Privacy Policy

Account data. When your organization's administrator creates a user account for you, we store your name, email address, role and permissions, and the security methods you set up — such as a passkey or, on mobile, a sign-in key held in your device's secure storage behind Face ID or a fingerprint. Your biometric itself never leaves your device.

Sign-in and security records. When you sign in or take a recorded action, we log what was done, by whom and when, together with the IP address it came from and the country we derive from that address (using a database on our own servers — no third party is asked). We use these records for your organization's audit trail, to enforce any network or region access rules your administrators set, and to detect misuse. On mobile, sensitive actions also use Apple's or Google's app-integrity checks, and the app may report that a device appears jailbroken or tampered with.

Customer business data. The records your team enters into Clariva — customers, contacts, quotes, orders, invoices, payments, inventory, the calls, notes and emails you log, and related files — belong to your organization. We store and process them solely on your organization's behalf to provide the service. We do not use this data for advertising, and we do not use it to train AI models.

Portal users. If an organization using Clariva invites you to its customer or vendor portal, we store the account it creates for you — your name, email address, the company you belong to, what you can see, and when you were invited, accepted and last signed in — along with the sign-in and security records described above. That organization controls the account, so requests about it go to them first.

Payments and signatures. If you pay an invoice through a Clariva payment link, your card details go directly to Stripe and never reach us. If you approve a repair estimate online, we record the approval with the IP address and browser it came from, as evidence of your signature.

Support and feedback. When you send us a bug report or support request from inside Clariva, it includes what you write and, unless you remove it, a screenshot of the visible page (parts of the screen marked sensitive are left out). It also includes technical context to help us reproduce the problem: the page address, your browser and device type, screen size, language, time zone, and recent technical messages from the page, with security tokens masked.

We use the data above to operate the service: signing you in, storing and displaying your organization's records, sending emails your organization triggers (such as quotes, invoices, statements and payment reminders), processing payments, providing support, billing, and keeping the platform and your account secure. That's it.

Your organization can also connect Clariva to other systems — for example QuickBooks Online, or a web address of its own that a workflow sends records to. Data sent that way goes where your organization chose to send it, under its control.

Clariva's AI features run on Google Cloud Vertex AI in the United States. Your data is not used to train any third-party model.

• The assistant. It receives what you ask, any images you attach, the page you're on, and the Clariva records needed to answer — only records your own permissions let you see. Conversations are kept for 180 days so you can return to them, then deleted automatically.
• Voice input. If you use the microphone button, your browser or phone turns speech into text with its own speech service (for example Google's in Chrome, or Apple's in Safari). Only the resulting text reaches Clariva.
• Suggestions. When you import a spreadsheet, column headings and a few sample values are used to suggest which field each column belongs in. In the browser extension and the Outlook add-in, the email or page details described below can be used to suggest the matching record or a next step. Suggestions are always shown to you to accept or change; they never change anything by themselves.
• Support triage. Support requests you send us, with their screenshot and technical context, are analyzed to help our team route and answer them. A person reviews AI suggestions on a support request before anything is changed or sent.

When people see AI conversations. We don't read your assistant conversations as a matter of course. If you rate an answer, we keep that answer and your comment for 180 days and review them to improve the product. If you rate an answer down and add a comment, it becomes a support request so we can respond, and it carries the last part of the conversation (up to 12 messages) so we can see what went wrong. That request is kept with your organization's support history (see Retention below).

The Clariva browser extension, the Clariva add-in for Outlook and the Clariva add-on for Gmail show your own Clariva records beside the email or page you are working on. They work only after you connect them to your Clariva account, and only for the person signed in.

• What they store on your device. One connection credential, kept in the extension's or add-in's local storage and sent only to Clariva. It is not synced to your other devices, and you or your administrator can revoke it at any time.
• What they read, and when. Only the email or page you have open, and only when you open the Clariva panel or choose an action — never in the background, and never your browsing history. In email, that is the sender's name and address, the subject, the message text (without earlier quoted replies) and attachment names. On a bank's payment page, it is the payment you are recording — payee, amount, date, memo and confirmation number — and never account or routing numbers. The extension reads an email or bank site only after you grant it access to that site. If you highlight text on a page and choose “Look up in Clariva”, it receives that highlighted text only.
• What they send. Those details go to Clariva to find the matching records and suggestions. An email or payment is saved to Clariva only when you choose to save it; it then becomes part of your organization's records like anything else you enter.
• Asking the assistant about an email. If you ask Blob, Clariva's assistant, a question in the panel while “Using this email” is shown, the open email's sender, subject and latest message (without earlier quoted replies) go with your question so the assistant can answer it or draft a reply. Attachments go too only if you tick each one: PDFs, pictures, Word documents, spreadsheets or text files, up to three, 5 MB each, and nothing is read from them until you send. Word, spreadsheet and text files are turned into text on our servers for the assistant to read. They are used for that answer and are not saved with the conversation. Remove “Using this email” to ask without it.
• The Gmail add-on. In the Gmail app and Gmail on the web, the add-on reads nothing until you tap “Look up this sender”, “Save this email” or “Record a promise” on an open email. Then Google gives Clariva that one email — sender, recipients, subject, date and message text — for that action only; the add-on cannot read your other emails. It also receives the address of the Google account using it, to match it to the Clariva account you connected. Your Clariva connection is kept on Clariva's servers, not on your phone, and you can disconnect it under Settings → Connected apps & devices.

