One agreement. Published, versioned, not negotiated.

Every subscription is governed by the CLEO Standard Terms (the Agreement) and an Order. The Agreement is a standard form. We publish it here, we version it, and we do not negotiate it, redline it or vary it for individual customers (clause 2.3). What changes from one customer to the next is only what the Order is designed to record: the plan, the site, the term, the fees, the approvers and a small number of elections.

Which version applies to you

The version stated on your Order governs that Order for its Initial Term. We may apply a newer version from the start of a Renewal Term by giving at least thirty days' written notice. If you object, you may terminate the affected Order with effect from the date the new version would have taken effect, and the earlier version applies until then (clause 2.5). Changes required by law or by the terms of a third-party platform may take effect on shorter notice.

The Plan Schedule is versioned separately. The version identified on your Order sets your plan's allowances and inclusions. When we increase an allowance or add an inclusion, every subscriber on that plan receives it from the new version's effective date. A reduction or withdrawal applies to an existing Order only from the start of a Renewal Term and on at least thirty days' written notice (clause 3.11).

Copies

The version you accepted is sent to you with your Subscription Confirmation and remains available on request. Earlier versions are available on request to info@regencleo.ai.

Order of precedence

If the documents conflict, Schedule 3 prevails on the processing of personal data, then the body of the Agreement, then Schedule 2, then Schedule 1, then Schedule 4, and then the Order, which prevails only in respect of the fields it is designed to record (clause 2.4). Text added to an Order outside those fields has no effect.

Version 1.0 is the first published version. Drafts issued to individual prospects earlier in 2026 were never published and have no successor. An agreement signed before 6 September 2026 continues to be governed by its own terms.

A change to commercial, liability or termination terms is a new major version (2.0). Clarifications, Schedule updates and changes required by law or by a third-party platform are minor versions (1.1). Each is listed here with its effective date, and the notice rules in clause 2.5 apply to both.

Who can accept. The Services are supplied to businesses for business purposes only (clause 2.8). The person who accepts confirms that they have authority to bind the business.

How you accept. An Order becomes binding on the earliest of three events (clause 2.2): signature of the Order by both parties, including electronic signature; clicking to accept the Agreement in the platform or in an electronic signature workflow; or using the Services after receiving the Order. Electronic signatures, click-acceptance records and platform audit logs have the same effect as handwritten signatures, consistent with the ADGM Electronic Transactions Regulations 2021 (clause 2.6).

The order portal. After a conversation with us you receive a personal link. It shows the full Agreement, which is also published above, lets you choose a plan from the published menu, takes your company details, and generates your Order Form for review. You accept by confirming your authority, accepting the Agreement and the Order, and typing your name as your signature, after verifying your email address with a one-time code. We countersign, and the completed document is emailed to both parties with an acceptance certificate. No document is edited by either side; a wrong field means a new Order.

What we record. The Order and the full text of the Agreement it references, the name, title and verified email address of the person who accepted, the statements they accepted, the date and time, the IP address and client, a cryptographic hash of the document as accepted, and the same details for our countersignature. We keep this record for the life of the subscription and for at least six years afterwards.

Our acceptance. We may decline any Order, trial request or customer, and we are not obliged to give reasons. No subscription exists until we have countersigned the Order or confirmed acceptance in writing (clause 2.7). During the first thirty days we may also end an Order if we judge that the site, sector, content requirements or working relationship are not suited to the Services, in which case we refund all fees paid under it (clause 8.5).

Purchase orders and supplier forms. We are happy to quote your purchase order number on invoices. Terms contained in a purchase order, vendor onboarding form, supplier portal or cover email are rejected and have no effect, even if we sign or process the document (clause 2.3).

Nothing on this page is legal advice. Take independent advice before you accept.

A sub-processor is a third party that processes personal data contained in Customer Data on our behalf in delivering the Services. This is the Sub-processor List referred to in Schedule 3 of the Agreement. Platforms that you connect through your own accounts, and the AI engines we query to measure your visibility, are listed separately in section 5: they process data under their own terms and are not our sub-processors, except where term S3.8 says otherwise.

Notice of changes and your right to object

We add a new sub-processor, or move an existing one to a new location, at least fifteen days before it starts processing Customer Data. We do that by updating this list and by emailing every customer that has registered for notice. To register, email info@regencleo.aiwith the subject line Sub-processor updates and the domain of your Customer Site.

Within that fifteen-day period you may object in writing on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected Order with a pro-rata refund of prepaid fees for the period after termination, as your sole remedy (term S3.7). We impose data protection obligations on every sub-processor that are in substance no less protective than Schedule 3, and we remain responsible to you for their performance.

Where we process data ourselves

Sub-processors

Transfers to a sub-processor outside a jurisdiction recognised as adequate by the ADGM Commissioner of Data Protection, or outside the EEA or the UK where those laws apply, rely on the standard contractual clauses incorporated by term S3.9. The plans column shows which subscriptions the sub-processor is used for.

