Legal

Privacy Policy

How Clareefai collects, uses, stores, and protects your information, including data obtained from Google and Microsoft when you connect an email account to send messages on your behalf.

Effective date: September 30, 2026

1. Introduction

Clareefai (“Clareefai”, “we”, “us”, or “our”) operates a referral, testimonial, survey, and rewards platform that helps vendors build relationships with their promoters and prospects. This Privacy Policy describes the information we collect when you use our application, why we collect it, how we use and share it, and the choices you have. By using Clareefai you agree to the practices described here.

2. Information We Collect

We collect the following categories of information:

  • Account information. Name, email address, company name, role, and authentication identifiers (Firebase UID).
  • Workspace content you create. Promoters, prospects, meetings, surveys, testimonials, referrals, rewards, use cases, and related notes you enter into the product.
  • Email integration data. When you connect a Google, Microsoft, or SMTP email account, we receive the connected email address, an OAuth refresh token (or SMTP credentials), and the categories of outbound mail you authorize us to send.
  • Usage and technical data. Log data, device and browser information, IP address, and error reports used to diagnose problems and improve the service.
  • Third-party integration data. If you choose to connect a CRM, video-meeting, or similar third-party service, we receive the data needed to perform the integration (e.g. contacts you choose to import, meeting metadata).

3. Google User Data and Gmail API

When you choose to send platform emails from your own Gmail address, Clareefai uses Google OAuth 2.0 to request your permission. We request the following scopes:

  • https://www.googleapis.com/auth/gmail.send : to send email on your behalf from your Gmail account.
  • openid email profile : to identify the connected account and display your email address in the application.

How we use Google user data. We use the gmail.send scope solely to deliver email messages that you explicitly authorize the platform to send on your behalf: for example, promoter invitations, prospect invitations, survey invitations, referral invitations, testimonial notifications, reward notifications, meeting notifications, action reminders, and team invitations. You can enable or disable each category at any time from Settings → Email Integration.

What we do not do. We do not read your inbox, search your messages, or access any mail in your account. We do not use the gmail.readonly or gmail.modify scopes, or any other Gmail scope beyond gmail.send.

Storage. We store the OAuth refresh token issued by Google so that the platform can send messages on your behalf without re-prompting you. Tokens are stored encrypted at rest in our database and are only accessible to the backend service that performs the send.

Limited Use compliance. Clareefai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not allow humans to read it except (a) with your explicit consent, (b) for security purposes (e.g. investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for internal operations.

4. Microsoft User Data

If you connect a Microsoft 365 / Outlook account, we request the Mail.Send and User.Read scopes (along with openid email profile offline_access). The handling of Microsoft data mirrors our handling of Google data: we only send messages you have authorized, we do not read your inbox, and tokens are stored encrypted at rest.

5. CRM Integrations (HubSpot, Attio, Microsoft Dynamics 365, Salesforce)

Clareefai can connect to the customer relationship management (CRM) system a vendor uses, currently HubSpot, Attio, Microsoft Dynamics 365, and Salesforce. A CRM is connected only when a vendor chooses to connect it, using OAuth and within the permissions (scopes) the vendor grants. For data received from a connected CRM, Clareefai acts on behalf of the vendor and processes that data only on the vendor’s instructions. Depending on the CRM and the features the vendor enables, we process:

  • Contact and people records. Name, email address, phone number, company, and job title of the contacts the vendor chooses to import or link, and of referred leads that Clareefai creates in the CRM on the vendor’s behalf.
  • Notes. Notes that Clareefai writes back to a contact’s record, such as a published testimonial, a survey response, a meeting summary, or a reward payout.
  • Lists, pipelines, and stage changes. List, pipeline, and deal entries and changes to their stage, used to follow the status of referrals and to run the automations the vendor configures.
  • Meetings. Meeting records and their metadata, such as title, date, duration, and participants.
  • Call recordings and transcripts (Attio). When a vendor imports a call recorded in Attio, we retrieve the recording’s metadata and its transcript. We do not download the audio or video of the recording.

We use this data only to provide the integration features the vendor has enabled: importing promoters from the CRM, writing advocacy outcomes (such as testimonials, survey responses, meeting summaries, and rewards) back to the CRM, keeping the status of referrals in sync, and drafting use cases from customer calls. We do not sell CRM data, use it for advertising, or use it to train AI models.

