Privacy Policy

The controller within the meaning of the GDPR is:
NEOCLARITY GROUP LTD
Archiepiskopou Makariou III 59, Mouyias Tower, 3rd floor, Office 301, 6017 Larnaka, Republic of Cyprus
Email: support@neoclarity.io

We process personal data solely to provide Neo CLARITY to you — your account, your workspace data and the sources you connect. The sections below explain which data we process for which purpose, on which legal basis and with which service providers.

Two roles. For our website, your user account and billing we are the controller ourselves. For the data you process in your workspace — such as your leads, appointments, sales, call recordings and your team’s performance data — you as the customer are the controller and we are your processor. Our Data Processing Agreement and the list of sub-processors apply to that. If you are a lead or client of a Neo CLARITY customer, please contact that company first about your data; we forward any requests that reach us to them.

Vercel (Vercel Inc., USA) runs the web application and its server-side functions; execution happens in the EU region Frankfurt.
Supabase provides the database, authentication and file storage; the data is held in the EU region Frankfurt (eu-central-1). Both act as our processors. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR) and performance of our contract with you (lit. b).

To register you, we process your email address, your password (only as a cryptographic hash), profile details and your language preference. If you sign in with your Google account, Google gives us your name, email address and, where available, your profile picture. The purpose is to provide and administer your account. The legal basis is performance of our contract (Art. 6(1)(b) GDPR).

If you request a demo appointment through our website, we process the details you enter in the form (including name, email address, company and optional contact details) in order to handle your request. For scheduling we use Cal.com (Cal.com, Inc., USA) as a processor; your name, email address and the chosen slot are transmitted to Cal.com. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). We notify our team internally about new requests and purchases via Slack (Slack Technologies, LLC, USA); your name, email address and the chosen slot are transmitted. The legal basis is our legitimate interest in handling requests quickly (Art. 6(1)(f) GDPR).

Transactional emails (confirmations, password resets, notifications) are sent via Resend (Amazon SES infrastructure, EU region Ireland), acting as our processor. The legal basis is performance of our contract and our legitimate interest in reliable delivery (Art. 6(1)(b), (f) GDPR).

Subscriptions and payments are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe processes your name, email address, billing address, where applicable your VAT ID, and your payment details. We never see full card or account details; we only receive the payment status and the information needed for the invoice. Stripe may also transfer data to the USA and is in part a controller in its own right for payment processing and fraud prevention. The legal basis is performance of our contract (Art. 6(1)(b) GDPR) and our statutory duty to retain invoices (lit. c).

Individual contract. If you sign a contract with us on our contract page, we store the details you enter there (name, company, address, VAT ID where applicable, the chosen payment method and, for direct debit, account holder and IBAN), the signed wording with its checksum (SHA-256), your drawn signature and the time, IP address and browser identifier of the signature. They serve as proof that the contract was concluded and for invoicing; you receive a copy of the contract by email. We keep these details for the term of the contract and afterwards until the statutory retention and limitation periods expire. The legal basis is performance of the contract (Art. 6(1)(b) GDPR), our statutory retention duty (lit. c) and our legitimate interest in proving the conclusion of the contract (lit. f).

For the AI features we use the Claude API from Anthropic (Anthropic PBC, USA): the “Neo” assistant (in the app, in the browser add-on and via Telegram), the automatic reports, the lead-quality assessment based on questionnaire answers, the review of sales calls based on their transcripts, speaker detection in a transcript and the analysis of website and sales script during setup.

Only the content each task needs is transmitted, for example metrics, a lead’s details with their answers or the transcript of a call including participants’ names. Anthropic does not use data submitted through the API to train its models and keeps it only for a limited period for abuse detection. AI results are recommendations; Neo CLARITY makes no automated decisions producing legal effects (Art. 22 GDPR). The legal basis is performance of our contract (Art. 6(1)(b) GDPR); for workspace data we act on the customer’s behalf.

At the customer’s request we fetch recordings and transcripts of sales calls from the sources the customer connects: from Close, from folders in Google Drive the customer shares with us, or through Fathom share links. Audio recordings are converted to text by ElevenLabs (ElevenLabs Inc., USA) acting as our processor. Only the audio is transmitted. We request processing without storage at the provider; where that is not possible in an individual case, we delete the transcript there immediately after conversion. ElevenLabs does not use the data to train its models. Call training (role-play) uses ElevenLabs for voice output; only the text to be spoken is transmitted.

