Privacy Policy

This Privacy Policy explains how Nexa Platforms, Inc., a Delaware corporation("ClueDig," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the ClueDig website and application (the "Service"). This Policy applies to visitors, registered users, and any individuals whose information we process in the course of operating the Service (for example, digest recipients you designate). It should be read together with our Terms of Use and our AI Transparency Notice.

We do not sell your personal information, and we do not use it for third-party advertising.

(a) Information you provide directly:

• Account information: email address, password (stored by our authentication provider in hashed form, never in plain text), and, if you provide it, your name and industry.
• Competitor tracking data: the name, URL, and any optional focus notes you enter for each competitor you monitor.
• Digest and notification settings: additional digest recipient email addresses (on eligible plans), your digest schedule preference, and, if you configure it, a Slack webhook URL you control.
• Billing information: when you subscribe to a paid plan, payment card and billing details are collected and processed directly by our payment processor, Stripe, Inc. We do not receive or store your full payment card number on our own servers.
• Referral information: if you use a referral link, we store the relationship between the referring account and the referred account for the purpose of administering the referral program.
• Communications: if you contact us for support, we retain the content of that communication and our responses.

(b) Information collected automatically:

• Session and authentication data, via cookies set by our authentication provider, used to keep you signed in.
• Your selected display language, stored in your browser's local storage (not on our servers), so your preference persists across visits.
• A pending referral code, stored temporarily in your browser's local storage between the time you follow a referral link and the time you complete sign-up, so the referral can still be credited if it is not otherwise carried through the sign-up flow.
• Basic technical and usage data inherent to operating a web application (such as IP address, browser type, and request timestamps), which may be recorded in the ordinary infrastructure and security logs of our hosting and infrastructure providers.

(c) Information we do not collect on our own servers:

• We do not store the full content of the competitor web pages we fetch on your behalf. That content is used transiently to generate an analysis and is discarded once processing completes; only the resulting structured analysis (for example, the summary, pricing signal, and similar fields, or a battlecard's fields) is stored.
• We do not store your payment card number; see Section 2(a) above.

We use the information described above to:

• provide, operate, and maintain the Service, including generating AI analyses and battlecards for the competitors you submit;
• send you transactional and account-related email, including analysis results, PDF exports, and, on eligible plans, recurring digest emails and Slack notifications you have configured;
• process payments and manage your subscription through our payment processor;
• administer the referral program and any promotional discount programs;
• authenticate you and secure your account, including one-time passcode verification during sign-up and password reset;
• respond to your support requests and communicate with you about the Service;
• monitor, maintain, and improve the Service, including diagnosing technical issues; and
• detect, investigate, and prevent fraud, abuse, and violations of our Terms of Use.

To generate an analysis or battlecard, we send the publicly available content of the competitor URL you submitted, together with the competitor's name and any focus notes you provided, to Anthropic (our artificial intelligence subprocessor) for processing. We do not send your account credentials, billing information, or the email addresses of other users to this AI subprocessor as part of that request. Full detail on this process, its limitations, and Anthropic's role is available in our AI Transparency Notice.

We use the following categories of third-party service providers to operate the Service. Each processes information only as necessary to perform its function for us, under its own terms and privacy practices:

• Database, authentication, and storage — Supabase, Inc., which hosts our application database and manages account authentication.
• Payment processing — Stripe, Inc., which processes subscription payments, stores payment method details, and administers referral/promotional credits applied to invoices.
• AI processing — Anthropic, PBC, which processes competitor page content to generate analyses and battlecards, as described in Section 4.
• Transactional email delivery — Resend, which delivers analysis, digest, and account-related emails on our behalf.
• Hosting and infrastructure — Vercel Inc., which hosts the application and runs our scheduled background jobs (for example, recurring digest generation).
• Messaging integration (optional, user-configured) — if you configure a Slack webhook URL, the digest content we generate for you is transmitted directly to the Slack workspace you designate. We are not responsible for how Slack, or your own workspace administrators, subsequently handle that data.

We require our service providers to protect your information consistently with this Policy and to use it only for the purposes for which we engage them.

