Clapi Privacy Policy

This privacy policy applies to the "Clapi" iPhone app and the related web app at web.clapilot.com (together "Clapi").

Controller

Clapilot GbR, represented by Luca Sonntag, Georgenstraße 97, 80798 Munich, Germany. Email: [email protected]

What data we process

• Account data: email address, name, display name, profile picture and sign-in data (password hash, passkeys, the identifier and email address provided by "Sign in with Apple").
• Content: chats with the assistant, notes, tasks, events, documents, files, Team Chat messages and anything else you create or upload in Clapi.
• Connected accounts: if you connect Google, Microsoft or a messenger (Telegram, WhatsApp), we process the access tokens required for it and the data you share through that connection (for example emails, calendars, files).
• Device and usage data: your device's push token, sessions, IP address, request times and technical logs we need for operation and security.

Clapi contains no advertising and no third-party tracking or analytics SDKs. We do not sell data.

Purposes and legal bases

• Providing Clapi and your account (Art. 6(1)(b) GDPR).
• Security, abuse prevention and handling reports (Art. 6(1)(f) GDPR; legitimate interest in a safe service).
• Connections to third-party accounts and messengers only when you set them up (Art. 6(1)(b) and (a) GDPR). You can disconnect them at any time in Settings.

AI processing

When you use the assistant, we send your request and the content it needs to an AI model that generates a response. Depending on the model chosen, it runs on our own servers or at an AI provider (for example OpenAI). For providers outside the EU, transfers are based on the European Commission's standard contractual clauses or an adequacy decision. We do not use your content to train our own AI models. AI responses can be wrong.

Recipients and processors

• Hosting: Clapi runs on servers in Germany that we operate ourselves.
• Cloudflare: routes and protects traffic to our servers (encryption, attack protection).
• Email delivery: we send sign-in links and notifications through an email service provider.
• Apple: "Sign in with Apple" and push notifications (Apple Push Notification service).
• AI providers: as described under "AI processing".
• Google, Microsoft, Telegram, WhatsApp: only if you set up the connection yourself.

Members of a team workspace see the content you share in that workspace.

Team Chat, reports and blocking

You can report messages in Team Chat and block people. A report stores the reported message, the reporting and the reported person, and your note. We usually review reports within 24 hours, remove content that violates our Terms of Use and suspend the accounts responsible.

Retention and deletion

We keep your data as long as your account exists. You can delete your account yourself at any time: in the app under Settings → Account → Delete account, or on the web in the same settings. This deletes your account, your personal workspace with all its content, team workspaces in which you are the only person, your sign-in data and your connected accounts. Your Team Chat messages in other workspaces are deleted as well. Backups are overwritten within 30 days. Statutory retention obligations remain unaffected.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. To exercise them, write to [email protected]. You can also lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (BayLDA).

Children

Clapi is not directed at children under 16.

Changes

If this policy changes, we publish the new version here and state the date of the last change.