Clariva's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from these tools adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: we use it only to provide the features described here, we do not sell it, we do not use or transfer it for advertising or to determine creditworthiness, and people at Clariva do not read it except with your permission, for security, or where the law requires.

We do not sell personal data, and we do not share it with third parties for their own marketing. Under the California Consumer Privacy Act as amended (CCPA/CPRA), we do not “sell” or “share” personal information as those terms are defined there, and we do not process it for cross-context behavioral advertising.

For the business records your organization enters into Clariva — its customers,contacts, orders and invoices — we act as a processor (a “service provider” under California law), handling that data on your organization's instructions and only to provide the service. Your organization decides what to collect and how long to keep it.

For our own records — the account we hold for your organization, our billing history and our support correspondence — we act as a controller.

Our obligations as a processor — security measures, sub-processor notice, breach notification and deletion — are set out in our Data Processing Addendum, which applies automatically to every customer without needing to be signed.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, obtain a portable copy, or object to or restrict certain processing. You also have the right not to be discriminated against for exercising these rights. To exercise them, email support@caringconsulting.co or write to the postal address below. We will acknowledge within 10 business days and respond within 45 days, extending once where the law allows and telling you if we do. We may need to verify your identity before acting, and we will not charge you for a reasonable request.

If your data reached us because you deal with one of our customers rather than with us directly — for example as their customer, a portal user, or someone they email — we will route your request to that organization, since it is their data and they decide the outcome. An authorized agent may make a request on your behalf with proof of authority.

Clariva runs on Google Cloud and Firebase in the United States. We use a small set of service providers to deliver specific features, and each receives only what its function requires:

• Google Cloud / Firebase — application hosting, database, file storage, reporting, and delivery of mobile push notifications
• Google reCAPTCHA Enterprise — telling real browsers apart from automated abuse on the assistant and on payment pages
• Algolia — search indexing so in-app search is fast
• Resend — delivery of transactional email, and receiving replies to it
• Stripe — payment processing (card details go to Stripe, not to us)
• Intuit (QuickBooks Online) — accounting sync, only when your organization connects its QuickBooks company
• Sentry — error reporting and performance monitoring so we can find and fix bugs
• Google Cloud Vertex AI (Gemini) — the AI features described above
• Google Maps Platform — address lookup, geocoding and map display
• Apple and Google Play — push notifications and app integrity checks on mobile

The full list, with the data each provider can access, is on our sub-processors page.

We do not use advertising or cross-site tracking cookies, and we do not run analytics or session-recording scripts. Clariva sets these cookies:

• __session — keeps you signed in (up to 12 hours; your organization can set a shorter limit)
• __stepup — confirms you re-verified your identity for a sensitive action (about one minute)
• dashboard.filters — remembers your last dashboard filters (180 days)

Some pages load services that set their own cookies or read browser signals for security and fraud prevention: Google reCAPTCHA (where the assistant is used, and on payment pages), Stripe (on payment pages), and Google Maps (on address fields, where what you type is sent to Google to suggest addresses). The app also keeps a few preferences in your browser's local storage — such as keyboard shortcuts, sidebar and list layouts, and unsent drafts — which stay on your device.

Data is encrypted in transit and at rest. Access inside your organization is controlled by the roles and permissions your administrators configure. Our own operational access is limited to what running and supporting the service requires; when our support team needs to look inside your organization's workspace to help you, that access is time-limited and recorded, with who, when and why.

We keep your organization's data for as long as its account is active, including its audit trail and support history. Some data is deleted automatically sooner:

• Records you delete can be restored for 30 days, then are permanently removed
• AI assistant conversations, and ratings of its answers: 180 days
• In-app notifications: 90 days
• Workflow run history: 30 days (90 days for runs that failed)
• Data staged during a bulk import: 45 days
• Mobile push registrations: 60 days after the app was last used
• Browser extension and Outlook add-in connections: 30 days after they expire or are revoked

When a subscription ends, we keep your organization's data for 30 days so the cancellation can be reversed, then export it for you and delete it — from the live database, file storage, the search index and our reporting copies. Your organization can ask in writing for deletion sooner. We keep only what the law requires us to (for example, our billing records for your account). Backups, operational logs and the export copy we prepare for you expire on their own schedule (the export after 30 days). Individual users should contact their organization's administrator first, since the organization controls its own records; you can also reach us directly using the contact below.

Clariva is a business tool. It is not directed to children, and we do not knowingly collect data from them.

If we change this policy, we'll update this page and the date at the top. Material changes will also be communicated to your organization's administrators.

Questions or requests: support@caringconsulting.co.