We use a limited set of cookies and browser local storage, none of which are used for third-party advertising or cross-site tracking:

• Authentication cookies (strictly necessary) — set by our authentication provider to keep you signed in and to protect your session.
• Local storage: language preference — your chosen display language, stored only in your browser.
• Local storage: pending referral code — a temporary record of a referral code, stored only in your browser, cleared once the referral has been recorded against your account.

Because we do not use advertising or analytics cookies that require consent under applicable law, we do not currently operate a cookie consent banner. If this changes, we will update this Policy and provide the appropriate consent mechanism.

We disclose information only in the following circumstances:

• with the service providers described in Section 5, to operate the Service;
• with a Slack workspace or digest recipient email addresses you affirmatively configure;
• if you enable a Shared Report as described in our Terms of Use, in which case the content of that specific report becomes accessible to anyone with the link, by your own choice;
• to comply with applicable law, legal process, or governmental request;
• to protect the rights, property, or safety of ClueDig, our users, or the public, including to enforce our Terms of Use;
• in connection with a merger, acquisition, financing, or sale of all or a portion of our business, in which case information may be transferred as part of that transaction, subject to standard confidentiality protections; and
• with your consent, or at your direction.

We do not sell your personal information to third parties, and we do not share it for third-party cross-context behavioral advertising.

We retain your account information for as long as your account remains active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements.

• Analysis records are retained as part of your account history for as long as the associated competitor record exists.
• On the free plan, if your single tracked competitor slot is inactive for 30 days and you add a new competitor, the prior competitor record and its associated analyses are permanently deleted at that time as part of the free plan's rolling-slot mechanism.
• Raw fetched competitor page content is never persisted; see Section 2(c).
• A Shared Report you enable remains publicly accessible indefinitely until we implement a takedown at your request, as described in our Terms of Use.

We do not currently offer a fully self-service "delete my account" control within the product. To request deletion of your account and associated personal information, contact us at hello@cluedig.com; see Section 9 below.

Depending on your location, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate information (you can also update your name and certain account details directly in Settings).
• Deletion — request that we delete your personal information, subject to legal retention requirements.
• Portability — request a copy of your information in a portable format.
• Objection or restriction — object to, or request that we restrict, certain processing of your information.
• Withdrawal of consent — where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, contact us at hello@cluedig.com. We will verify your identity before acting on the request and will respond within the time required by applicable law. You may also unsubscribe from non-essential email communications using the link provided in those emails; note that you cannot opt out of transactional emails necessary to operate the Service (for example, email verification codes or the analysis results you directly requested).

We apply technical and organizational measures designed to protect your information, including encryption of data in transit, database-level access controls that restrict each account to its own records (row-level security), and restricted internal access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and any applicable regulator as required by applicable law.

Our service providers may store and process information in the United States and other countries in which they or their subprocessors operate, currently including the region hosted by our infrastructure provider at [DATA HOSTING REGION]. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States or other countries whose data protection laws may differ from those of your home jurisdiction. Where required by applicable law, we rely on appropriate safeguards for such transfers.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), gives you the right to know what personal information we collect, use, and disclose about you; to request deletion of your personal information; to correct inaccurate personal information; and to not be discriminated against for exercising these rights. As stated above, we do not sell personal information and do not share it for cross-context behavioral advertising, so there is no "opt out of sale/sharing" action necessary. To exercise your CCPA rights, contact us at hello@cluedig.com.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, we process your personal information on the following legal bases, as applicable: performance of a contract with you (providing the Service you signed up for), our legitimate interests (such as securing and improving the Service and preventing fraud, balanced against your rights), compliance with a legal obligation, and consent where we specifically request it. You have the rights described in Section 9 above, as well as the right to lodge a complaint with your local data protection supervisory authority. [EU/UK REPRESENTATIVE OR DATA PROTECTION OFFICER CONTACT, IF APPLICABLE]

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at hello@cluedig.com and we will take steps to delete it.

Some browsers offer a "Do Not Track" signal. Because there is no common industry standard for how to interpret this signal, the Service does not currently respond to it differently than described in this Policy.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after a change becomes effective constitutes your acceptance of the revised Policy.

Questions or requests regarding this Privacy Policy may be directed to hello@cluedig.com.