Privacy Policy

Summary

• We run two kinds of processing. For our website and for merchants who use our products, we decide how data is used (we are the controller). For data about a merchant's customers ("buyers"), we work on the merchant's behalf (we are the processor, or service provider).
• If you are a buyer: we never contact you or sell your data. A merchant who uses Clue sends us their Stripe data about you so that we can help them assess fraud risk. Ask the merchant first about your data. You can also contact us.
• Within the merchant's credits and daily ceiling, the first time they open a buyer we run every lookup we have an input for: email, phone, address, IP address, and name with address. Some lookups need specific data (section 5.3).
• Installing Clue starts a data sync. We copy up to the last 12 months of the merchant's payment history from Stripe and then receive live updates, so that Clue can offer history-based features as they ship. Today's lookups do not read the synced copy. Uninstalling ends our access and we stop adding to it. We delete the synced copy within 30 days of uninstall (sections 5.3a and 7).
• We do not use the data for credit, insurance, employment, housing or tenancy decisions. Clue is not a consumer reporting agency.
• Stripe Radar data is used only for that merchant's own fraud checks.
• Stored data stays in the United States (AWS us-east-1). Our AI provider may process requests in the United States or other countries where it operates.

1. Who we are

Canonical Labs, Inc. ("GoCanonical", "we", "us"), 2261 Market Street, STE 10849, San Francisco, CA 94114, United States. Contact: support@gocanonical.com. GoCanonical currently serves US businesses and will appoint a representative before offering the service in the EU or UK, if required.

2. Our two roles

This Policy covers both. For buyer data, the merchant's own privacy notice also applies, and their instructions and our Data Processing Addendum govern our handling.

3. Website, wait-list and cookies

• We collect your email if you join the wait-list or contact us, and use it to send updates. You can unsubscribe at any time.
• We use PostHog (product analytics) to understand how the website is used. Our cookies fall into two categories: strictly necessary cookies that make the site work, and analytics cookies that help us see how the site is used.
• We do not use third-party analytics inside the Clue app.

4. Merchant users

When a merchant installs or uses a product, we collect:

• the merchant's Stripe account id and the Stripe Dashboard user id of each person who opens the app, taken from Stripe's signed request to us;
• the email address of each Stripe Dashboard user who opens the app, which the app reads from Stripe with the user_email_read permission and sends to us once per session. It is stored against that user's account and user id, with the first and last time we saw it. Stripe's signature covers the account and user id, not the email, so we treat the email as contact details the user's browser reported, not as proof of identity;
• the business's public contact details from its Stripe business profile (support email and support phone), read with the connected_account_read permission. We use them to reach the business when no user email has reached us;
• business facts from Stripe or the merchant: business name, industry code, website and product description, and any profile or policy text the merchant enters;
• a restricted Stripe API key, if the merchant chooses to give us one for optional features. It is encrypted, bound to the account, and we keep only the last four characters in clear;
• usage and telemetry: which features were opened and when, requests, AI calls (tokens and cost, not content), and credit use;
• subscription and payment records, if the merchant buys a plan or boost: the plan, its status and renewal date, invoice and payment identifiers, amounts, and credits granted and reversed. Payment card details are entered on Stripe's pages and never reach us; and
• support messages.

We use this to provide and secure the service, keep an access log for security and audit, bill plans and credits, offer support, and improve the products. We use the contact details above (the users' emails and the business's support email and phone) only to send account notices, such as plan, pricing and service changes, and to reply to support requests. We never send them to an AI model or a data vendor, never use them for marketing without separate consent, and delete them when the merchant uninstalls Clue.

4a. Payments for plans and boosts

When a merchant buys a Clue plan or boost, Stripe acts as our payment processor for that billing. The merchant enters card and billing details on Stripe's Checkout and Customer Portal pages, and Stripe holds them. We receive and keep the subscription and payment records listed above, so we can grant and reverse credits, answer billing questions and meet accounting and tax obligations. Stripe also acts as an independent controller of its own data. We do not use payment data for advertising. Sandboxes use Stripe test mode, where no money moves.

