1. Introduction
Desklamp, Inc., a Delaware corporation doing business as Clueso ("Clueso", "we", "us"), is committed to protecting the privacy of its users, customers and visitors. This Privacy Policy explains how we collect, use, disclose and safeguard personal information when you (a) visit clueso.io; (b) use our platform at web.clueso.io; (c) install and use our browser Extension; (d) access our hosted video player and article viewer (the "Hosting Solution"); (e) authorise the Clueso connector at connect.clueso.io, through which a third-party AI assistant acts on your Clueso workspace at your direction (the "Connector"); or (f) otherwise interact with our products and services.
Our role
For account and website data we act as a controller. For content you create and for end-user interaction data collected through the Hosting Solution on behalf of our enterprise customers, we act as a processor and the enterprise customer is the controller. Where we act as a processor, our Data Processing Agreement governs.
2. Information we collect
Information you provide
• Name, work email address and organisation when you create an account
• Account profile data shared by third-party identity providers when you sign in via SSO, including name, email and the provider-issued identifier
• Billing contact information; payment card details are provided directly to our payment processor and are not stored by us
• Records of correspondence when you contact us, and anything else you choose to provide
Recording and content data
• Screen recording data. When you initiate a recording using the Extension, we capture audio, video and, as part of an active recording session, HTML/DOM state describing the pages where you interact. The Extension remains dormant and collects nothing when not recording.
• Audio and video. Used by our AI processing pipeline to generate articles, videos and voiceovers, and transmitted to AI sub-processors for that purpose.
• HTML/DOM data. May incidentally contain text, form values or metadata visible on the pages you record. You are responsible for ensuring you have authority to record such content.
Connector data
When you authorise the Connector, an AI assistant you have chosen acts on your Clueso workspace on your behalf. We receive what that assistant sends to Clueso in order to carry out the actions you request — for example project, clip and article details, scripts and narration text, prompts describing media to be generated, and files you choose to upload through the Connector — together with the account identifiers established when you sign in and grant access.
We receive only what is submitted to Clueso for the purpose of performing a requested action. We do not access the assistant's memory, conversation history or conversation summaries, or your files held on that platform, and we do not collect conversation data beyond what is submitted to Clueso to carry out a requested action. Content submitted through the Connector is treated in the same way as content you create directly in the platform, including for the purposes of AI processing, retention and security described below.
The AI assistant you connect is operated by a third party under its own terms and privacy policy, and your use of that assistant is governed by that provider rather than by this Policy. You may withdraw the Connector's access at any time from your Clueso account or from the assistant you authorised.
Usage and operational data
We use product analytics associated with your account login email, error monitoring which may incidentally capture user identifiers in stack traces and request contexts, and customer relationship management which receives identifiers associated with form submissions and customer-success interactions. The relevant sub-processors are listed in the published sub-processor list.
Hosting Solution
The Hosting Solution collects non-personally-identifying interaction analytics — views, completion, navigation events — on behalf of our enterprise customers. No personally identifiable information is collected from end users interacting with the Hosting Solution. Customers may integrate their own analytics provider, in which case we collect no analytics for those deployments.
3. AI processing
Your content is transmitted to AI sub-processors to deliver the features you request:
• Speech-to-text — audio recordings, for transcription
• Large language models — transcripts, screenshots and document content, for article and video generation
• Text-to-speech — voiceover scripts, for AI voice synthesis
• Image, animation and video generation — prompts and any reference material describing the media to be produced
The current providers for each capability are named in the published sub-processor list.
We do not use your recordings, transcripts or content to train generalised AI models, and we contractually require the same of every AI sub-processor. We train no models of our own and maintain no training datasets. Content submitted to the platform may include incidental personal information visible on screen or audible in recordings, including that of third parties; you are responsible for ensuring you have authority to record and submit it.
4. Enterprise modules
Enterprise customers may enable additional modules under an Order Form. Where a code-connected module is enabled, Clueso reads source code from the repositories the customer authorises, using read-only access scoped to selected repositories, in order to keep the articles and videos generated for that customer in sync with their product. Source code is stored in an encrypted, isolated environment, is not used to train AI models, and is not shared other than with the AI sub-processors named in the published sub-processor list. Full details are set out in the annex to the customer's Data Processing Agreement, provided before enablement. These modules are not enabled by default and do not apply to self-serve accounts.
5. How we use information
• To provide, maintain and improve the Service
• To generate the articles, videos, voiceovers and translations you request
• To carry out the actions you request through the Connector
• To authenticate you and secure your account
• To communicate with you about the Service, including service and security notices
• To process payments and manage subscriptions
• To comply with legal obligations and enforce our terms
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
6. Legal bases for processing
Where the GDPR or UK GDPR applies and Clueso acts as a controller, we rely on the following lawful bases:
Purpose: Providing the Service to account holders, authenticating users, processing payments and managing subscriptions
Lawful basis: Performance of a contract — Article 6(1)(b)
Purpose: Securing the Service, preventing fraud and abuse, monitoring errors, and understanding product usage to improve the Service
Lawful basis: Legitimate interests — Article 6(1)(f). We balance these against your rights and you may object at any time
Purpose: Sending marketing communications
Lawful basis: Consent, or legitimate interests where permitted for existing customers. You may withdraw or opt out at any time
Purpose: Retaining accounting, tax and billing records
Lawful basis: Legal obligation — Article 6(1)(c)
Where Clueso acts as a processor for an enterprise customer — for content you create and for end-user data collected through the Hosting Solution — the lawful basis is established by that customer as controller, not by Clueso.
7. Disclosure
• Service providers and sub-processors performing services on our behalf, including AI processing, cloud hosting, payment processing, error monitoring and analytics. All are bound to confidentiality and to process only for the disclosed purpose. Current list: the published sub-processor list.
• Integrations you enable, at your direction, into your own tenant on a third-party platform.
• AI assistants you connect. Where you authorise the Connector, the data described in section 2 is exchanged with the AI assistant you have chosen, at your direction and for as long as that authorisation remains in effect, so that it can carry out the actions you request and return the results to you. That provider processes it under its own terms and privacy policy.
• Legal requirements — where required by law, or to protect rights, safety or property, or in connection with legal process. Where we receive a request for customer data we notify the customer unless legally prohibited.
• Corporate transactions — in connection with a merger, acquisition or sale of assets, subject to equivalent protections.
8. Retention
Audio, video and HTML data associated with your recordings is retained for the duration of your subscription and for thirty (30) days following account closure or deletion of the relevant content, after which it is securely deleted from our systems and, to the extent technically feasible, from those of our sub-processors. Generated outputs remain part of your account content. Account and billing records are retained as required for accounting, tax and legal purposes. Product analytics and error-monitoring data are retained no longer than necessary for the purposes in the lawful-bases section and in line with the retention settings of the relevant sub-processor.
9. Security
We maintain administrative, technical and physical safeguards including encryption at rest (AES-256) and in transit (TLS 1.2 or higher), role-based access control, tenant isolation by organisation, logging and monitoring, and a documented incident response process. Clueso is SOC 2 Type II certified and ISO/IEC 27001 certified. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. International transfers
Customer content and the stores holding it are localised to the region the customer selects: Mumbai (ap-south-1), Frankfurt (eu-central-1) or California (us-west-1). Account identity data — name, work email and organisation, containing no customer content — is held in a single global store. Where an enterprise module processes data in a different location, that location is stated in the applicable annex to the customer's Data Processing Agreement.
Transfers of personal data from the EEA, UK or Switzerland to the United States, including to our AI sub-processors, are made in reliance on the EU Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum where applicable. Because our AI sub-processors are US-based services, content is transferred outside its storage region at the AI processing step. Copies of the relevant clauses are available to customers on request from privacy@clueso.io.
11. Your rights
Depending on where you live you may have rights to access, correct, delete, port or restrict processing of your personal information, to object to processing, and to withdraw consent. Where Clueso acts as a processor for an enterprise customer, please direct your request to that customer; we will assist them in responding. Otherwise, contact privacy@clueso.io. We will respond within the period required by applicable law and will not discriminate against you for exercising a right. You may also lodge a complaint with your supervisory authority.
12. California privacy rights
This section applies to California residents under the California Consumer Privacy Act as amended by the CPRA.
Category collected: Identifiers — name, work email, organisation, account and SSO identifiers, IP address
Source: You, your employer, your identity provider
Business purpose: Providing and securing the Service
Category collected: Commercial information — subscription and billing records
Source: You and our payment processor
Business purpose: Processing payments, managing subscriptions
Category collected: Internet or network activity — product usage, error and diagnostic data
Source: Your use of the Service
Business purpose: Operating, securing and improving the Service
Category collected: Audio, visual and similar information — recordings, transcripts and generated media
Source: Content you create or upload
Business purpose: Generating the articles, videos and voiceovers you request
Category collected: Professional information — role and employer where you provide it
Source: You
Business purpose: Support and customer success
We disclose these categories to the service providers and sub-processors described in Section 7 for the business purposes stated. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16.
We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA, so the right to limit its use does not apply.
Your rights. California residents may request to know the categories and specific pieces of personal information we hold, to delete it, and to correct inaccuracies. You may exercise these rights by contacting privacy@clueso.io. An authorised agent may submit a request on your behalf with written permission and proof of identity. We will verify your request against information already in our records and will not discriminate against you for exercising a right.
Where Clueso processes personal information on behalf of an enterprise customer, that customer is the business and Clueso is a service provider; direct your request to them and we will assist.
13. Cookies
We use strictly necessary cookies for authentication and session management, and analytics cookies to understand product and website usage. Where required by law, we ask for your consent before setting analytics cookies, and you may withdraw it at any time. You can also control cookies through your browser settings; disabling strictly necessary cookies will prevent the platform from functioning.
14. Children
The Service is not intended for anyone under 18 and we do not knowingly collect personal information from children. If we learn we have, we will delete it promptly. Contact privacy@clueso.io.
15. Marketing communications
We identify commercial messages as such, include our physical address, honour opt-out requests promptly, and include an unsubscribe mechanism in every marketing email. Service and security notices are not marketing and cannot be opted out of while your account is active.
16. Sub-processors
A current, maintained list of Clueso sub-processors — including those used for internal business operations such as customer relationship management, email delivery, error monitoring and product analytics — is named in the published sub-processor list.
Before engaging a new sub-processor we assess its security posture, certifications, data-residency arrangements and contractual commitments, and execute a written data processing agreement. The published list is kept current, and changes are posted there. Customers who have entered into our Data Processing Agreement receive advance notice of sub-processor changes and may object, on the terms set out in that agreement.
17. Contact
Desklamp, Inc. d/b/a Clueso1111B S Governors Ave #90974, Dover, DE 19904, USAprivacy@clueso.io