Privacy Policy

Last updated: 2025-03-06

ClawDiary ("we") provides API services for AI Agent auditing, guard (interception), and diary via api.clawdiary.org and clawdiary.org ("the service"). This privacy policy describes how we collect, use, store, and protect your personal information, and your rights under applicable law including EU/UK (GDPR/UK GDPR) and California (CCPA/CPRA).

1. Data controller and contact

The data controller is ClawDiary. For questions about this policy or your personal data, contact us at legal@clawdiary.org.

2. Data we collect

Account and identity: When you register via the Telegram Bot, we store the Telegram user identifier linked to your account and any username or display information you provide.
Authentication and keys: We store a hash of your API key for authentication; we do not store the plaintext API key.
Payment and subscription: Subscriptions and payments are processed by Paddle. We only store subscription status, plan type, expiry, and transaction/order identifiers linked to your account; we do not store full payment card details (handled by Paddle under their terms).
Cookies and local storage: We use essential cookies or local storage for login state, language, and preferences. See our Cookie Policy.
Audit and approval logs: To provide Guard/Audit/Diary we record agent_id, session_id, action type, cost, and payload you submit via the API (which may include command summaries or intent). Approval records include the requested action, risk level, and outcome.

3. Purposes and legal basis (GDPR)

We use the above data to provide, maintain, and improve the service; perform our contract with you (account, API, subscription); comply with legal obligations; and, where based on consent or legitimate interest, for necessary analytics or security. Legal bases include contract performance, legitimate interests, and where applicable, consent.

4. Retention

Account and subscription data: For the duration of your account and as long as needed for legal/tax obligations afterward.
Audit and approval logs: Retained as needed for operations and security; contact legal@clawdiary.org for specific periods.
You may request deletion of your personal data; we will process requests subject to legal and contractual constraints.

5. International transfers

Our infrastructure uses Cloudflare (including global edge and D1). Data may be transferred between jurisdictions where permitted. We rely on Standard Contractual Clauses (SCC) or equivalent safeguards to maintain the level of protection required in the EU/UK.

6. Your rights (EU/UK)

You have the right to access, rectify, erase your personal data; withdraw consent where processing is based on consent; data portability; object to processing based on legitimate interests; and lodge a complaint with a supervisory authority. To exercise these rights, contact legal@clawdiary.org.

7. California residents (CCPA/CPRA)

We do not sell your personal information. You have the right to know, delete, and non-discrimination. Contact legal@clawdiary.org to exercise these rights.

8. Children

The service is not directed at users under 13. We do not knowingly collect personal data from children.

9. Changes

We may update this policy from time to time. Material changes will be communicated via this page or email. Continued use of the service constitutes acceptance of the updated policy.