Privacy Policy

The controller within the meaning of the GDPR is:
AB SOUL IMPACT LTD
Georgiou Karaisaki 11-13, Carisa Salonica, Office 102, 7660 Pervolia, Larnaka, Republic of Cyprus
Email: support@neoclarity.io

We process personal data solely to provide CLARITY to you — your account, your workspace data and the sources you connect. The sections below explain which data we process for which purpose, on which legal basis and with which service providers.

Vercel (Vercel Inc., USA) runs the web application and its server-side functions; execution happens in the EU region Frankfurt.
Supabase provides the database, authentication and file storage; the data is held in the EU region Frankfurt (eu-central-1). Both act as our processors. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR) and performance of our contract with you (lit. b).

To register you, we process your email address, your password (only as a cryptographic hash), profile details and your language preference. The purpose is to provide and administer your account. The legal basis is performance of our contract (Art. 6(1)(b) GDPR).

If you request a demo appointment through our website, we process the details you enter in the form (including name, email address, company and optional contact details) in order to handle your request. For scheduling we use Cal.com (Cal.com, Inc., USA) as a processor; your name, email address and the chosen slot are transmitted to Cal.com. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

Transactional emails (confirmations, password resets, notifications) are sent via Resend (Amazon SES infrastructure, EU region Ireland), acting as our processor. The legal basis is performance of our contract and our legitimate interest in reliable delivery (Art. 6(1)(b), (f) GDPR).

The in-app assistant “Neo” uses the Claude API from Anthropic (Anthropic PBC, USA). We transmit the content needed to answer your request (for example metrics from your workspace). Anthropic processes it solely to generate the response and does not use data submitted through the API to train its models. The legal basis is performance of our contract and our legitimate interest in offering the feature (Art. 6(1)(b), (f) GDPR).

Only if you actively connect them do we access Facebook/Meta Ads, Typeform, Calendly and Close (see section 9). Access tokens are stored encrypted; we import the data you release (for example campaign metrics, form responses, bookings) in order to display it in your analytics. The legal basis is performance of our contract (Art. 6(1)(b) GDPR). You can disconnect any integration at any time.

When you connect your Close account via OAuth, and only for as long as the connection is active, we access the following data read-only:

• Account and organization info: your Close organization ID and the connecting user’s email address.
• Leads and contacts: contact email addresses, used to match Close records to leads in your CLARITY workspace.
• Activities: custom activities and their field values (including the selected outcome), and call activities — including, where available in your Close plan, call recording transcripts and AI-generated call summaries.
• Opportunities: opportunities and their pipeline, stage and status.

We use this data solely to display sales and coaching analytics (conversions, attribution, call history, pipeline stage) inside your CLARITY workspace. CLARITY is read-only against Close — we never create, modify or delete data in your Close account.

OAuth access and refresh tokens are stored encrypted (AES-256-GCM) and are never exposed to end users or third parties. Imported records are scoped to your workspace by row-level security — only members of that workspace can access them. Data is transmitted over TLS.

We retain imported Close data and tokens for as long as the connection is active. When you disconnect Close in CLARITY, we revoke the token with Close and delete the stored credentials; imported records are deleted on request or via your workspace’s data controls. You may disconnect at any time.

The legal basis is performance of our contract (Art. 6(1)(b) GDPR) and our and your legitimate interest in providing sales analytics (lit. f). By connecting Close you confirm that you are authorized to share that organization’s data with us; for the imported data we act as your processor.

If you link the Telegram bot, we process your Telegram chat ID and the messages exchanged in order to deliver notifications and the chat with Neo. The service is operated by Telegram. The legal basis is your consent and performance of our contract (Art. 6(1)(a), (b) GDPR).

By default we count page views without cookies and without cross-device recognition — the evaluation is aggregated. An optional cookie mode (persistent recognition) is only activated with separate consent through a consent banner. The legal basis is our legitimate interest in audience measurement (Art. 6(1)(f)) and your consent in cookie mode (lit. a GDPR).

To detect and fix faults we use Sentry (EU region, de.sentry.io), which processes technical error data. The legal basis is our legitimate interest in error-free operation (Art. 6(1)(f) GDPR).

We set technically necessary cookies for sign-in and session handling. These are required to operate the service and do not require consent (Section 25(2) TDDDG). We do not set marketing or tracking cookies by default.

On access, technical data (including a truncated IP address, timestamp, requested resource and user agent) is logged briefly to safeguard security and stability. The legal basis is Art. 6(1)(f) GDPR.

We store account-related data for as long as your account exists. After deletion your personal data is removed or anonymized; statutory retention obligations remain unaffected.

We do not sell personal data, and we do not use data imported from connected sources — your Close data in particular — for advertising or to train AI models.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21); consent you have given can be withdrawn at any time with effect for the future (Art. 7(3)). You can delete your account yourself at any time in the settings — this removes your personal data including your profile picture. To exercise your rights or ask questions, contact us at support@neoclarity.io. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — given our seat, in particular the Office of the Commissioner for Personal Data Protection (Nicosia, Republic of Cyprus); you may equally address the supervisory authority in your own EU member state.

Some of our service providers (including Vercel, Anthropic, Cal.com and Close) are US companies. Where data is transferred to the USA, this is done on the basis of the EU Standard Contractual Clauses or — where the provider is certified — the EU-US Data Privacy Framework.

We update this privacy policy when our processing or the legal situation changes. Material changes are published here with an updated effective date. The version published here is the one that applies.