Data residency regions

Customer Data at rest is stored in the cloud region agreed with you: New York, United States; London, United Kingdom; or Mumbai, India. Hosting location does not cover data processed transiently by third-party platforms, AI engines, sub-processors, crawlers, monitoring tools or content delivery networks, which may process data in other locations (term S2.15.2).

Changes to this list

This is the current list published under clause 15.2 of the Agreement. You authorise each connection through your own accounts, and each platform processes data under its own terms, which you must comply with (clause 15.1). We may add, suspend or withdraw support for any platform or AI engine where its terms, APIs, pricing, policies or availability change (clause 15.2). Charges levied by a platform are not included in the fees (clause 15.4). Anything not listed here is not supported, including TikTok and Google Business Profile.

6.1 Who we are

REGENAI CLEO, registered in Abu Dhabi Global Market under number 33929, Sky Tower, Al Reem Island, Abu Dhabi, United Arab Emirates (we, us). We operate the CLEO platform and this website. For anything in this notice, emailinfo@regencleo.ai with Privacy in the subject line. Our lead regulator for data protection is the ADGM Office of Data Protection.

6.2 Who this notice covers, and the role we play

• Visitors to this website, including anyone who runs the free Presence Scan, books a conversation or contacts us. We are the controller.
• People at our customers: administrators, Named Approvers, billing contacts and anyone who uses the platform or corresponds with us on a customer's behalf. We are the controller of your account, billing, usage and contact data (clause 14.2 of the Agreement).
• People at our prospects and suppliers, and anyone who corresponds with us. We are the controller.
• Individuals whose data appears in a customer's content, sites, accounts or monitoring, for example a customer's own customers, website visitors, and people who post or review publicly about a customer's brand. Here the customer is the controller and we are its processor under Schedule 3 of the Agreement. Section 6.5 explains what that means for you.

6.3 What we collect as a controller

We do not ask for special category data, government identifiers, payment card data or data about children, and we ask customers not to place them in the platform (clause 14.4 of the Agreement).

6.4 Why we use it, and the legal basis

You are not required by law to give us personal data. If you do not, we cannot provide the Services to your business, run a scan for you or respond to you.

6.5 Data we process on behalf of customers

When a customer subscribes, the platform processes personal data contained in the customer's content, sites, Connected Accounts and monitoring. The customer decides what the platform processes and why; we process it only on the customer's documented instructions, which are the Agreement, the Order, the Content Approval Matrix and the settings the customer configures (term S3.3). The data involved is described in term S3.2, our sub-processors in section 4, and the platforms the customer connects insection 5.

Monitoring covers public content only: search results, AI engine responses, public posts, reviews and mentions that refer to a customer's brand. We do not attempt to identify individuals beyond the public name or handle shown, and we do not build profiles of individuals for our own purposes.

If your personal data appears in a customer's content or monitoring and you want to exercise your rights, contact that customer. If you contact us instead, we will pass your request to the customer and help it respond (term S3.10).

6.6 Who we share data with

• The sub-processors and business systems listed in section 4, on contractual terms that restrict what they may do with it.
• The platforms and AI engines listed in section 5, when a customer connects them or instructs monitoring; each processes data under its own terms.
• Our group companies, for engineering, delivery and support.
• Our payment processor, banks, auditors, accountants, lawyers and insurers, to the extent they need it.
• Courts, regulators and law enforcement, where the law requires it or to protect our rights.
• A buyer or successor, if our business or the platform is sold or reorganised, on terms that protect your data.

We do not sell personal data and we do not share it with advertisers.

6.7 International transfers

We are established in the ADGM. Customer Data at rest is stored in the cloud region agreed with you: New York, United States; London, United Kingdom; or Mumbai, India (term S2.15.2). Our sub-processors process data in the locations shown in section 4. Where a transfer from the ADGM goes to a jurisdiction that the ADGM Commissioner of Data Protection has not recognised as adequate, we rely on the standard contractual clauses adopted under section 42 of the ADGM Data Protection Regulations 2021, or another safeguard those Regulations permit. Where the GDPR or the UK GDPR applies to a transfer, we rely on an adequacy decision where one exists and otherwise on the European Commission's standard contractual clauses or the UK International Data Transfer Addendum (term S3.9). You may ask us for a copy of the safeguard that applies to your data.

6.8 How long we keep data

We keep data for longer where the law requires it or where it is needed for a claim, and we delete or de-identify it when the reason for keeping it ends.

6.9 Security

We encrypt data in transit and at rest, limit access by role, require multi-factor authentication for our personnel, log and monitor access, follow secure development practices, take regular backups and review these measures periodically (term S3.6). We connect to your systems through delegated roles, keys and OAuth grants that you can revoke, not through your own credentials; the credentials and tokens we must hold are encrypted; access to them is controlled and logged; and each customer's data is kept separate from every other customer's. A summary of current measures is available to customers on request. No system is perfectly secure; if a personal data breach affects Customer Data we notify the customer without undue delay and in any event within seventy-two hours after becoming aware of it (clause 14.3).

