Skip to content
Clarvia
Check my site

Legal

Privacy

Clarvia AS - Privacy Policy

Last updated: October 20, 2026

1. Data Controller

Clarvia AS (org. no. 936201520) ("Clarvia", "we", "us", "our") is the data controller responsible for the processing of your personal data. We operate the Clarvia platform at clarvia.io, which measures how often AI names you.

Contact details:
Clarvia AS
Org. no. 936201520
Kråketorpveien 8A
1626 Manstad, Norway
Email: post@clarvia.io

For questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, contact us at the email address above.

2. Data We Collect

We collect and process the following categories of personal data in connection with your use of the Clarvia platform:

  • Account information - your name, email address, and company name, as provided during registration or onboarding.
  • Page URLs submitted for analysis - the web page addresses you submit to Clarvia for AI-powered analysis. By submitting a URL, you represent that you have the right to authorize analysis of the content at that address.
  • AI-generated analysis results - scores, suggestions, reports, and other outputs produced by our AI analysis of your submitted URLs.
  • Usage data - usage against your plan's limits, feature usage, actions performed within the platform, and session metadata used for service delivery and abuse prevention.
  • Technical metadata - your IP address and the address, time and result of each request, recorded in our server logs when you visit or use Clarvia. Used for security and abuse prevention and to debug failed requests. Retained for 90 days, then deleted automatically. When you accept a legal document in the app, such as our data processing agreement, we also record your browser's user-agent string and a one-way hash of your IP address as evidence of that acceptance.
  • Form and survey responses - anything you enter into a form we publish, including contact forms, waitlists, surveys and pre-call questionnaires. Section 15 sets out in full what we do with these.
  • Payment information - all payment processing is handled by Stripe. Clarvia never stores, processes, or has access to your full payment card details. Stripe operates as an independent data controller for payment data under their own privacy policy.

3. Legal Basis for Processing

Under GDPR Article 6 and the Norwegian Personal Data Act (Personopplysningsloven), we process your personal data based on the following legal grounds:

  • Performance of a contract (Art. 6(1)(b)) - processing your account information, submitted URLs, and AI analysis results is necessary for performing our contract with you (i.e., delivering the Clarvia service you have subscribed to).
  • Legitimate interest (Art. 6(1)(f)) - processing usage data for platform improvement, security monitoring, fraud prevention, and pseudonymised analytics. Our legitimate interest in improving and securing the service does not override your fundamental rights and freedoms.
  • Consent (Art. 6(1)(a)) - optional analytics cookies are only activated with your consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
  • Legal obligation (Art. 6(1)(c)) - retaining certain financial and transactional records where required by Norwegian accounting law (Bokføringsloven) or tax regulations.

4. How We Use Your Data

We use the data we collect strictly for the following purposes:

  • Service delivery - to scrape, analyze, and score web pages you submit, and to generate reports and suggestions.
  • AI analysis - to process page content through our AI pipeline and produce actionable insights.
  • Transactional communications - to send you emails related to your account, analyses, subscription status, and service updates.
  • Platform improvement - to analyze pseudonymised, aggregated usage patterns to improve our product, fix bugs, and develop new features.
  • Legal compliance and security - to detect and prevent fraud, abuse, and unauthorized access, and to comply with applicable legal obligations.

We do not sell, rent, or trade your personal data to any third party. We do not use your data for advertising or profiling purposes unrelated to service delivery.

5. AI Processing and Automated Decision-Making

When you submit a URL for analysis, we scrape the publicly accessible content of that page and transmit a processed version to a third-party AI inference provider for analysis. This processing is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). The following safeguards apply:

  • Our AI inference providers keep API inputs and outputs only for a limited period, for service delivery and abuse prevention, as set out for each provider in Section 6.
  • Our AI inference providers do not use API inputs to train or improve their AI models.
  • We transmit only page content relevant to analysis. Your personal account information (name, email, payment details) is never sent to the AI provider. What you type to Ava, Clarvia's assistant, is sent to the AI provider so that it can answer.

Automated decision-making (Art. 22 GDPR). Clarvia uses AI to generate visibility scores, content suggestions, and optimization recommendations for web pages you submit. These scores are produced through automated processing. However, they are informational and advisory in nature - they do not produce legal effects or similarly significant effects on you. The scores are intended to assist your content optimization decisions, not to replace human judgment. You are free to accept, modify, or disregard any AI-generated suggestion.

If you have questions about the logic involved in the scoring, or wish to contest a particular result, you may contact us at post@clarvia.io.

