable calling — call recordings and transcripts. For a connected WhatsApp Business number we keep notes and summaries rather than the message threads themselves (Section 8).
• Your customers’ data. Contact details, notes about each interaction, and booking details of the customers your business serves through GenOS.
• Usage and device data. Log data such as IP address, browser type, pages viewed, and actions taken, used for security and to improve the Service. This includes session replays of how you use the web app, recorded by our product-analytics provider, with your customers’ personal data masked in your browser before anything is sent.
• Payment data. If you buy a paid plan, billing details are handled by our payment processor; we do not store full card numbers.

We use personal data to:

• Provide the Service — run GenOS, deliver messages, manage bookings, and sync your calendar (performance of a contract);
• Personalize your agent — GenOS learns your brand voice and business context from your workspace to work in your voice (performance of a contract);
• Secure and improve the Service — debugging, abuse prevention, and product analytics (legitimate interests);
• Communicate with you — service emails, and marketing you can opt out of at any time (legitimate interests or consent);
• Meet legal obligations — accounting, tax, and lawful requests (legal obligation).

We do not sell personal data, and we do not use your data for third-party advertising.

GenOS is powered by large language models. To generate replies, posts, and actions, relevant workspace content (for example, a customer message and your business context) is sent to AI infrastructure providers — currently Anthropic, OpenRouter, Groq, and Amazon Bedrock — that process it on our behalf.

• Our agreements with these providers prohibit them from using your content to train their models.
• We do not use your content to train models made available to other customers. GenOS’s memory of your business stays inside your workspace.
• AI-generated output can be inaccurate — the Service is designed so your team reviews what GenOS proposes before it reaches your customers.

When your business uses GenOS to serve its customers, we process those customers’ personal data on your behalf and on your instructions — you are the controller, and Clustly is your processor. That means your business is responsible for:

• telling its customers how their data is used (your own privacy notice);
• having a lawful basis to contact them, and any consent required to record calls; and
• responding to their privacy requests (we will assist you).

If you are a customer of a business that uses Clustly GenOS, contact that business first for privacy requests; if you contact us at support@clustly.ai, we will forward your request and help resolve it.

If you sign in with Google or connect Google services such as Google Calendar, our use of data received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we use that data only to provide the features you request, we do not use it for advertising, and no human reads it except with your consent, for security, or as required by law.

Connecting Google Calendar is optional. When you connect it, Clustly GenOS uses your calendar for exactly two things: it reads your events to see when you are busy so it never double-books an appointment, and it creates and updates the bookings it manages so they appear on the calendar you already use. It accesses no other Google data. You can disconnect Google Calendar at any time from Settings, which revokes our access immediately; we then delete the synced calendar data from our systems.

You can connect the WhatsApp Business app number you already use, so GenOS can turn buyer enquiries into contacts and draft your replies. Connecting is optional. Here is exactly what happens to those chats.

• Only your business number. GenOS reads chats on the business number you connect. It never reads your personal WhatsApp number.
• Importing your history is your choice. If you turn it on, GenOS reads your existing chats once to build your contact list. It keeps each contact’s name and phone number, what kind of contact they are, a one-line summary of what they want, when to follow up, any property links they sent, and a note saying “Imported from WhatsApp history”. It does not keep the imported messages.
• New messages become notes, not transcripts. GenOS reads each new buyer message to write you a short brief and a suggested reply. It then keeps a one-line note of the exchange (for example, “Asked whether the unit is tenanted”), the time, and what it learned about the contact. It does not keep the text of the message.
• No photos, voice notes, videos, or documents. Files a buyer sends are never downloaded or stored.
• Your own replies. When you reply from your phone, GenOS records that you replied and what it was about, never your words.
• Personal chats stay private. Mark a contact as personal and GenOS stops reading them. Nothing from those chats is kept in any form.
• Nothing is sent without you. GenOS never sends a message from your business number until you approve it.
• Who can see it. Everything is isolated to your workspace by row-level security. No one at Clustly reads your messages through the product, no support or admin screen shows message content, and access to production systems is restricted and audited.
• AI processing. Message text is sent to the AI providers listed in Section 5, under contracts that prohibit them from training on it.
• Deleting and disconnecting. Deleting a contact deletes everything GenOS holds about that contact. Disconnecting WhatsApp stops all reading immediately and revokes our access, and you choose whether GenOS also deletes every contact and note it created from your WhatsApp; contacts you added yourself stay.

The connection, the one-time history sync, and message delivery run through Meta’s WhatsApp Business Platform under Meta’s terms. We receive only what Meta sends us for the number you connected.

We share personal data only with:

• Service providers (subprocessors) that help us run the Service — cloud hosting (Amazon Web Services), the AI providers listed in Section 5, and payment processors — each bound by contracts limiting their use of your data;
• Connected platforms you choose to use — for example, messages GenOS sends on WhatsApp, Instagram, or Facebook necessarily pass through Meta’s systems under Meta’s terms;
• Authorities, where required by law or to protect rights, safety, or the integrity of the Service; and
• A successor entity, if we are involved in a merger, acquisition, or sale of assets — we will notify you before your data becomes subject to a different privacy policy.

A current list of subprocessors is available on request at support@clustly.ai.

We operate globally, and data may be processed in countries other than where you live, including the United States and Singapore. Where data protected by European (EEA/UK) or similar law is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum, and equivalent mechanisms under Singapore’s PDPA.

We keep personal data while your account is active and as needed to provide the Service. When you delete your workspace (or ask us to), we delete or anonymize your personal data within 90 days, except where we must keep records longer for legal, tax, or security reasons. Residual copies in encrypted backups are purged on the backups’ rotation schedule.

We protect data with encryption in transit and at rest, tenant isolation enforced at the database layer (row-level security), access controls, and monitoring. No system is perfectly secure — if we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

We use cookies and similar technologies that are essential to run the Service — keeping you signed in and protecting your session. We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser, but the Service will not work without the essential ones.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any right, email support@clustly.ai — we respond within the timelines required by law and never discriminate against you for exercising your rights.

If you are in the EEA or the UK, you also have the right to withdraw consent at any time (where processing is based on consent) and to lodge a complaint with your local supervisory authority. Our legal bases for processing are listed in Section 4.

If you are a California resident: in the last 12 months we collected the categories of personal information described in Section 3 (identifiers, commercial information, internet activity, professional information, and audio from call recordings), for the purposes in Section 4. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information other than to provide the Service.

You have the rights to know, access, correct, delete, and port your personal information, and the right not to be discriminated against for exercising them. Submit requests to support@clustly.ai; we will verify your identity via your account email. You may use an authorized agent with signed permission.

For users whose data is controlled by Clustly Pte. Ltd., we collect, use, and disclose personal data with consent or as otherwise permitted under Singapore’s Personal Data Protection Act 2012, for the purposes in this policy. You may withdraw consent, and request access to or correction of your personal data, by contacting our Data Protection Officer at support@clustly.ai.

The Service is a business tool for users aged 18 and over. We do not knowingly collect personal data from children under 13 (or the equivalent minimum age where you live); if you believe a child has provided us personal data, contact us at support@clustly.ai and we will delete it.

We may update this policy as the Service evolves. For material changes, we will notify you by email or in the app before they take effect, and update the “Last updated” date above.

Privacy questions and requests: support@clustly.ai. You can reach the data controller for your region — Clustly Inc. (United States) or Clustly Pte. Ltd. (Singapore) — at the same address.