We store transcripts and reviews in the customer’s workspace until the customer deletes them or the workspace. The customer is responsible for ensuring that all call participants were informed and consented before recording (§ 201 German Criminal Code). Our processing is based on the customer’s instruction (Art. 28 GDPR).

Only if you actively connect them do we access Facebook/Meta Ads (see section 13), Google Ads (see section 12), Typeform, Calendly and Close (see section 11). Access tokens are stored encrypted; we import the data you release (for example campaign metrics, form responses, bookings) in order to display it in your analytics. The legal basis is performance of our contract (Art. 6(1)(b) GDPR). You can disconnect any integration at any time. How to remove your Facebook data completely is explained under Data Deletion.

When you connect your Close account via OAuth, and only for as long as the connection is active, we access the following data read-only:

• Account and organization info: your Close organization ID and the connecting user’s email address.
• Leads and contacts: contact email addresses, used to match Close records to leads in your Neo CLARITY workspace.
• Activities: custom activities and their field values (including the selected outcome), and call activities — including, where available in your Close plan, call recording transcripts and AI-generated call summaries.
• Opportunities: opportunities and their pipeline, stage and status.

We use this data solely to display sales and coaching analytics (conversions, attribution, call history, pipeline stage) inside your Neo CLARITY workspace. Neo CLARITY is read-only against Close — we never create, modify or delete data in your Close account.

OAuth access and refresh tokens are stored encrypted (AES-256-GCM) and are never exposed to end users or third parties. Imported records are scoped to your workspace by row-level security — only members of that workspace can access them. Data is transmitted over TLS.

We retain imported Close data and tokens for as long as the connection is active. When you disconnect Close in Neo CLARITY, we revoke the token with Close and delete the stored credentials; imported records are deleted on request or via your workspace’s data controls. You may disconnect at any time.

The legal basis is performance of our contract (Art. 6(1)(b) GDPR) and our and your legitimate interest in providing sales analytics (lit. f). By connecting Close you confirm that you are authorized to share that organization’s data with us; for the imported data we act as your processor.

If you connect your Google account via “Connect Google Ads” using OAuth, we access the following data through the Google Ads API — only while the connection is active and strictly read-only:

• Account data: the email address of the connecting Google account, and the ID, name, currency and time zone of the Google Ads accounts you can access (including the sub-accounts of a manager account).
• Campaign structure: names, IDs and statuses of campaigns, ad groups, ads and asset groups, and campaign budgets.
• Performance metrics: cost, impressions and clicks per ad and day.

We do not request personal data of the people who see your ads through the Google Ads API. We use the data solely to analyze your ad spend and campaigns in your Neo CLARITY workspace (cost per lead, per appointment and per sale). Neo CLARITY only reads — we never create, change, pause or delete anything in your Google Ads account.

Neo CLARITY’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising or to train general-purpose AI models, and humans only see it where needed for support, security or legal obligations, or with your explicit consent.

Access and refresh tokens are stored encrypted (AES-256-GCM) and never disclosed to end users or third parties. Imported data is restricted to your workspace by row-level security and stored in the EU (Frankfurt). If you disconnect Google Ads in Neo CLARITY, we revoke the access at Google and delete the stored credentials; the imported ad data is deleted with the connection. Daily values already carried into your funnel metrics (ad spend, impressions, clicks) remain part of your reports until you delete them. You can also remove access at any time at myaccount.google.com/permissions.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). By connecting, you confirm that you are entitled to share the data of the Google Ads accounts concerned with us; for the imported data we act as your processor.

If you connect your Meta ad account, we read campaign metrics and spend. If you additionally grant the permission “Neo may steer campaigns”, Neo can propose pausing, activating, re-budgeting or copying campaigns or ad sets; nothing is executed until an owner or admin clicks “Execute”.

If you switch on the feedback channel, we report via the Meta Conversions API which stage a lead has reached (for example appointment, deal) to the dataset in your Meta account. Contact details (email, phone, first and last name, country) are transmitted only as SHA-256 hashes; technical matching attributes (click ID, browser identifier, internal lead ID, page URL) as well as value and currency are sent in clear text. Meta processes this data under its own Business Tools terms. The feedback channel is off by default; the customer is responsible for ensuring the leads concerned have consented and been informed.

