Privacy Policy

1. Introduction

Desklamp, Inc., a Delaware corporation doing business as Clueso (“Clueso”, “we”, “us”), is committed to protecting the privacy of its users, customers and visitors. This Privacy Policy explains how we collect, use, disclose and safeguard personal information when you (a) visit clueso.io; (b) use our platform at web.clueso.io; (c) install and use our browser Extension; (d) access our hosted video player and article viewer (the “Hosting Solution”); (e) authorise the Clueso connector at connect.clueso.io, through which a third-party AI assistant acts on your Clueso workspace at your direction (the “Connector”); or (f) otherwise interact with our products and services.

Our role

For account and website data we act as a controller. For content created in the Service, and for end-user data collected through the Hosting Solution, we act as a processor on behalf of our customer — the organisation that holds the Clueso account — which is the controller. Where we act as a processor, the applicable Data Processing Agreement governs. Our standard Data Processing Agreement applies automatically to every paid plan.

2. Information we collect

Information you provide

• Name, work email address and organisation when you create an account
• Account profile data shared by third-party identity providers when you sign in via SSO, including name, email and the provider-issued identifier
• Billing contact information; payment card details are provided directly to our payment processor and are not stored by us
• Records of correspondence when you contact us, and anything else you choose to provide

Recording and content data

• Screen recording data. When you initiate a recording using the Extension, we capture audio, video and, as part of an active recording session, HTML/DOM state describing the pages where you interact. The Extension remains dormant and collects nothing when not recording.
• Audio and video. Used by our AI processing pipeline to generate articles, videos and voiceovers, and transmitted to AI sub-processors for that purpose.
• HTML/DOM data. May incidentally contain text, form values or metadata visible on the pages you record. You are responsible for ensuring you have authority to record such content.

Connector data

When you authorise the Connector, an AI assistant you have chosen acts on your Clueso workspace on your behalf. We receive what that assistant sends to Clueso in order to carry out the actions you request — for example project, clip and article details, scripts and narration text, prompts describing media to be generated, and files you choose to upload through the Connector — together with the account identifiers established when you sign in and grant access.

We receive only what is submitted to Clueso for the purpose of performing a requested action. We do not access the assistant’s memory, conversation history or conversation summaries, or your files held on that platform, and we do not collect conversation data beyond what is submitted to Clueso to carry out a requested action. Content submitted through the Connector is treated in the same way as content you create directly in the platform, including for the purposes of AI processing, retention and security described below.

The AI assistant you connect is operated by a third party under its own terms and privacy policy, and your use of that assistant is governed by that provider rather than by this Policy. You may withdraw the Connector’s access at any time from your Clueso account or from the assistant you authorised.

Usage and operational data

We use product analytics associated with your account login email, error monitoring which may incidentally capture user identifiers in stack traces and request contexts, and customer relationship management which receives identifiers associated with form submissions and customer-success interactions. The relevant sub-processors are listed in the published sub-processor list.

We also collect device and log data automatically when you use the Service or visit our website, including IP address, browser type and device information.

Hosting Solution

The Hosting Solution collects interaction analytics — views, completion, navigation and search events — and the technical data needed to deliver content, including IP address, on behalf of our customers, who are the controllers of that data. We do not ask viewers of hosted content for their names or contact details. Where a customer signs its viewers in, the identifiers the customer supplies are associated with those viewers’ analytics. Customers may integrate their own analytics provider, in which case we collect no analytics for those deployments.

3. AI processing

Your content is transmitted to AI sub-processors to deliver the features you request:

• Speech-to-text — audio recordings, for transcription
• Large language models — transcripts, screenshots and document content, for article and video generation
• Text-to-speech — voiceover scripts, for AI voice synthesis
• Image and avatar generation — prompts and reference material describing the media to be produced and, for avatar video, the voiceover script or audio

To monitor the quality and cost of AI features, model inputs and outputs on some paths are also recorded by our LLM observability provider. The current providers for each capability, including LLM observability, are named in the published sub-processor list.