6. AI Processing

Some Clareefai features use AI models provided by OpenAI, L.L.C. through its API. When a vendor imports a call from a connected CRM (such as Attio) or call-recording service, the call transcript and related call content (such as the meeting title and participant names) are sent to OpenAI to generate a summary of the call and a draft use case. OpenAI is also used for other AI-assisted features in the product, such as drafting content and the in-app assistant, using the workspace content that feature needs.

Under OpenAI’s API terms, OpenAI does not use data submitted through its API to train its models. OpenAI may retain API inputs and outputs for up to 30 days to monitor for abuse, after which they are deleted unless a longer retention is required by law. AI-generated content can be inaccurate, and vendors should review summaries and use-case drafts before publishing them.

7. How We Use Information

  • To provide, maintain, and operate the Clareefai platform.
  • To send the transactional messages you have explicitly enabled (invitations, notifications, reminders, survey requests, etc.) from your connected mail account.
  • To authenticate you and secure your account.
  • To diagnose problems, monitor reliability, and improve product features (using aggregated logs and error reports).
  • To comply with legal obligations and enforce our Terms of Service.
  • To provide the CRM integrations and AI features a vendor enables: importing promoters, writing advocacy outcomes back to the CRM, syncing referral status, and generating call summaries and use-case drafts (see Sections 5 and 6).

8. How We Share Information

We do not sell personal information. We share information only as described below:

  • Service providers (subprocessors). Infrastructure and tooling providers that process data on our behalf, in categories such as cloud hosting and file storage, managed database, authentication and real-time messaging, error monitoring, rewards payout, and AI processing (OpenAI, L.L.C.). Each provider is bound by contractual confidentiality and security obligations. We can provide the current list of subprocessors on request to support@clareefai.com.
  • AI processing. OpenAI, L.L.C. processes call transcripts and other content sent to its API to generate summaries, use-case drafts, and other AI-assisted output, as described in Section 6. OpenAI acts as our subprocessor.
  • CRM providers you connect. HubSpot, Attio, Microsoft Dynamics 365, and Salesforce are data sources connected by the customer, not subprocessors of Clareefai. When a vendor connects one of them, we exchange data with it only as the vendor instructs and within the scopes the vendor grants, as described in Section 5.
  • Recipients you choose. When you send an invitation, survey, or notification, the recipient receives the email content you generated.
  • Legal requirements. When required by law, regulation, valid legal process, or to protect the rights, property, or safety of Clareefai, our users, or others.
  • Business transfers. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

9. Data Storage and Security

Application data and files are hosted with reputable cloud providers under industry-standard security commitments. OAuth refresh tokens and SMTP credentials are encrypted at rest. All traffic between your browser and our backend is protected by TLS. Access to production systems is restricted to authorized personnel and protected by strong authentication.

10. Data Retention

We retain your account and workspace data for as long as your account is active. When you disconnect an email integration, the associated OAuth refresh token (or SMTP credentials) is deleted from our systems. When you delete your account, we delete or anonymize the associated personal data within a reasonable period, except where retention is required to comply with legal obligations, resolve disputes, or enforce our agreements.

For CRM integrations and AI features specifically:

  • OAuth access and refresh tokens for a connected CRM are encrypted at rest and are deleted immediately when the vendor disconnects the integration.
  • Clareefai does not store raw call transcripts. A transcript is retrieved from the connected service when a call is imported, sent for AI processing, and discarded once the summary and use-case draft have been generated.
  • AI-generated call summaries, use-case drafts, and contacts imported from a CRM are kept until the vendor deletes them or closes their account, and are deleted within 30 days of account closure.
  • CRM write-back job records, which contain the text of the note written to the CRM and the contact’s email address, are deleted automatically 180 days after they are created.
  • Data that Clareefai has written to the vendor’s CRM is then held under the vendor’s own agreement with that CRM provider and is not deleted by Clareefai when the integration is disconnected.

11. Your Rights and Choices

Depending on your jurisdiction, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. You can exercise most of these rights directly in the application (editing your profile, exporting data, deleting your account) or by contacting us at support@clareefai.com.

12. Revoking Access

You can disconnect Clareefai from your Google or Microsoft account at any time:

13. Children’s Privacy

Clareefai is a business tool not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page and, where appropriate, notify you through the application or by email.

15. Contact Us

Questions, requests, or complaints about this Privacy Policy or our data practices can be sent to support@clareefai.com.