Privacy Policy

klerc is a CRM platform for service businesses: CRM and records, an omnichannel inbox, forms and chatbots, calendars and scheduling, pipelines, tasks and notes, invoices, workflow automation, broadcasts and templates, dashboards and reports, a knowledge base, Molly AI and agents, and a REST API with app integrations. The service is provided by Stribe Inc., [registered address] (“klerc”, “we”, “us”).

“You” means anyone whose personal data we handle: people who visit klerc.co, people who sign up and use the product, and people whose details our customers keep in klerc.

We play two different roles, and the difference decides who you should ask about your data.

• Controller — for data about our own relationship with you: your account, support conversations, and how you use klerc.co and the product. We decide why and how that data is used.
• Processor — for workspace data: everything an organisation puts into klerc or connects to it — records, contacts, conversations, tasks, notes, calendar events, files, form submissions and chatbot sessions. That data belongs to the organisation (our customer), which is its controller. We process it on the organisation's instructions, to run the service for them.

If a business stores your details in klerc — say you messaged it on WhatsApp and landed in its inbox — that business is responsible for your data. Contact it first; we'll help it respond.

• Account data. Name, work email, organisation and role, plus what we need to secure sign-in: email one-time codes and the devices you mark as trusted.
• Workspace content. The objects, records, pipelines, tasks, notes, calendar events, files, documents, spreadsheets, forms and their submissions, chatbot sessions, message templates, broadcasts, reports and AI agent threads your organisation creates or imports — including any personal data inside them.
• Connected-account data. When an admin connects an email, messaging, social-DM, calendar, payments or other app through integrations, we receive the messages, contacts, events and metadata that account makes available, and the access tokens that let klerc act for you. Those tokens are stored encrypted.
• Usage and device data. IP address, browser and device details, the features you use, and security events — sign-ins, exports, record changes and denied access attempts, which also go into your organisation's audit log.
• Communications. What you send us when you book a demo, email us or ask for help.
• Cookies. klerc.co and the console use only the cookies needed to keep you signed in, protect forms from abuse and remember essential preferences. We don't use advertising cookies and run no third-party analytics today; if that changes, this policy and our cookie controls will change first.

• To provide the service your organisation asked for: storing records, delivering messages through the channels you connect, running workflows, chatbots, forms and broadcasts, creating the tasks and reminders you set up, and answering questions put to Molly and your AI agents.
• To keep it secure: authentication, two-factor sign-in, rate limiting, abuse prevention and the audit log.
• To support you and keep you informed: onboarding and migrations you ask for, early-access updates, and notice of changes such as the launch of paid plans.
• To improve klerc: learning which features are used and where things break, using aggregated or de-identified data wherever we can.
• To meet legal obligations and enforce our Terms of Service.

We don't sell personal data. klerc doesn't train AI models on workspace content. [Confirm before launch]

Molly and AI agents run on the model provider your organisation chooses — currently OpenAI, Anthropic, Google, or providers available through OpenRouter — and you can switch at any time. When someone uses an AI feature, the prompt and the workspace data needed to answer it are sent to that provider to generate a response: the results of a query Molly runs, a conversation being drafted, or the knowledge-base items an agent is allowed to see.

• Your own key. Organisations can use their own API keys; that provider's agreement with you then also governs the processing.
• Included models. During early access, model usage is included within fair-use limits, through klerc's own provider accounts.
• Permissions still apply. Molly and agents act through the same permission checks as the person using them, and every change Molly proposes waits for a person to confirm it.
• Voice. Voice notes are transcribed, and replies can be read aloud, using speech models.

AI output can be wrong. Treat it as a draft, and check anything that matters before you rely on it.

We share personal data only with the parties needed to run the service, and only what they need:

• Infrastructure providers that host and store data, run our databases, search and analytics systems, and serve the site.
• Email delivery providers that send sign-in codes and notifications, and the emails you send through klerc.
• The AI model providers your organisation selects, as described above.
• Third-party platforms you authorise — WhatsApp, Gmail, Instagram and the other apps you connect through integrations. When klerc sends a message or acts in a connected app for you, that platform receives the data under its own terms.
• Professional advisers, and authorities where the law requires it or to protect rights and safety.
• A successor organisation, if klerc is part of a merger or acquisition — with notice to you.

We'll publish our list of subprocessors [before general availability] and give customers notice before we add a new one.

klerc and its providers may process data outside the country where you live. When personal data leaves the UK, the EEA or another place with transfer rules, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions. [Primary hosting region to be confirmed.]

• Account data — while your account is active, then deleted or anonymised within [period], unless the law requires us to keep it longer.
• Workspace data — for as long as your organisation keeps it in klerc. Records are soft-deleted by default: deleting one marks it deleted so it can be recovered, and it's permanently removed [when purged / within period]. When an organisation leaves, it can export everything first; we then delete its workspace data within [period].
• Audit log — security and access events are kept for 45 days.
• Backups — [backup retention period].
• Communications with us — [period].

• Encryption in transit, and encrypted storage for third-party OAuth tokens and secrets.
• Two-factor sign-in with email one-time codes, and trusted devices that expire after 30 days and can be revoked.
• Relationship-based access control — roles, teams, per-record sharing and field-level permissions — enforced the same way in the app, the query engines and the API.
• Scoped API tokens, hashed at rest, that never exceed the live permissions of the person behind them.
• An append-only audit log of sign-ins, exports, record changes and denied attempts.
• Rate limits on sign-in and API endpoints.

No system is perfectly secure. If a breach affects personal data we're responsible for, we'll notify affected customers — and regulators, where required — without undue delay.

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to how it's used, to receive it in a portable form, and to withdraw consent.

• UK and EEA (UK GDPR and GDPR) — all of the above, and the right to complain to your data protection authority. [EU and UK representatives, if required.]
• India (Digital Personal Data Protection Act, 2023) — the right to information about your data, to correction and erasure, to grievance redressal, and to nominate someone to exercise your rights. [Grievance officer contact to be added.]
• California and other US states — the right to know, correct and delete personal information, and not to be treated differently for using these rights. We don't sell personal information or share it for cross-context behavioural advertising.

To use any of these rights, email support@klerc.co. If your data sits in a customer's workspace, we'll pass your request to that organisation, which decides as controller. Admins can also export records — to CSV or through the REST API and SOQL — and delete them directly in klerc.

klerc is a business tool for adults. We don't knowingly collect personal data from children; if you think we have, tell us and we'll delete it.

We'll update this policy as the product changes. We'll announce material changes in the product or by email before they take effect, and the date at the top always shows the current version.

Questions, requests or complaints: support@klerc.co. By post: Stribe Inc., [registered address]. [Data protection officer, if appointed.]