Privacy Policy

1. What this policy covers

This policy covers clairn.app and the questionnaire service described on it. It does not cover websites run by others, including the Stripe checkout page you pay on, which is governed by Stripe’s privacy policy.

If we have signed a non-disclosure agreement with your company, it also applies to your materials. Our Terms of Service explain how an NDA fits with their confidentiality section.

2. Information we collect

When you visit this website

The site has no forms, accounts, analytics or advertising, and does not use cookies to track you. Like any web host, our hosting provider automatically records standard request logs: IP address, browser and device type, the page requested, the referring page and the time. These logs are used to deliver the site and protect it from abuse.

When you email us

Your name, email address, company and role, and whatever you choose to include in your message.

When you buy

Payment is taken by Stripe on its own checkout page. Stripe shares with us your name, email address, company name, billing address (sometimes only country and postal code), the tier you bought, limited card details (card brand, last four digits, expiration date, issuing bank and card country), and the IP address and approximate location the payment was made from, which Stripe shows us for fraud screening. We never see or store your full card number or security code.

When we do the work

Your materials, such as security policies, SOC 2 reports, ISO 27001 certificates, architecture notes and past questionnaires, and the deliverable we produce from them. These can contain incidental personal information, such as the names and roles of the people who own your policies. If you choose to give us a seat in your buyer’s questionnaire portal, we also hold the login for that seat.

We do not need, and ask you not to send, production access, credentials for your systems, your customers’ personal data, or regulated data such as health or payment card information. Our Terms of Service list what not to send. If something like that reaches us by mistake, we tell you and delete it.

When we contact you first

If we reach out to you about Clairn, we use business contact details that are publicly available, such as those on your company’s website. Reply asking us to stop and we will not contact you again.

3. How we use it

We use the information above only to:

• answer your questionnaire, and deliver, revise and support that work;
• reply to your inquiries and communicate with you about your order;
• tell businesses about Clairn when we think they could use it;
• take payment, issue refunds, and keep the accounting and tax records the law requires;
• keep this website running and secure; and
• comply with the law and enforce our terms.

We do not:

• sell or rent personal information to anyone;
• share it for advertising, or track you across websites;
• use your materials for any other customer’s work, or build them into templates or answer libraries used for anyone else; or
• name you as a customer, or describe your order, without your written permission.

4. No AI tools on your materials

Your questionnaire is answered by a person. We do not upload, paste or otherwise put your materials or the deliverable into any AI tool, such as a chatbot, an AI assistant built into other software, or a large language model service. We do not use your materials or the deliverable to train any AI model. Our email and storage providers process files only to provide their service to us, for example by automatically scanning incoming email for spam and malware.

If that ever changes, we will update this policy before it does, and we will not apply the change to materials you have already sent us without your written consent.

5. Who else handles your information

We use three service providers. Each handles only what it needs for its function, under its own contractual and security commitments.

• Amazon Web Services, Inc., United States. Encrypted storage for your materials and the deliverable (Amazon S3, in a US region), and hosting for this website and its request logs (AWS Amplify).
• Proton AG, Switzerland. Our email (Proton Mail), including any attachments you email to us, and the password manager that holds buyer portal logins (Proton Pass). Proton stores data in its data centers in Switzerland, Germany or Norway.
• Stripe, LLC, United States. Payments and refunds. Stripe also uses payment information for its own purposes, such as fraud prevention, under its own privacy policy.

Before we add a provider that would handle your materials, we will update this list and email customers whose materials we hold. You can object, and if we cannot accommodate the objection, you can cancel any order we have not yet delivered for a full refund, and we will delete your materials.

Beyond these providers, we share information only:

• with your buyer, directly or through its questionnaire portal, when you ask us to enter, submit or send answers to it;
• with our professional advisers, such as a lawyer, accountant or insurer, when they need it and are bound to keep it confidential;
• when the law requires it, for example in response to a subpoena or court order; or
• with a new owner if Clairn is ever sold or merged, who must keep to this policy. We will email you before that happens.

If the law requires us to disclose information, we will tell you first unless we are legally prohibited from doing so, and we will disclose no more than is required.

6. Personal information inside your materials

When your materials contain personal information about other people, such as your staff, we handle it only on your company’s instructions and only to do your work. In privacy law terms, we act as your company’s service provider or processor for that information. If someone asks us about their information in your materials, we will pass the request to you. If your company needs a data processing agreement, ask us.

7. How we protect your materials

• Apart from our providers’ systems that store or carry them, and the limited sharing described under “Who else handles your information”, only Alex Walker works on or has access to your materials: no employees, no contractors and no other customers.
• Files are stored in Amazon S3, encrypted at rest, in a separate folder for each customer, with public access blocked.
• Files we move between our work computer and AWS are encrypted in transit. Email to and from us is encrypted in transit whenever the other mail server supports it, as almost all business email services do, and Proton stores incoming mail encrypted.
• While we work, copies may also be on our work computer, which uses full-disk encryption. Customer files on it are not synced or backed up to any other service, and they follow the same deletion schedule.
• Our AWS, Proton, Stripe and domain registrar accounts, and every other online account of our own that can reach your materials or our email, are protected by multi-factor authentication. Buyer portal seats are covered in the next point.
• Buyer portal logins are kept in an encrypted password manager and used only for your order. A portal seat uses the sign-in your buyer’s portal provides, and we turn on multi-factor authentication there whenever the portal offers it.

No system is perfectly secure. If your materials are accessed, disclosed or lost without authorization, we will tell you without undue delay, and in any case within 72 hours of learning of it, unless law enforcement asks us to wait. We will tell you what we know and what we are doing about it.

8. How long we keep it

• Your materials and the deliverable: deleted 60 days after delivery, from storage, our work computer, and our inbox, including the email threads they arrived in or were sent in. If a revision or follow-up you sent within its window is still open on that day, we delete them as soon as we deliver it. If an order ends without delivery, they are deleted within 60 days of the order ending. If you send us materials and no order follows, they are deleted within 60 days of when you sent them. You can ask us to delete them sooner at any time.
• Keeping them for next time: if you ask us in writing to keep your materials and the deliverable for a future questionnaire, we keep them until you tell us to delete them. We will check with you at least once every 12 months, and delete them if you do not reply within 30 days.
• Buyer portal logins: deleted when we deliver. If a revision, follow-up or submission needs us back in the portal, you can grant access again, and we delete that login when the work is done.
• Other emails with you, such as inquiries, scheduling or billing: kept for two years after your last order or, if you have not ordered, two years after our last email.
• Business contact details we used to reach out: kept for two years after we last contacted you. If you ask us to stop, we delete them except your email address, which we keep on a do-not-contact list so we never contact you again.
• Order and payment records, such as who ordered, what, when, and any refunds: kept as long as tax and accounting law requires, generally up to seven years.
• Website request logs: kept in our AWS account by AWS Amplify for as long as the site is hosted there. We look at them only to diagnose problems or abuse.

Deleted items can take a short time to be purged from our providers’ systems.

9. Your choices and rights

Whoever you are and wherever you live, you can ask us to:

• tell you what personal information we hold about you;
• give you a copy of it;
• correct it if it is wrong; or
• delete it.

Email alex@clairn.app. We will respond, and carry out the request, within 30 days, and may need to confirm your identity first. We may still keep three things: records the law requires us to keep, such as tax records; website request logs, which our host stores as a whole and we cannot edit entry by entry; and, if you have asked us to stop contacting you, your email address on a do-not-contact list. Stripe keeps its own payment records under its privacy policy. We will tell you if any of this applies. We will not treat you differently for making a request. Requests about personal information inside a customer’s materials go to that customer, as described above.

Depending on where you live, privacy laws may give you further rights. We honor the requests above for everyone, whether or not a particular law requires it.

This site does not track you across websites, does not allow third parties to collect information about your browsing on it, and does not sell data, so there is nothing for Do Not Track or Global Privacy Control signals to switch off.

If you are in the EEA, UK or Switzerland

The controller is Alex Walker, a sole proprietor based in Pennsylvania, USA, doing business as Clairn, reachable at alex@clairn.app. Our legal bases are performing our contract with you, where you are personally our customer, and otherwise our legitimate interests: providing and getting paid for the service your company orders, corresponding with business contacts, telling businesses about our service, keeping tax and accounting records, and securing this website. You can ask us how we balanced those interests. You do not have to give us personal information, but we cannot take or complete an order without the contact details and documents we ask for. We make no decisions about you by automated means.

Besides the rights above, you can ask us to restrict how we use your information or to give it to you in a portable format, and you can object at any time to our use of it based on legitimate interests, including to our contacting you about our service.

We are based in the United States, so information you send us is received there. Your materials are stored with AWS in the United States and with Proton in Switzerland, Germany or Norway, and Stripe processes payments worldwide. AWS and Stripe are certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. If you have a complaint, tell us first; you can also complain to your local data protection authority.

10. Children

Clairn is a business service and is not directed at children. We do not knowingly collect information from anyone under 18.

11. Changes to this policy

When we change this policy we will update the effective date at the top. If a change is significant, we will email customers whose materials we hold before it takes effect. A change will never reduce the protection of materials you have already sent us without your written consent.

12. Contact

Questions or requests about this policy go to alex@clairn.app, and you will get an answer from the person who handles your files.