6.10 Your rights

Subject to the law that applies to you, you may ask us to: give you access to your personal data and a copy of it; correct it; delete it; restrict how we use it; give it to you or another provider in a portable form; and stop using it where we rely on legitimate interests, including for marketing. Where we rely on consent, you may withdraw it at any time without affecting what we did before. You may also ask us not to make decisions about you based solely on automated processing.

To exercise a right, email info@regencleo.ai withPrivacy in the subject line. We may need to verify your identity. We respond without undue delay and within the period the applicable law allows: one month under the GDPR and the UK GDPR, and two months under the ADGM Data Protection Regulations 2021, each extendable where the law permits. There is no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response you may complain to theADGM Office of Data Protection. If you are in the EEA or the UK, you may also complain to your local supervisory authority.

6.11 Marketing

We send business marketing about CLEO to people who have enquired, run a scan, booked a conversation or subscribed. Every message includes an unsubscribe link, and you may opt out at any time by using it or by emailing us. We do not send marketing to a customer's approvers or users about anything other than the service they use, unless they have asked for it.

6.12 Automated decision-making and AI

The platform uses artificial intelligence to generate and edit content, to analyse pages, prompts and results, and to recommend actions. Content is published only after a Named Approver at the customer approves it, or under a Content Approval Matrix the customer has completed (clause 5 of the Agreement). We do not make decisions about individuals that produce legal or similarly significant effects by automated means alone. Content and prompts sent to AI engines and model providers are processed under those providers' commercial API terms, which prohibit the use of inputs and outputs to train their generalised models (clause 9.6, term S3.8). We do not use customer content to train our own models. If we ever propose to, we will ask the customer for explicit written opt-in first, and nothing happens without it.

6.13 Children

The platform and this website are for businesses. We do not knowingly collect personal data from anyone under eighteen, and we ask customers not to place children's data in the platform.

6.14 Changes to this notice

We update this notice when our processing changes and record the version and date at the top of this section. Where a change materially affects customers we also notify them by email. The version history for the Agreement is in section 2.

6.15 Google user data

When a customer connects Google Search Console, Google Analytics or Google Site Verification, we access, under the customer's OAuth grant: from Search Console, performance data for the connected property (queries, pages, clicks, impressions and positions), index coverage and sitemap status; from Analytics, aggregated traffic and engagement reports for the connected property; from Site Verification, the ability to add a verification record so the customer's domain can be verified. We use this data only to provide and improve the features the customer uses in CLEO: measuring presence, prioritising pages and keywords, verifying ownership and reporting. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not transfer this data to others except to provide or improve those features, to comply with the law, or with the customer's consent; we do not use it for advertising; and no person at CLEO reads it unless the customer has consented, it is needed for security or to comply with the law, or it has been aggregated and de-identified. The customer can revoke access at any time in its Google account or in the platform.

6.16 CMS and platform integrations

For WordPress we install a plugin under a least-privilege user the customer creates; the plugin applies approved changes and keeps the request log described in section 6.8. For Shopify, Wix, Webflow, Squarespace, HubSpot CMS and the other platforms listed in section 5, we use the platform's app, API or delegated access under the customer's grant. Where a platform cannot write files at the root of the site, the customer either gives us access limited to those files or applies the files we supply (term S2.2.5). We hold no more than the role or token needed, and the customer can revoke it at any time.

This website and the platform use a small number of cookies and similar technologies. Strictly necessary cookies load without consent because the site cannot work without them. Where the law that applies to you requires consent for anything else, non-essential cookies load only after you give it, and you can change your choice at any time through the cookie settings link in the footer. We do not use advertising or cross-site tracking cookies.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop the platform from working.

Information only. The pages of this website describe our services and prices. They are not an offer that you can accept by conduct; a subscription comes into existence only in the way described insection 3. Prices and plan contents may change, and the Agreement records how changes affect existing subscriptions.

The Presence Scan. The free scan reads publicly available pages of the domain you enter and returns an indicative score. It is not an audit, a warranty, a ranking prediction or professional advice, and it may be incomplete or out of date. Use it for domains you own or represent.

Content and marks. The text, design, software and data on this website belong to us or our licensors. CLEO, CLEO Orbit, Quill and Perception are names we use for our products. You may read and share pages for your own information. You may not copy, scrape, crawl or reproduce the site by automated means, except for indexing by a public search engine or AI engine that respects our robots directives, and you may not use our names or marks to suggest an endorsement.

Third-party links. Links to other sites are provided for convenience. We do not control them and are not responsible for their content or their handling of your data.

No liability for the website. To the extent the law allows, this website is provided as it is and we exclude liability for loss arising from reliance on it. Nothing on this website excludes liability that cannot be excluded by law. Liability under a subscription is governed by the Agreement, not by this section.

Law and courts. These website terms are governed by the laws of the Abu Dhabi Global Market, and the ADGM Courts have exclusive jurisdiction over any dispute about them.