Privacy Policy

1. Who we are

Clause360 is provided by RGV Technologies LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA ("we", "us"). This policy explains how we handle personal data on clause360.com and in the Clause360 service. Contact us at hello@clause360.com, or by phone or WhatsApp on +1 (229) 536-0928.

2. Our two roles

• For our website, accounts and billing, we decide how personal data is used: we are the controller.
• For the contracts and documents our customers put into Clause360 ("Customer Data"), our customer decides, and we process that data only on their instructions, as their processor, under the data protection terms of the Clause360 Subscription Agreement. If your details appear in a contract held by one of our customers, please contact that organisation first; we will help them respond.

3. What we collect

• When you contact us or book a demo: your name, email, organisation, topic and message.
• When you create or use an account: your name, work email, organisation, role, sign-in and two-step verification details, and a record of your actions in the workspace (the audit log).
• When you buy a subscription: billing contact details, order and invoice details, and payment status. Card details, where used, are handled by our payment processor and never stored by us.
• When you accept our terms: your name, email, organisation, the version accepted, the time, your IP address and browser, as evidence of acceptance.
• Technical data: server logs (such as IP address, browser and pages requested) kept for security and troubleshooting.

4. Cookies and tracking

Our website does not use advertising or analytics cookies, and does not track you across other websites. The Clause360 app uses only cookies needed to keep you signed in securely. Videos on our website load from YouTube in privacy-enhanced mode, and only when you choose to play them.

5. How and why we use personal data

• To provide, secure and support the Clause360 service (to perform our contract with you or your organisation).
• To answer enquiries and arrange demos (at your request, and in our legitimate interest in responding).
• To send service emails, such as sign-in codes, notifications, trial and renewal notices (to perform our contract).
• To invoice and keep accounting records (to comply with legal obligations).
• To keep evidence of acceptance of our terms, and to protect against fraud and abuse (legitimate interests and legal obligations).
• To send occasional product news, only where you have agreed or where the law allows; you can opt out at any time.

We do not sell personal data, and we do not use Customer Data to train artificial intelligence models.

6. Who we share it with

We use carefully selected service providers, under contracts that protect your data: Oracle Cloud Infrastructure (hosting, by default in Riyadh, Saudi Arabia), Anthropic (AI features, which receive contract text with common personal identifiers masked where possible, and do not train on it), Hostinger (email), Stripe and Wise (payments), and Microsoft (only if a customer connects Microsoft 365). We may also disclose data where the law requires, or to protect rights and safety.

7. International transfers

Our main hosting is in Saudi Arabia. Some providers, including our AI provider, process limited data in other countries such as the United States. Where the law requires, we use appropriate safeguards, such as standard contractual clauses, for these transfers.

8. How long we keep it

• Enquiries: up to 2 years after our last contact.
• Account data: for as long as the account is active, then deleted within 90 days of the end of the subscription, except where we must keep it.
• Customer Data: as set out in the Subscription Agreement (available for export for 30 days after termination, then deleted).
• Invoices and accounting records: as long as tax law requires.
• Records of acceptance of our terms and the audit log: as long as needed to show compliance and to establish or defend legal claims.

9. How we protect it

Encryption in transit and at rest, separation of each customer's data in the database, mandatory two-step verification, role-based access, a tamper-evident audit log, daily backups and least-privilege administrative access. More detail is on our Security page.

10. Your rights

Depending on where you are, including under the Saudi Personal Data Protection Law, the EU and UK GDPR and similar laws, you may have the right to be informed, to access your personal data, to correct it, to have it deleted, to restrict or object to its use, to data portability, and to withdraw consent where we rely on it. To exercise these rights, contact hello@clause360.com. We will respond within the time the law requires, usually within 30 days. You can also complain to your data protection authority, such as the Saudi Data and Artificial Intelligence Authority (SDAIA) in Saudi Arabia, or the Information Commissioner's Office in the United Kingdom.

11. Children

Clause360 is a business service and is not intended for children.

12. Changes to this policy

We may update this policy. We will post the new version here with its effective date and, for significant changes, tell account administrators by email.