Privacy Policy

This Privacy Policy explains how [Disclarion's legal entity name and registered address to be inserted] ("Disclarion", "we") processes personal data in connection with the disclarion SDK, disclarion.com, api.disclarion.com, and app.disclarion.com (together, the "Service").

Disclarion acts in two roles: as the data controller for information about you as our customer (account, billing, support), and as a data processor for the interaction data your own product sends to the Service on behalf of your end users — that processing is governed separately by our Data Processing Agreement.

1. Data we collect as a controller

• Account data: name, email address, company/team name, and authentication credentials (Supabase Auth).
• Billing data: plan, subscription status, and payment history. Card details are collected and stored by Stripe, our payment processor — we do not receive or store full card numbers.
• Usage data: aggregate log counts and plan limits, used to enforce plan limits and detect abuse.
• Support communications: anything you send to hello@disclarion.com or disclarion.com's contact form.
• Waitlist signups: your email address, and optionally company name and role, if you sign up for the waitlist on disclarion.com.

2. Why we process it

To provide and bill for the Service (performance of our contract with you), to secure the Service and prevent abuse (our legitimate interest), to comply with tax and accounting obligations (legal obligation), and, where you have agreed, to send you product updates.

3. Where data is hosted

Account, billing, and interaction-log data is hosted on Supabase infrastructure in an EU region (Ireland). We do not currently operate infrastructure outside the EU for this data. Waitlist signups collected on disclarion.com are stored in a separate Supabase project used only for that form.

4. Who we share data with

We use a small number of sub-processors to run the Service, and share only what each one needs to do its job:

• Supabase (database, authentication) — hosted in the EU.
• Stripe (payment processing) — for Customers on a paid plan.
• Zoho (transactional email) — for account, billing, and product-usage emails sent to you.
• Railway / Vercel (application hosting) — run our application code; they do not have standing access to our database.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. How long we keep it

We keep account and billing data for as long as your account is active, and for a limited period afterward as needed for legal, tax, or dispute-resolution purposes. Interaction logs are kept for as long as your account is active, unless you or we delete your account sooner, subject to the retention terms in the DPA.

6. Your rights

If you are in the EEA, UK, or a jurisdiction with similar law, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these rights, email hello@disclarion.com. You also have the right to lodge a complaint with your local data protection authority.

7. Cookies

We use only one cookie, set by our authentication provider (Supabase), to keep you securely signed in to your account. This cookie is strictly necessary for the Service to function and does not require consent under applicable law. We do not use advertising or third-party tracking cookies of any kind, and no data is shared with third parties for tracking or advertising purposes.

disclarion.com does not use cookies. It uses two forms of client-side storage: sessionStorage for the on-page chat widget (strictly necessary to keep your conversation open while you use it), and a randomly-generated, non-identifying session identifier stored in localStorage that lets us count product-usage events (e.g., page views, demo interactions) without collecting personal data, IP addresses, or device fingerprints, and without any cross-site tracking. This identifier is not linked to your name, email, or account, and is never shared with or sold to third parties.

8. International transfers

Where a sub-processor is located outside the EEA/UK, we rely on an appropriate safeguard (such as Standard Contractual Clauses) as required by law.

9. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time; material changes will be notified to account owners by email before taking effect.

11. Contact

Questions about this policy, or requests to exercise your rights, can be sent to hello@disclarion.com.