6. Third-Party Services and Sub-Processors

We rely on a small set of carefully vetted third-party services to operate Clarvia. We have entered into Data Processing Agreements (DPAs) with each processor in accordance with GDPR Article 28. The named sub-processors we use are:

  • Supabase (Supabase Inc., USA - EU infrastructure region) - managed Postgres database and authentication. Primary storage of account, site, scan and measurement data. Data location: EU (Frankfurt, Germany). Transfer safeguard: Standard Contractual Clauses.
  • Microsoft (Microsoft Ireland Operations Ltd., EU) - application hosting, file storage and key vaults on Microsoft Azure in the Sweden Central region. The Clarvia web application, API and background jobs run on Azure Container Apps, so Microsoft processes the request data that passes through them. Azure Storage holds page copies, report PDFs, account exports and database backups; Azure Key Vault holds the website credentials you give us; our server logs are kept in Azure for 90 days. Azure OpenAI models read page text to extract facts and to run the free check, and stand in for Anthropic when it is unavailable; these calls use an EU Data Zone deployment, so the processing stays in the EU. The ChatGPT measurement (an OpenAI model on Azure) uses a global deployment, which Microsoft may process in any of its regions; it receives the tracked questions, not account data. Data location: EU (Sweden). Transfer safeguard: EU Standard Contractual Clauses and Microsoft's Data Protection Addendum.
  • Anthropic (Anthropic PBC, USA) - AI inference (Claude) for scoring pages, writing fixes and content, Ava, Clarvia's assistant, and the Claude measurement, in which Claude answers your tracked questions with web search. Receives page text, brand facts, tracked questions and what you type to Ava. Under Anthropic's commercial API terms, our content is never used to train models; the provider retains API data only for a limited period for service delivery and abuse prevention, as set out in its data processing addendum. Transfer safeguard: EU-US Data Privacy Framework certification + Standard Contractual Clauses.
  • Google (Gemini API, Google Ireland Ltd.) - Gemini inference for the Gemini measurement (Gemini answers your tracked questions with Google Search grounding), for suggesting questions to track, and for image generation. Receives the brand name, facts about the site and the tracked questions; no account data is sent. Transfer safeguard: EU-US Data Privacy Framework + Standard Contractual Clauses.
  • Google Workspace (Google Ireland Ltd.) - hosts the forms and surveys we publish and stores the responses in Google Forms, Sheets and Drive. Receives whatever you enter into one of our forms. Transfer safeguard: EU-US Data Privacy Framework and the Standard Contractual Clauses in the Google Workspace Data Processing Amendment.
  • Perplexity (Perplexity AI Inc., USA) - AI inference for the Perplexity measurement. Receives the brand name and the tracked questions for the site being checked; no account data is sent. API inputs are not used for model training. Transfer safeguard: Standard Contractual Clauses.
  • Stripe (Stripe Inc., USA - Stripe Payments Europe Ltd. for EU customers) - subscription management and payment processing. Stripe acts as an independent data controller for payment data under their own privacy policy. Transfer safeguard: EU-US Data Privacy Framework.
  • Resend (Resend Inc., USA) - email delivery (account emails such as sign-up confirmation and password reset, reports, and notifications about your sites). Transfer safeguard: Standard Contractual Clauses.
  • PostHog (PostHog EU Cloud) - product analytics with a pseudonymous browser identifier. Used only after you accept analytics cookies in the cookie banner. Data location: EU.
  • Sentry (Functional Software Inc. dba Sentry, USA) - error monitoring for our servers and for the app and website in your browser. Configured not to send personal data by default (no cookies, no user details) and without session recording. Data location: EU (Germany). Transfer safeguard: Standard Contractual Clauses.
  • Cloudflare (Cloudflare Inc., USA) - DNS for our domains, and the Turnstile bot check on public forms (the free check, sales enquiries and partner applications). Turnstile receives the visitor's IP address and browser signals. Transfer safeguard: EU-US Data Privacy Framework.
  • Fiken (Fiken AS, Norway) - accounting. Receives the invoice data the Norwegian Bookkeeping Act requires us to keep (company name, address, amounts). Data location: Norway.
  • Discord (Discord Inc., USA) - our internal operations channel. Receives operational alerts that can include the URL of a site being analysed and, for support cases, an account email address. No page content, no passwords. Transfer safeguard: EU-US Data Privacy Framework.

Better Stack checks from outside that our public addresses answer; it receives no customer or visitor personal data, so it is not a sub-processor.

To subscribe to notifications of changes to this sub-processor register, email post@clarvia.io with the subject line "Sub-processor updates".

7. International Data Transfers

Your primary account data is stored within the European Union: the database in Frankfurt, Germany, and the application, files and backups in Sweden. However, certain processing activities require transferring data to service providers located outside the EU/EEA, primarily in the United States.

For all transfers of personal data outside the EU/EEA, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including:

  • EU-US Data Privacy Framework - where the receiving organization is certified under the EU-US Data Privacy Framework (adequacy decision by the European Commission, July 2023).
  • Standard Contractual Clauses (SCCs) - where the Data Privacy Framework does not apply, we rely on the European Commission's Standard Contractual Clauses as the legal mechanism for the transfer.

You may request a copy of the relevant transfer safeguards by contacting us at post@clarvia.io.

8. Data Retention

We retain your data according to the following schedule:

  • Active accounts - your data is retained for as long as your subscription is active and your account is in good standing.
  • Cancelled accounts - personal data is retained for 30 days following cancellation to allow for reactivation, after which it is permanently and irreversibly deleted.
  • Page copies, scans and answers - the copies of your pages we take when we check them are deleted 30 days after they are taken. Scan history (scores, findings and fixes) and the snapshots that let you undo a published change are kept for 24 months. The AI answers we record for your tracked questions are kept for 12 months. Scheduled jobs delete older records every night.
  • Request logs - the technical metadata above (IP address, request path, timing) is deleted automatically after 90 days.
  • Backups - nightly database backups are deleted automatically after 35 days, so data deleted from the service is gone from every backup within 35 days after that.
  • Self-service - you can download everything we hold about you, or delete your account and its data, from the Privacy section of your Account page at any time. Deleting your account starts 30 days in which you can restore it; after that, the account and its analyses, pages and reports are deleted permanently.
  • Financial records - transaction and billing records may be retained for up to 5 years after the end of the financial year in which the transaction occurred, as required by Norwegian accounting law (Bokføringsloven § 13).
  • Data deletion requests - you may request full deletion of your data at any time by contacting post@clarvia.io. We will process your request within 30 days, except where retention is required by law.

Anonymized and aggregated data that cannot be used to identify you may be retained indefinitely for statistical and product improvement purposes.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven), you have the following rights regarding your personal data:

  • Right to access (Art. 15) - request a copy of the personal data we hold about you, along with information about how it is processed.
  • Right to rectification (Art. 16) - request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17) - request deletion of your personal data, subject to legal retention requirements.
  • Right to restriction of processing (Art. 18) - request that we restrict the processing of your data in certain circumstances, such as when you contest the accuracy of your data or object to our processing.
  • Right to data portability (Art. 20) - receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
  • Right to object (Art. 21) - object to our processing of your personal data where we rely on legitimate interest, including for direct marketing purposes.
  • Right to withdraw consent (Art. 7(3)) - where processing is based on consent (e.g., analytics cookies), you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
  • Right not to be subject to automated decisions (Art. 22) - you have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects on you. See Section 5 for details on how Clarvia uses automated processing.

To exercise any of these rights, email post@clarvia.io. We will respond within 30 days in accordance with GDPR Article 12. We may request verification of your identity before processing your request. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive.

10. Right to Lodge a Complaint

If you believe that our processing of your personal data violates your rights under the GDPR or Norwegian data protection law, you have the right to lodge a complaint with the supervisory authority. In Norway, the competent authority is:

Datatilsynet (Norwegian Data Protection Authority)
Postboks 458 Sentrum
0105 Oslo, Norway
Phone: +47 22 39 69 00
Website: datatilsynet.no

You may also lodge a complaint with the supervisory authority in the EU/EEA member state of your habitual residence or place of work.

11. Data Security

We implement appropriate technical and organizational measures to protect your data, including but not limited to:

  • Encryption in transit - all data is transmitted over HTTPS/TLS.
  • Database security - Row Level Security (RLS) policies ensure users can only access their own data.
  • Credential protection - the credentials you give us to publish to your website are stored in a dedicated Azure Key Vault for customer-supplied secrets, separate from our own platform secrets, and never in the application database. Per-workspace envelope encryption of these credentials (an AES-256-GCM data key for each workspace, wrapped by a key held in Azure Key Vault) is built but not yet switched on in production.
  • EU-hosted infrastructure - the database is in the EU (Frankfurt, Germany); the application, files, backups and logs are in the EU (Sweden).
  • Access controls - role-based access controls for administrative functions.

While we take commercially reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. Clarvia cannot guarantee absolute security and shall not be held liable for unauthorized access resulting from circumstances beyond our reasonable control, including but not limited to user negligence, compromised credentials, or force majeure events.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (Datatilsynet) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with GDPR Article 34, describing the nature of the breach, likely consequences, and measures taken or proposed to address it.

13. Cookies

We use the following categories of cookies:

  • Essential cookies - required for authentication sessions and locale preferences. These cannot be disabled as they are necessary for the platform to function. No consent is required for essential cookies.
  • Analytics cookies (optional) - a pseudonymised analytics cookie, holding a random identifier rather than your name or email, is used to understand usage patterns and improve the product. These cookies are only placed with your prior consent. You may withdraw consent or opt out at any time via the cookie consent banner or your browser privacy settings. Once you accept analytics cookies, we also note which website or AI assistant sent you (the address of the site, not the page) and any campaign tags in the link, to learn which channels bring visitors. If you decline, this is not noted.

For a complete list of cookies used on our platform, see our Cookie Policy.

14. Children

Clarvia is not intended for use by individuals under the age of 16. We do not knowingly collect, solicit, or process personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us immediately at post@clarvia.io.

15. Forms, Surveys and Other Direct Contact

This section applies to every form we publish, whatever it is called and wherever it sits: contact forms, demo and booking requests, waitlists, newsletter signups, surveys, questionnaires and feedback forms, hosted either on clarvia.io or on a third-party form service, and reached from our website, from an email, or from a link we shared. It applies whether or not you are a Clarvia customer, and it applies to forms we publish in future as much as to the ones running today.

What we collect. Only the fields the form itself shows you. Every form marks which fields are required and which are optional, and we keep the required set to what the form genuinely needs in order to do the thing you are asking for. Where a form asks who you are - name, work email, company, role - you may leave those fields blank unless the form states that they are required. We do not enrich your answers with data bought from third parties, and we do not use forms to build profiles of you.

Why we process it, and on what legal basis:

  • Replying to you and preparing for a call (Art. 6(1)(b) and Art. 6(1)(f)) - where you contact us, request a demo, join a waitlist or complete a form ahead of a booked call, we process what you send in order to answer you and to prepare for that conversation. If you are already a customer, this is performance of our contract with you. If you are not, our legal basis is our legitimate interest in responding to a business enquiry you directed at us.
  • Research and product development (Art. 6(1)(f)) - we use the substance of what you tell us, such as the questions you say your customers ask, to understand the market and to improve Clarvia. We work on aggregated or anonymised data wherever that still answers the question.
  • Anything optional (Art. 6(1)(a)) - sending you a result, adding you to a mailing list, quoting you, or naming your company in published material happens only where you ticked a box asking for it. Those boxes are never pre-ticked, each purpose has its own box, and the form works if you tick none of them. You can withdraw consent at any time by emailing post@clarvia.io, which does not affect the lawfulness of what we did before you withdrew it.

Publication. We may publish findings drawn from form and survey responses. Unless you have given specific consent to be identified, published findings are aggregated or anonymised so that neither you nor your company can be identified from them. We do not publish your answers next to your name or your company name without that separate consent.

Retention. Form and survey responses are kept for 12 months from the date you send them and are then deleted. Where a response belongs to a booked call or an open conversation, it is kept for as long as that conversation is live and then follows the same 12-month clock. Where you asked to be added to a mailing list, we keep your contact details until you unsubscribe or ask us to remove them. Aggregated or anonymised results that can no longer identify you may be kept indefinitely, as described in Section 8.

Access and deletion. Email post@clarvia.io and we will send you a copy of everything you submitted through a form, or delete it, within 30 days. You do not need a Clarvia account to ask, and you do not have to give a reason. The rights in Section 9 apply in full to data collected through a form.

Where the responses are stored. Some of our forms run on a third-party form service rather than on our own infrastructure. The provider is named in the sub-processor register in Section 6, and your responses are processed under that provider's data processing terms and the transfer safeguards recorded there.

16. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. If we make material changes that affect how we collect, use, or share your personal data, we will notify you by email at the address associated with your account at least 14 days before the changes take effect. Your continued use of Clarvia after the updated policy takes effect constitutes your acceptance of the changes. If you do not agree with the updated policy, you must discontinue use of the platform and may request deletion of your data.

17. Contact

For any questions, concerns, or requests related to this Privacy Policy or our data practices, contact us at:

Clarvia AS
Org. no. 936201520
Kråketorpveien 8A
1626 Manstad, Norway
post@clarvia.io

This privacy policy was last reviewed for legal compliance on April 8, 2026. This document does not constitute legal advice. Clarvia AS recommends consulting with a qualified legal professional for formal compliance assessment.

Questions about this? Write to post@clarvia.io.