This Privacy Policy explains how Tyler Seminetta ("Cleo," "we," "us," or "our") collects, uses, and shares information in connection with the Cleo application (the "Service"). It applies to Cleo's own users (people who create an account) and, separately, to the individuals whose information our users store within Cleo (their clients or project contacts), as described in Section 8.

Name, email address, password (stored in encrypted/hashed form), role, and team membership. We also keep a short internal list of the email addresses of people who create a Cleo account, together with the date each account was created. See Section 6 for how long it is kept.

Client or project records (names, industries, contract details, contacts), notes, tasks, intake messages, uploaded files, and any other content you add to the Service.

We use a session cookie to keep you signed in. We also use Vercel Web Analytics to understand how many people visit our website and app and which pages they use. It does not set cookies or use advertising identifiers; it records the page viewed, the referring site, and general details such as country, browser, operating system, and device type, and it does not let us identify you personally. One-time sign-in tokens in password-reset and invitation links are removed before a visit is recorded. We do not use third-party advertising trackers.

Cleo also keeps some things in your own browser's storage so the app works quickly and offline. It saves a copy of the app and of the workspace pages you have opened so you can read them without a connection; the saved workspace data is cleared when you sign out, when your session ends, or when a different account signs in on the same browser, and a copy more than a week old is no longer used. Changes you make while offline wait in your browser, under your account, until they can be sent to Cleo; they stay there if you sign out in the meantime, so they can still be sent when you sign back in. Your browser also keeps notepad text before it is saved, an email you are writing in Compose until you send or clear it or sign out, recently used email recipients and your email signature, your desktop-notification choice and which notifications you have already been shown, and preferences such as your theme, task filters, dashboard views, recently opened records, and the size, split and last tab of the Cleo Jr window. This storage stays on your device; it is not shared with anyone, and you can remove it at any time by clearing your browser's data for Cleo.

If you contact us, or if we send you account-related emails (like password resets or team invitations), we retain that correspondence.

Besides typing or pasting an email into the Log intake form, Cleo offers three ways to get an email into your workspace. Each is optional, and each sends the email to your own Cleo workspace and nowhere else.

Cleo for Chrome (browser extension). The extension reads the email you are viewing only when you click its "Send to Cleo" button in Gmail or open its toolbar popup. It then sends the subject, sender, date and body to your Cleo workspace through the Cleo tab it opens, where the email appears in the Log intake form for you to review before anything is saved. The extension never reads your mail in the background, makes no network requests of its own, and has no analytics. It keeps nothing after the hand-off: the email waits in Chrome's session storage only until the Cleo tab collects it, for at most 30 minutes or until that tab closes.

Cleo for Gmail (Google Workspace add-on). The add-on reads only the message open in Gmail, and only when you click "Send to Cleo". It sends the subject, sender, date and body to Cleo, together with the names of any attachments but not their contents. Cleo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Forwarding address. You can turn on a private forwarding address for your workspace (cleo-forwarding-…@in.cleopm.com) in Settings. Email you forward or send to that address is received and parsed by Resend, the email provider that already delivers Cleo's outbound mail, and handed to Cleo, which stores it as an intake draft in your workspace. Resend keeps its own copy of the message for a short period for delivery and troubleshooting. You can turn the address off, or replace it with a new one, at any time in Settings.

However an email reaches Cleo, it is handled exactly like an email pasted into the intake form: it is stored in your workspace, analyzed only by the optional AI features described in Section 4, shared only as described in Section 5, and deleted on the same terms as the rest of your content (Section 6).

We use the information above to:

If you use Cleo's optional intake-analysis feature, the text you submit (such as an intake email's subject and body) is sent to a third-party AI provider (currently Anthropic) to generate a category, urgency rating, summary, or suggested reply. We do not use your content to train third-party AI models beyond what is necessary to generate that specific output. If no AI provider is configured, this feature falls back to a local rule-based process that does not leave our infrastructure.

We do not sell your information. We share information only with:

We retain your information for as long as your account is active, or as needed to provide the Service. You can delete your account at any time from Settings. If other members of your team remain, we erase your name, email address, password, connected sign-ins, profile photo and personal settings, and delete your sessions, Ask Cleo history, dashboard layouts and feedback ratings; the records, tasks, notes and intake you worked on belong to your team's workspace, so they stay with the team, attributed to "Former member". If you use Cleo on your own, or are the last active member of your team, we permanently delete the workspace and everything in it, including uploaded files. We send a confirmation to your former email address. We may retain information where we are required to by law. Our internal sign-up list contains only the email address and creation date of each account. When you delete your account, your email address remains on that list until we remove it. You can ask us to remove it at any time by contacting us (see Section 13), and we will do so within 30 days.

We use reasonable administrative, technical, and organizational safeguards designed to protect your information, including encrypted password storage and access controls between team members. No system is completely secure, and we cannot guarantee the absolute security of your information.

Cleo's users may enter personal information about their own clients, customers, or contacts (names, emails, phone numbers, and related notes) into the Service. If you are such a person and have questions about your information, please contact the Cleo user or organization that entered it, as they control that information and are responsible for having the legal right to submit it and for responding to your requests about it. You may also contact us at anubisapplications@yahoo.com, and we will direct your request to the relevant Cleo user or respond as required by applicable law. We do not independently verify that a Cleo user has the right to submit information about you, and we are not responsible for a user's failure to have that right.

Depending on your location, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. You can update most account information directly within Cleo, or contact us at anubisapplications@yahoo.com to make a request. If you are a California resident, you may have rights under the California Consumer Privacy Act; if you are located in the European Economic Area or United Kingdom, you may have rights under the GDPR or UK GDPR. We will respond to verified requests as required by applicable law.

Cleo is not directed to individuals under 18, and we do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

Our service providers may process and store information in the United States or other countries. Where required by law, we take steps intended to provide an adequate level of protection for information transferred internationally.

We may update this Privacy Policy from time to time. We will post the updated policy with a new effective date and, for material changes, provide additional notice through the Service or by email.

Questions about this Privacy Policy can be sent to anubisapplications@yahoo.com.