What we keep, and why.

Who we are

Clemali is operated from France. Contact: [email protected].

What we collect

• Account — email, name, password hash, optional social sign-in identifiers, two-factor seed (encrypted), sessions (IP address, browser).
• Environments — names, upstream server addresses, secrets (encrypted, never readable by us through the product), OAuth grants (encrypted).
• Call log — for each tool call: tool name, agent name, status, latency, sizes, a redacted error message. Arguments and results are not stored unless you enable argument logging for an environment.
• Billing — handled by Stripe; we keep the customer and subscription identifiers and usage counters.
• Support — messages you send us and notes we take to help you.

Why

To run the gateway, bill fairly, keep the service secure, answer support and meet legal obligations. We do not sell data, do not run advertising, and do not use tool calls or their results to train anything.

Retention

• Call log: 24 hours on Free, 30 days on Pro, 90 days on Team, custom on Enterprise.
• Account data: as long as the account exists. Deleting the account deletes environments, destroys vault keys and anonymizes the account record.
• Billing records: as long as tax law requires.

Sub-processors

Listed in the docs and updated before any change: hosting in the EU, Cloudflare, Stripe, Resend, GitHub and Google for optional sign-in.

Google user data

When you connect a Google Workspace source (Gmail, Drive, Calendar, Sheets, BigQuery), Clemali reads the data the assistant needs to answer the question of the person asking, at the moment they ask, and writes only what that person confirms. Nothing from a Google account is copied into a search index, used to train models, shown to anyone else, sold or shared with advertisers. The authorization is stored encrypted and can be revoked at any time from the Sources tab or from your Google account. Clemali's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights

Access, rectification, erasure, portability and objection under the GDPR. Most of it is self-service in Settings; for the rest, write to [email protected]. You can also complain to the CNIL.

Cookies

One session cookie to keep you signed in and one to remember the organization you are looking at. No tracking cookies.