Privacy Policy

CLEO is operated by Regenerative AI ("RegenAI", "we", "us"). This policy explains what personal data we process, why, and the rights you have.

This policy covers personal data processed through the CLEO platform and the regencleo.ai website. For most client data we process, our client is the data controller and CLEO acts as a data processor under our agreement with them; for website visitors and account holders, we act as the controller.

This policy also covers the Cleo for WordPress plugin. When a customer installs that plugin on their own website, it sends us technical details of requests made to that website so we can identify which AI systems are reading it. In that situation the customer is the controller of their visitors' data and Cleo acts as their processor. Customers are responsible for describing their use of Cleo in their own privacy notice.

Website visitor data (Cleo for WordPress)

Where a customer has installed our WordPress plugin, we receive the following for each request made to their website: the date and time, the HTTP method and response status code, the hostname and page path (with the query string removed), the visitor's IP address, the User-Agent and Referer headers, and how long the page took to generate.

We do not receive cookies, form contents, usernames, passwords, email addresses, comment text, or the content of any page. Requests to administrative areas of the customer's site are excluded and never sent.

IP addresses are not retained. An IP address is used at the moment of receipt for a single purpose: to check it against IP ranges that AI companies publish for their crawlers, which is the only reliable way to tell a genuine crawler from software falsely claiming to be one. Once that check is complete the address is discarded. We store only an irreversible keyed hash of it, from which the original address cannot be recovered, and which exists so that repeat visits can be counted without identifying anyone.

We process personal data to provide and secure the platform, to publish and analyse content on your instruction, to manage your account and billing, to communicate with you, and to meet legal obligations.

We do not allow your content to train third-party AI models. AI providers are used only on paid, commercial API terms under which client inputs and outputs are not used for model training; we do not use free tiers that would permit it.

We do not train our own models on your campaigns without your explicit opt-in. If we ever offer this, you will be asked first and may decline while continuing to use CLEO in full.

CLEO's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our use and transfer of information received from Google APIs fully complies with that policy.

Specifically, our use of data complies with the "Limited use of user data" requirement as outlined in the Google Workspace API User Data and Developer Policy.

Our application uses the following Google API scopes:

Affirmative statement. All Google user data accessed by CLEO is used solely for providing and improving the user-facing features of our application. We will never use Google user data for serving advertisements, transfer it to third parties for advertising purposes, or sell it to any third party.

Google Search Console data. We access performance data (search queries, impressions, clicks, average position), crawl and indexing data (crawl errors, sitemaps, index status), and website property management (adding and removing sites, and managing users where write access is used). This is used to give you insight into your website's search performance, identify SEO opportunities and issues, help you monitor your site's health and visibility on Google Search, and let you manage your Search Console properties directly through our application.

Google Analytics data. We access audience data (demographics, interests, geography), acquisition data (traffic sources, campaigns), behaviour data (page views, session duration, event tracking), conversion data (goals, e-commerce transactions), and account management (creating and managing accounts, properties, and views). This is used to provide insight into website and app performance, analyse user behaviour, generate reports and dashboards, let you manage your Analytics setup within our application, and create and configure new Analytics properties on your behalf.

Google Site Verification data. We access site verification data to verify ownership of websites on your behalf within Google services and to manage existing verifications. This streamlines verifying your website with Google services that require ownership verification, for example adding a site to Search Console.

Notwithstanding anything else in this policy, if you give CLEO access to your Google data, your use of our features is subject to these additional restrictions:

We share personal data only with the subprocessors needed to run the service: our cloud provider, managed data store, identity provider, payments provider, AI content providers, search-data vendors, and telemetry/monitoring, each bound by a data-processing agreement. We do not sell personal data.

We adhere strictly to Google's policies concerning the transfer of information received from Google APIs. We will only transfer Google user data to others if necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets. We will never sell or rent your Google user data.

Production data is hosted in the cloud region agreed with each client; available regions include the United States of America (New York), Australia (Sydney), the United Kingdom (London), and India (Mumbai). Where data is processed outside your jurisdiction, each recipient is bound by a data-processing agreement holding it to equivalent standards, designed to support cross-border obligations under regimes such as the UK/EU GDPR and the Australian Privacy Principles.

We keep personal data for as long as needed to provide the service and to meet legal, accounting, and security obligations, after which it is deleted or anonymised. Project deletion cascades across our system of record.

Detailed website request records collected through the Cleo for WordPress plugin are kept for 30 days and then deleted automatically. Aggregated daily counts, which contain no page-level or visitor-level detail, are kept for as long as the customer's account is active so that historical trends remain available.

Google user data is retained only for as long as needed to provide the features you have connected it to, and its use remains subject to the restrictions set out in Limits on our use of Google data above. Disconnecting a Google account removes our stored access to it.

Depending on your jurisdiction, you may have the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent. To exercise any of these, contact us at the address below and we will respond within the time required by law.

We protect personal data with delegated identity, application-layer encryption of sensitive credentials, encryption in transit and at rest, controlled egress, and tenant isolation. See our Security page for detail.

CLEO is a business platform and is not directed at children. We do not knowingly collect personal data from children.

We will post any changes here and update the effective date. Material changes will be communicated to account holders.

Questions or requests: contact@regencleo.ai