We do not use your recordings, transcripts or content to train generalised AI models, and we contractually require the same of every AI sub-processor. We train no models of our own and maintain no training datasets. Content submitted to the platform may include incidental personal information visible on screen or audible in recordings, including that of third parties; you are responsible for ensuring you have authority to record and submit it.

4. Enterprise modules

Enterprise customers may enable additional modules under an Order Form. These modules are not enabled by default and do not apply to self-serve accounts. Full details of each are set out in its annex to the customer’s Data Processing Agreement, made available on or before enablement.

Code-Connected Content Generation

Clueso reads source code from the repositories the customer authorises, using read-only access scoped to selected repositories, in order to keep the articles and videos generated for that customer in sync with their product. Source code is stored in an encrypted, isolated environment, is not used to train AI models, and is not shared other than with the AI sub-processors named in the published sub-processor list.

Automated Recording

Clueso drives a browser against a non-production environment the customer nominates and records product workflows, which it turns into articles and videos. Page state, screenshots and navigation context from those runs are processed by the sub-processors named for that module in the published sub-processor list. Production systems and production customer data are not accessed.

5. How we use information

• To provide, maintain and improve the Service
• To generate the articles, videos, voiceovers and translations you request
• To carry out the actions you request through the Connector
• To authenticate you and secure your account
• To communicate with you about the Service, including service and security notices
• To process payments and manage subscriptions
• To comply with legal obligations and enforce our terms
• To measure and improve our marketing, including advertising on other websites (see Section 13)

We do not sell personal information for money. The marketing cookies on our website may amount to “selling” or “sharing” personal information under California law; Section 12 explains this and how to opt out.

6. Lawful bases for processing

Where the GDPR or UK GDPR applies and Clueso acts as a controller, we rely on the following lawful bases:

Where Clueso acts as a processor for an enterprise customer — for content you create and for end-user data collected through the Hosting Solution — the lawful basis is established by that customer as controller, not by Clueso.

7. Disclosure

• Service providers and sub-processors — performing services on our behalf, including AI processing, cloud hosting, payment processing, error monitoring and analytics. All are bound to confidentiality and to process only for the disclosed purpose. Current list: the published sub-processor list.
• Integrations you enable — at your direction, into your own tenant on a third-party platform.
• Advertising and analytics partners — through the cookies on our website described in Section 13, subject to your cookie choices.
• AI assistants you connect — where you authorise the Connector, the data described in Section 2 is exchanged with the AI assistant you have chosen, at your direction and for as long as that authorisation remains in effect, so that it can carry out the actions you request and return the results to you. That provider processes it under its own terms and privacy policy.
• Legal requirements — where required by law, or to protect rights, safety or property, or in connection with legal process. Where we receive a request for customer data we notify the customer unless legally prohibited.
• Corporate transactions — in connection with a merger, acquisition or sale of assets, subject to equivalent protections.

8. Retention

Audio, video and HTML/DOM data associated with your recordings is retained for the duration of your subscription and for up to thirty (30) days following account closure or deletion of the relevant content, after which it is securely deleted from our systems and, to the extent technically feasible, from those of our sub-processors. Generated outputs remain part of your account content. Account and billing records are retained as required for accounting, tax and legal purposes. Product analytics and error-monitoring data are retained no longer than necessary for the purposes in Section 6 and in line with the retention settings of the relevant sub-processor. Website cookies are kept for the periods set out in our Cookie Policy.

9. Security

We maintain administrative, technical and physical safeguards including encryption at rest (AES-256) and in transit (TLS 1.2 or higher), role-based access control, tenant isolation by organisation, logging and monitoring, and a documented incident response process. Clueso holds a SOC 2 Type II report from an independent CPA firm and is certified to ISO/IEC 27001. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

Customer content and the stores holding it are localised to the region the customer selects: Mumbai (ap-south-1), Frankfurt (eu-central-1) or California (us-west-1). Account identity data — name, work email and organisation, containing no customer content — is held in a single global store. Where an enterprise module processes data in a different location, that location is stated in the applicable annex to the customer’s Data Processing Agreement.

