Clariyo.ai
Start free
Legal

Privacy Policy

Effective 7 October 2026

This Privacy Policy explains how Clariyo ("we", "us", "our") collects, uses, stores and protects personal data when you use our website at clariyo.ai and our analytics platform (together, the "Service"). We are committed to handling your data in accordance with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, the "PDPPL"), the Ministry of Transport and Communications guidelines issued under it, and other applicable data-protection laws across the GCC, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the Kingdom of Saudi Arabia Personal Data Protection Law (Royal Decree M/19 of 2021).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please do not use the Service.

1. Data controller

Clariyo is the data controller responsible for the personal data described in this policy. You can contact us at clariyo.ai/start or by email at hello@clariyo.ai.

2. What data we collect

2.1 Account data

When you create an account or request early access, we collect your name, email address, company name and role. If you subscribe to a paid plan, we collect billing details (processed by our payment provider — we do not store full card numbers).

2.2 Store and platform data

When you connect a third-party platform (such as Shopify, Meta Ads, Google Ads, Klaviyo, Stripe or GA4), we access data from those platforms through their official APIs using read-only credentials you grant. This data may include orders, products, customer records, advertising metrics, email-campaign metrics and payment summaries. We act as a data processor for your customers' personal data that passes through these integrations.

2.3 Usage data

We automatically collect technical information when you visit our website or use the Service, including IP address, browser type, device type, pages viewed, referring URL and timestamps. We use this data to improve the Service and diagnose issues.

2.4 Communications

If you email us or submit a form, we keep the content of that communication and any attachments to respond and to improve the Service.

2.5 Cookies and similar technologies

We use essential cookies required for the Service to function. We may also use analytics cookies to understand how the Service is used. You can control non-essential cookies through your browser settings. We do not use cookies for third-party advertising.

3. Legal basis for processing

Under the PDPPL, we process personal data on the following bases:

  • Consent. Where you have given informed, specific and freely given consent — for example, when you create an account, connect a platform or subscribe to communications. You may withdraw consent at any time (see Section 8).
  • Contractual necessity. Processing required to provide the Service you have subscribed to.
  • Legitimate interest. Processing necessary for our legitimate business interests (such as fraud prevention and service improvement), provided those interests are not overridden by your rights.
  • Legal obligation. Processing required to comply with applicable law, regulation or a lawful order.

4. How we use your data

  • To provide, maintain and improve the Service, including generating analytics, investigations and recommendations for your store.
  • To process payments and manage your subscription.
  • To communicate with you about the Service, respond to support requests and send service-related notices.
  • To send marketing communications where you have opted in. You can unsubscribe at any time.
  • To detect, prevent and address technical issues, fraud or security incidents.
  • To comply with legal obligations and enforce our Terms of Use.
  • To produce aggregated, anonymised analytics that cannot identify any individual. Anonymised data is not personal data under the PDPPL.

5. Data sharing and disclosure

We do not sell personal data. We share personal data only in the following circumstances:

  • Service providers. Third-party vendors who process data on our behalf to deliver the Service (for example, cloud hosting, payment processing, email delivery and analytics). Each provider is contractually bound to process data only for the purposes we specify and to maintain appropriate security measures.
  • Legal requirements. Where disclosure is required by law, regulation, legal process or a governmental request, including requests from authorities in Qatar or other GCC jurisdictions.
  • Business transfers. In connection with a merger, acquisition or sale of assets, provided the successor entity assumes the obligations of this Privacy Policy.
  • With your consent. Where you have given specific consent to a particular disclosure.

6. International data transfers

The Service may process data using infrastructure located outside Qatar or the GCC. Where personal data is transferred internationally, we ensure that:

  • The transfer does not violate the provisions of the PDPPL or result in serious harm to the data or the individuals concerned (Article 15, PDPPL).
  • The recipient country or organisation provides an adequate level of data protection, or appropriate safeguards are in place (such as standard contractual clauses or binding corporate rules).
  • For users in the UAE, transfers comply with the conditions set out in the UAE PDPL and any executive regulations issued under it.
  • For users in the Kingdom of Saudi Arabia, transfers comply with the Saudi PDPL's conditions for cross-border transfer.

If you have questions about where your data is processed, contact us.

7. Data security

We implement technical and organisational measures to protect personal data from unauthorised access, loss, misuse or alteration. These include:

  • Encryption of data in transit (TLS) and at rest.
  • Access controls, including multi-factor authentication for internal systems.
  • Regular security assessments and vulnerability testing.
  • Staff training on data-protection obligations.
  • Incident-response procedures, including breach notification to the competent authority and affected individuals where required by law.

No system is completely secure. We cannot guarantee absolute security, but we commit to promptly investigating and remediating any incident.

8. Your rights

Under the PDPPL and applicable GCC data-protection laws, you have the following rights:

  • Access. Request a copy of the personal data we hold about you.
  • Correction. Request that we correct inaccurate or incomplete data.
  • Deletion. Request that we delete your personal data, subject to legal retention obligations.
  • Objection. Object to certain processing activities, including direct marketing.
  • Withdrawal of consent. Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Restriction. Request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, contact us at hello@clariyo.ai or through our contact form. We will respond within 30 days. If we cannot fulfil a request, we will explain why.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law. Specifically:

  • Account data is retained for the duration of your account and for up to 12 months after closure, unless legal or regulatory requirements mandate longer retention.
  • Store and platform data is retained for the duration of the active integration. When you disconnect a platform or close your account, we delete or anonymise the connected data within 90 days.
  • Usage data is retained in identifiable form for up to 24 months, after which it is anonymised.
  • Communications are retained for as long as necessary to resolve the matter, plus any period required by law.

When data is no longer needed, we securely delete or irreversibly anonymise it.

10. Children's data

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have collected data from a child without verifiable parental consent, we will delete it promptly. The PDPPL requires parental consent for processing children's data, and we comply with this requirement.

11. Direct marketing

We only send marketing communications where you have opted in. Every marketing message includes an unsubscribe mechanism. We comply with Qatar's restrictions on unsolicited electronic communications under the Electronic Commerce and Transactions Law (Decree-Law No. 16 of 2010, Article 54).

12. Data protection impact assessments

Where our processing activities are likely to result in a high risk to individuals' rights, we conduct data protection impact assessments in accordance with the PDPPL and the 2021 MOTC guidelines. We maintain a record of processing activities (RoPA) documenting all personal data processing operations.

13. Third-party links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the Service before the changes take effect. The "Effective" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact

For any questions about this Privacy Policy or to exercise your data-protection rights: