Privacy Policy

1.1 Personal Identification Information

• Full name, as provided during account registration
• Email address, used for account creation, authentication, and service communications
• Account credentials (encrypted), including passwords and authentication tokens

1.2 Audio Data

During active interview sessions facilitated through our platform, we may collect audio input data transmitted via your device's microphone. Such audio data is processed exclusively for the purpose of real-time AI-assisted interview support. Audio data is not stored beyond the duration of the session unless explicitly required for service delivery and subject to your prior informed consent.

1.3 Technical & Device Data

• Browser type, version, and operating system
• Internet Protocol (IP) address and approximate geolocation
• Session duration, timestamps, and clickstream data
• Device identifiers and screen resolution

1.4 Cookie & Tracking Data

We use browser cookies and similar tracking technologies. Please refer to Section 1A (Cookie Policy) for a full and detailed account of how cookies are used and how you may exercise your opt-out rights.

1.5 Data We Do Not Collect

Clause AI does not collect sensitive personal data as defined under the DPDP Act 2023 and SPDI Rules, 2011, including but not limited to financial information, biometric data (beyond audio as described above), medical records, racial or ethnic origin, or political opinions, unless mandated by law or with explicit, informed consent.

1A.1 What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or mobile) by websites you visit. They are widely used to make websites function efficiently, improve user experience, and provide analytical information to site operators. Cookies may be set either by the website you are visiting ('first-party cookies') or by third-party services operating on that site ('third-party cookies').
Similar technologies include web beacons, pixel tags, local storage objects (LSOs), and session storage — all of which may operate analogously to cookies for data collection purposes. References to 'cookies' in this policy include all such similar technologies unless otherwise stated.

1A.2 Categories of Cookies We Use

The table below provides a detailed breakdown of cookies used on www.clauseai.in:

1A.3 Detailed Cookie Descriptions

1A.4 How to Manage & Opt-Out of Cookies

You have the right to withdraw consent for non-essential cookies at any time. We provide the following mechanisms:

1A.5 Do Not Track (DNT) Signals

Some browsers transmit 'Do Not Track' (DNT) signals to websites. At present, there is no universally accepted standard for how websites should respond to DNT signals. Clause AI acknowledges DNT signals and, where technically feasible, will honour them by disabling non-essential tracking. We will continue to monitor industry developments on this matter.

1A.6 Cookie Consent for Minors

Where a user is identified as, or is reasonably suspected to be, a minor (under 18 years of age), Clause AI will deploy only essential cookies and will not activate analytical, functional, or marketing cookies without verifiable parental or guardian consent, in accordance with Section 9 of the DPDP Act, 2023 and Article 8 of GDPR. Please refer to Section 5A of this Policy for our full provisions relating to minors.

3.1 Service Delivery

• To authenticate users and maintain secure account sessions [Basis: Contractual necessity]
• To provide real-time AI interview assistance and generate response suggestions during active sessions [Basis: Contractual necessity / Legitimate interest]
• To process audio data for in-session transcription and AI analysis [Basis: Consent]

3.2 Platform Improvement

• To analyse anonymised usage patterns for product enhancement and feature development [Basis: Legitimate interest]
• To diagnose and resolve technical errors and platform stability issues [Basis: Legitimate interest]

3.3 Communication & Support

• To send service-related notifications, security alerts, and account updates [Basis: Contractual necessity]
• To respond to user queries, complaints, and support requests [Basis: Legitimate interest]
• To send promotional communications or product updates, only with your prior consent, and subject to your right to withdraw consent at any time [Basis: Consent]

3.4 Legal & Regulatory Compliance

• To comply with applicable laws, court orders, regulatory directives, or lawful requests from competent governmental authorities [Basis: Legal obligation]
• To enforce our Terms of Service and protect the legal rights, property, or safety of Clause AI, its users, and the public [Basis: Legitimate interest / Legal obligation]

4.1 Infrastructure & Cloud Storage

We use Supabase (a PostgreSQL-based cloud database and backend service) for secure data storage, user authentication, and real-time database operations. Supabase processes data on our behalf and is contractually prohibited from using your data for any independent purpose. Data stored via Supabase is encrypted at rest and in transit.

4.2 Analytics Services

We may use privacy-respecting analytics tools to understand platform performance. These tools are configured to anonymise user identifiers and do not permit cross-site tracking or individual-level profiling.

4.3 Non-Disclosure of Data

Clause AI does not sell, lease, barter, or otherwise commercially transfer your personal data to any third party for marketing or commercial purposes. Data may be disclosed to third parties only in the following circumstances:

• When required by a court order, government directive, or applicable law
• To protect the rights, property, or safety of Clause AI, its users, or the public
• In connection with a merger, acquisition, or sale of assets, subject to equivalent data protection obligations being imposed on the acquiring entity and prior notice to you
• With your explicit prior consent

4.4 International Data Transfers

Where personal data is transferred to or processed in jurisdictions outside India, Clause AI ensures such transfers are effected in compliance with Section 16 of the DPDP Act, 2023 and applicable GDPR Chapter V provisions, including the use of Standard Contractual Clauses or equivalent transfer mechanisms where required.