Transfers of personal data from the EEA, UK or Switzerland to the United States, including to our AI sub-processors, are made in reliance on the EU Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum where applicable. Because our AI sub-processors are US-based services, content is transferred outside its storage region at the AI processing step. Copies of the relevant clauses are available to customers on request from privacy@clueso.io.

11. Your rights

Depending on where you live you may have rights to access, correct, delete, port or restrict processing of your personal information, to object to processing, and to withdraw consent. Where Clueso acts as a processor for a customer, please direct your request to that customer; we will assist them in responding. Otherwise, contact privacy@clueso.io. We will respond within the period required by applicable law and will not discriminate against you for exercising a right. You may also lodge a complaint with your supervisory authority.

12. California privacy rights

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”).

We disclose these categories to the service providers and sub-processors described in Section 7 for the business purposes stated.

Selling and sharing

In the preceding twelve (12) months, the marketing cookies on our website have made identifiers (such as cookie identifiers and IP address) and internet activity on our website (such as pages viewed) available to advertising, analytics and visitor-identification partners, including Google, Meta and LinkedIn. Under the CCPA this may be a “sale” of personal information or “sharing” for cross-context behavioural advertising. We do not sell or share the content you create in the Service, or personal information we process on behalf of our customers. We do not knowingly sell or share the personal information of consumers under 16.

You can opt out of this selling and sharing at any time: choose Cookie preferences in the footer of our website and turn off Marketing. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of selling and sharing for that browser, keep Marketing off, and show that the request has been honoured in Cookie preferences.

We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA, so the right to limit its use does not apply.

Your rights

California residents may request to know the categories and specific pieces of personal information we hold, to delete it, to correct inaccuracies, and to opt out of its sale or sharing. You may exercise these rights by contacting privacy@clueso.io. An authorised agent may submit a request on your behalf with written permission and proof of identity. We will verify your request against information already in our records and will not discriminate against you for exercising a right. We keep each category of personal information for the periods described in Section 8.

Where Clueso processes personal information on behalf of an enterprise customer, that customer is the business and Clueso is a service provider; direct your request to them and we will assist.

13. Cookies

We use strictly necessary cookies for authentication and session management. On our website we also use analytics cookies, to understand how the site is used (including session recording), and marketing cookies, which measure our campaigns and partner referrals, show you relevant ads on other websites, and tell us which companies and people are interested in Clueso.

In the EEA, the UK and Switzerland we set analytics and marketing cookies only with your consent. Elsewhere they are on by default, except that a Global Privacy Control signal keeps marketing cookies off. Wherever you are, you can change your choice at any time from Cookie preferences in the footer of our website. Our Cookie Policy lists each provider and what it stores. You can also control cookies through your browser settings; disabling strictly necessary cookies will prevent the platform from functioning.

14. Children

The Service is not intended for anyone under 18 and we do not knowingly collect personal information from children. If we learn we have, we will delete it promptly. Contact privacy@clueso.io.

15. Marketing communications

We identify commercial messages as such, include our physical address, honour opt-out requests promptly, and include an unsubscribe mechanism in every marketing email. Service and security notices are not marketing and cannot be opted out of while your account is active.

16. Sub-processors

Clueso’s sub-processors — including those used for internal business operations such as customer relationship management, email delivery, error monitoring and product analytics — are named in the published sub-processor list.

Before engaging a new sub-processor we assess its security posture, certifications, data-residency arrangements and contractual commitments, and execute a written data processing agreement. The published list is kept current, and changes are posted there. Customers covered by our Data Processing Agreement, which applies automatically to every paid plan, receive notice of sub-processor changes and may object, on the terms set out in that agreement.

17. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, where the changes are material, notify you by email or in-product before they take effect.

18. Contact

Desklamp, Inc. d/b/a Clueso
1111B S Governors Ave #90974, Dover, DE 19904, USA
privacy@clueso.io