The Chrome extension “Neo im Browser” shows Neo as a side panel next to any web page. It does not read the content of the pages you visit and transmits neither your browsing history nor the addresses of those pages. What you write to Neo in the side panel is processed as described in Section 8.

Sign-in. You sign in with your Neo CLARITY account and choose a workspace. The access and refresh token issued in the process is stored only locally in your browser (chrome.storage.local, not synced across devices). Signing out in the side panel or disconnecting under Settings → Connected apps revokes the token; if you remove the extension, Chrome deletes the locally stored data.

Column in Ads Manager. Only if you switch it on and allow Chrome to access adsmanager.facebook.com — and only that address — does the extension add a column with your Neo CLARITY figures there. To do so it reads the ad account ID, the level (campaigns, ad sets, ads) and the selected date range from the page and uses them to request the matching values from us. It uses the IDs of the table rows only inside your browser to match values to rows; they are not transmitted. It reads no other Ads Manager content. Your column selection is also kept in chrome.storage.local. Switching the column off gives the access back.

The extension talks exclusively to Neo CLARITY, uses no tracking or analytics services and shares no data with third parties. The legal basis is performance of contract (Art. 6(1)(b) GDPR); storing the token on your device is strictly necessary for the function you requested (Section 25(2) TDDDG).

If you link the Telegram bot, we process your Telegram chat ID and the messages exchanged in order to deliver notifications, reports and the chat with Neo. If the customer links a Telegram group, we also send call reviews there as PDFs at the customer’s request; these contain the names of the lead and the team member, the score and excerpts from the transcript. The service is operated by Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates); messages leave the EU. The legal basis is your consent and performance of our contract (Art. 6(1)(a), (b) GDPR).

We do not use any analytics or tracking tools on our own website. This is separate from the funnel tracker our customers embed on their own pages: by default it works without cookies, truncates the IP address, makes it unrecognisable with a daily changing key and does not store it. The respective customer is the controller for it; we process this data on the customer’s behalf.

To detect and fix faults we use Sentry (EU region, de.sentry.io), which processes technical error data. The legal basis is our legitimate interest in error-free operation (Art. 6(1)(f) GDPR).

We set technically necessary cookies for sign-in and session handling. These are required to operate the service and do not require consent (Section 25(2) TDDDG). We do not set marketing or tracking cookies by default.

Partner referral. If you arrive through the link of one of our partners (recognisable by ?ref= in the address), we ask whether we may remember that. Only if you agree do we store the partner's code in the first-party cookie clarity_ref (no other data about you). Purpose: if you book a call later, it is attributed to the partner who referred you, so they receive their commission. Storage period: 90 days. Legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, nothing is stored. You can withdraw your consent at any time – with this button or by deleting this site's cookies in your browser: Delete partner assignment

On access, our hosting provider briefly logs technical data (including IP address, timestamp, requested resource and user agent) to safeguard security and stability. The legal basis is Art. 6(1)(f) GDPR.

We store account-related data for as long as your account exists. After deletion your personal data is removed or anonymized; statutory retention obligations (in particular for invoices) remain unaffected. Data in a customer’s workspace — including transcripts and reviews — is stored until the customer deletes it, and at the latest until 60 days after the customer’s contract ends (see § 11 of the Data Processing Agreement).

We do not sell personal data, and we do not use data imported from connected sources — your Close data in particular — for advertising or to train AI models.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21); consent you have given can be withdrawn at any time with effect for the future (Art. 7(3)). You can delete your account yourself on your profile page once none of your workspaces has a running subscription — this removes your personal data including your profile picture. To exercise your rights or ask questions, contact us at support@neoclarity.io. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — given our seat, in particular the Office of the Commissioner for Personal Data Protection (Nicosia, Republic of Cyprus); you may equally address the supervisory authority in your own EU member state.

We store your data in the EU (Frankfurt am Main). Some of our service providers (including Supabase, Vercel, Anthropic, ElevenLabs, Resend, Sentry, Slack, Stripe, Cal.com and Close) are US companies. Where data is transferred to the USA, this is done on the basis of the EU Standard Contractual Clauses or — where the provider is certified — the EU-US Data Privacy Framework. Telegram messages go to a provider in the United Arab Emirates; this transfer only happens if you link Telegram yourself, to provide the service you requested (Art. 49(1)(b) GDPR).

We update this privacy policy when our processing or the legal situation changes. Material changes are published here with an updated effective date. The version published here is the one that applies.