5.1 Technical Safeguards

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 encryption standards
• Access to personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls (RBAC)
• Multi-factor authentication (MFA) is enforced for all internal administrative access to production systems
• Regular automated vulnerability assessments and penetration testing are conducted

5.2 Organisational Safeguards

• All employees and contractors with access to personal data are bound by confidentiality obligations
• Internal data handling policies and security awareness training are provided to relevant personnel
• A documented incident response plan is maintained and tested periodically

5.3 Data Retention & Deletion

• Account information: Retained for the duration of the active account and up to 90 days following account deletion
• Audio data: Deleted at the conclusion of each session, unless subject to extended retention with explicit consent
• Usage and log data: Retained for a maximum of 12 months for security and operational purposes

5.4 Breach Notification

In the event of a personal data breach that is likely to result in harm to Data Principals, Clause AI will notify the affected individuals and the Data Protection Board of India within the timelines prescribed under the DPDP Act, 2023. Such notification will include the nature of the breach, data categories affected, and remedial measures undertaken.

5A.1 Age Restriction & Eligibility

Clause AI's AI-powered interview assistant platform is designed for adult users and is not directed at, or intended for use by, children or minors under the age of 18 years ('Minor'). By registering for or using our services, you represent and warrant that you are at least 18 years of age.
Where applicable local law prescribes a different age of digital consent (e.g., 13 in some U.S. states under COPPA, 16 in certain EU member states under GDPR), the higher age threshold shall apply.

5A.2 Legal Framework for Minors' Data

Clause AI's approach to minors' data is governed by the following international and domestic legal instruments:

• Section 9, DPDP Act, 2023 (India): Prohibits processing of personal data of children without verifiable parental consent and prohibits behavioural tracking, targeted advertising, or any processing detrimental to the well-being of a child.
• Article 8, GDPR (EU): Requires that where an online information society service is offered to a child, the child must be at least 16 years old to provide consent. Below this age, consent must be obtained from the holder of parental responsibility.
• Children's Online Privacy Protection Act (COPPA), USA: Prohibits the collection of personal information from children under 13 without verifiable parental consent.
• United Nations Convention on the Rights of the Child (UNCRC), Article 16: Recognises children's right to privacy and protection from interference with their privacy, family, home, or correspondence.

5A.3 Consent Requirements for Minors

Notwithstanding the general age restriction, should a Minor access our platform (whether through misrepresentation of age or otherwise), the following safeguards apply:

• No personal data of a Minor will be processed without verifiable consent from a parent or legal guardian, in accordance with Section 9 of the DPDP Act, 2023.
• Clause AI will not conduct behavioural monitoring, profiling, or targeted advertising directed at Minors under any circumstances.
• Audio data of a Minor will not be retained beyond the active session under any circumstances, even where the Minor or their guardian has consented to extended retention for adult users.
• Consent for Minors must be obtained through a verifiable parental consent mechanism, the details of which will be presented at the point of registration if a Minor is detected.

5A.4 Detection & Enforcement

While Clause AI does not proactively collect age information beyond the age verification declaration at registration, we implement the following measures to identify and protect Minors:

• Age verification checkbox and declaration at the point of account creation
• Automated signal review to detect age-inconsistent usage patterns, to the extent technically feasible
• Prompt account suspension and data deletion upon receipt of credible notification that a Minor is using the platform without parental consent

5A.5 Parental Rights & Reporting

If you are a parent or legal guardian and believe that your child has provided personal data to Clause AI without your consent, you are entitled to:

• Request immediate deletion of your child's personal data
• Request a full disclosure of what personal data (if any) has been collected
• Withdraw any consent previously given on your child's behalf

To exercise these rights, please contact our Data Protection Officer at dpo@clauseai.in with the subject line: MINOR DATA REQUEST. We will respond within 48 hours and take remedial action within 7 business days of verifying the request.

5A.6 Data Deletion Upon Discovery

Upon discovery or credible notification that personal data belonging to a Minor has been collected without valid parental consent, Clause AI will:

• Immediately suspend the relevant account
• Permanently and irrecoverably delete all personal data associated with that account within 7 business days
• Notify the parent or guardian of the actions taken
• Where required by law, notify the relevant regulatory authority

6.0 DPDP Act 2023 — Compliance Verification

The following compliance check confirms how this Privacy Policy addresses specific rights under the Digital Personal Data Protection Act, 2023:

6.1 Rights Under the DPDP Act, 2023 (India) — Detailed

As a Data Principal under the DPDP Act, 2023, you are entitled to the following rights, each of which is specifically implemented in this Policy:

6.2 Rights Under GDPR (EEA Residents)

• Right of Access (Article 15): To obtain confirmation of whether and what personal data is processed about you.
• Right to Rectification (Article 16): To have inaccurate personal data corrected without undue delay.
• Right to Erasure / Right to be Forgotten (Article 17): To request deletion of personal data in specified circumstances.
• Right to Restriction of Processing (Article 18): To restrict processing of your personal data in specified circumstances.
• Right to Data Portability (Article 20): To receive your personal data in a structured, machine-readable format.
• Right to Object (Article 21): To object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making (Article 22): To not be subject to solely automated decisions with significant effects, without human review.

6.3 Rights Under CCPA / CPRA (California Residents)

• Right to Know: To request disclosure of categories and specific pieces of personal information collected, purposes of collection, and third parties with whom information is shared.
• Right to Delete: To request deletion of personal information, subject to applicable exceptions.
• Right to Opt-Out of Sale or Sharing: Clause AI does not sell or share personal information. You may opt out if this practice commences in the future.
• Right to Correct: To request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: To limit use and disclosure of sensitive personal information to lawfully authorised purposes.
• Right of Non-Discrimination: You shall not be discriminated against for exercising any of your CCPA/CPRA rights.