Privacy Policy

Clustea ("we", "us", "our") is operated by Salhi Ahmed, 73 rue Palestro, 26100 Romans-sur-Isère, France. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights under the General Data Protection Regulation (GDPR) and applicable French law. By using the Service, you acknowledge this policy.

1. Data We Collect

Account data

When you create an account, we collect your email address, hashed password, subscription plan, and usage counters (articles generated, projects created). This data is necessary to provide the Service.

Content data

Domains, keywords, content clusters, and articles you create are stored to power the Service and display your history. You retain full ownership of this content.

Payment information

Billing is handled entirely by Stripe. We do not see, store, or process your full card number, CVV, or banking details. We receive from Stripe only your subscription status, plan, and billing email for account management purposes.

Usage data

We collect page views, feature usage events, session duration, browser type, operating system, and error logs. This data is used to improve the Service and diagnose technical issues. It is collected via PostHog and Google Analytics 4 (GA4).

Technical data

IP address, HTTP headers, and device identifiers may be collected automatically by our infrastructure provider (Vercel) for security and performance monitoring.

2. Purposes and Legal Bases

We process your personal data for the following purposes and on the following legal bases:

• Contract performance — to provide, operate, and maintain the Service; to process payments; to send transactional emails (account confirmation, password reset, subscription receipts).
• Legitimate interest — to detect and prevent fraud and abuse; to improve the product based on aggregated usage patterns; to maintain the security and integrity of our systems.
• Consent — to place non-essential cookies (analytics, A/B testing) where required by applicable law. You may withdraw consent at any time via our cookie settings.
• Legal obligation — to comply with applicable French law, including accounting and tax obligations.

3. Data Retention

We retain your personal data for as long as your account is active. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g., billing records are retained for 10 years under French accounting law). Anonymized or aggregated usage data may be retained indefinitely for analytical purposes.

4. Sub-processors and International Transfers

We use the following third-party service providers ("sub-processors") to operate the Service. Some of these are located in the United States. International transfers to the US are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) where applicable:

• Vercel Inc. (USA) — hosting and infrastructure. 440 N Barranca Ave 4133, Covina, CA 91723.
• Supabase Inc. (USA) — database and authentication. Data stored in EU region (eu-west-2) where selected.
• Stripe Inc. (USA) — payment processing. Subject to Stripe's own privacy policy and PCI DSS compliance.
• Anthropic PBC (USA) — AI article generation. Your keyword inputs and domain context are sent to Anthropic's API to generate content.
• Resend Inc. (USA) — transactional email delivery.
• PostHog Inc. (USA/EU) — product analytics and session recording.
• Google LLC (USA) — website analytics via Google Analytics 4.
• DataForSEO — keyword and SEO data provider.

We do not sell your data to third parties. We do not use your content to train AI models.

5. Cookies

We use cookies and similar tracking technologies. Essential cookies (authentication session) are strictly necessary for the Service to function. Analytics and A/B testing cookies require your consent. For a full list of cookies, see our Cookie Policy.

6. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request correction of inaccurate or incomplete data.
• Right to erasure — you may request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to data portability — you may request your data in a structured, machine-readable format.
• Right to restriction of processing — you may request that we limit how we use your data in certain circumstances.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email contact@clustea.com. We will respond within 30 days. You also have the right to lodge a complaint with the French data protection authority (CNIL) at www.cnil.fr.

7. Security

We implement industry-standard security measures: HTTPS/TLS for all data in transit, bcrypt-hashed passwords, AES-256-GCM encryption for sensitive credentials (e.g. WordPress application passwords), and row-level security on the database. No system is 100% secure — please use a strong, unique password and enable two-factor authentication where available.

8. Children

The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The current version is always available at this URL.

10. Contact and Data Controller

The data controller responsible for your personal data is:

Salhi Ahmed — Clustea
73 rue Palestro, 26100 Romans-sur-Isère, France
Email: contact@clustea.com