5. Buyers: what we process for merchants

5.1 Where it comes from

• The merchant's Stripe account, through the read permissions the merchant grants us, both when the merchant opens a buyer and through the data sync (section 5.3a).
• Lookups we run on the details in that data (section 5.3).
• The merchant, if they enter or confirm information (for example, marking a case as confirmed fraud).

5.2 Categories

From Stripe: name, email, phone, billing and shipping address, receipt email, customer history (tenure, payment and dispute history, refunds), card details limited to brand, last four digits, country, funding type, fingerprint and 3-D Secure result, Radar review and early-fraud-warning history, decline reasons, and an IP address where Stripe or the merchant holds one. We do not receive full card numbers, expiry dates or security codes.

From lookups: signals such as whether an email or phone looks real, old or risky, whether an address is deliverable, what public records show about ownership of an address, whether an IP address belongs to a network that hides location, and whether an email appears in known data breaches.

5.3 Purposes and lookups

Purpose: fraud and payment-risk assessment for that merchant only. We do not use buyer data for advertising, for credit, insurance, employment, housing or tenancy decisions, or as a background check.

Within the merchant's credits and daily ceiling, every lookup runs the first time a merchant opens a buyer, for each input that exists. Lookups do not run when the merchant is out of credits, at its daily ceiling, or when we have paused lookups across all accounts (stored results are shown instead). Some depend on data: the carrier check needs a first and last name, property records need a confirmed US address, and a merchant can switch a source off in settings.

We do not use any source for scoring unless it is on our sub-processor page (gocanonical.com/subprocessors).

The merchant sees derived conclusions (for example "address is deliverable", "no public ownership record found"), and in a few cases a name or value from a record shown next to the Stripe value for comparison.

5.3a Data sync

When a merchant installs Clue, their account is enrolled in our data sync. We copy up to the last 12 months of payment history from their Stripe account (charges, payment intents, refunds, disputes, events (the last 30 days, which is Stripe's limit), early fraud warnings, reviews, customers and payment methods), and then receive live updates as events happen. This data can include buyers' names, emails, phone numbers and addresses as held in Stripe.

We keep it, for that merchant only, so that Clue can match repeat customers and households from a buyer's history, make checks faster, produce signals based on history, and run features that work automatically. These history-based features are being built; today's lookups do not read the synced copy. We do not use it for any other merchant, for advertising, or for credit, insurance, employment, housing or tenancy decisions.

Uninstalling ends our access to the merchant's Stripe account and we stop adding to the synced copy. We delete the synced copy within 30 days of uninstall. See section 7.

5.4 AI processing

We use an AI model from a third-party provider (see sub-processors) to write a short summary and on-demand explanations.

• Sent: the buyer's name and addresses (the merchant's own order data), the email domain with the year it was first seen, and derived grades, counts and comparisons. For profile suggestions, the merchant's business name and website, and web search results about the business.
• Never sent: raw email addresses, phone numbers and IP addresses; licensed record values from sources (such as emails, phone numbers, addresses, social profiles, birth year, job title or company on a person record); other customers' addresses; Stripe card numbers (we never hold them).
• The verdict label is set by fixed rules, not by the model. The model cannot return a label.
• The Decision Explainer for blocked payments uses fixed rules and no AI model.

5.5 Stripe Radar data

Radar scores, levels, rule outcomes, reviews and early fraud warnings are used only as the merchant's agent, for that merchant's own fraud checks. They are not used for other merchants, not for benchmarks, and not for training models. They are part of the synced data: we stop using them on uninstall and delete them on the clock in section 7, or sooner when Stripe requires.

5.6 What we do not do

• We do not collect behavioural or biometric data (such as keystroke patterns) in the Clue app.
• We do not sell buyer data, and do not use it to advertise.
• We do not share one merchant's buyer data with another merchant.

6. Legal bases (EU/UK)

• Website and merchant users: contract (providing the service), legitimate interests (security, product improvement, fraud prevention), consent (marketing cookies and email where required), legal obligation.
• Buyer data: we process on the merchant's instructions. The merchant's basis is usually legitimate interests in preventing fraud.

7. Retention

We keep each store only as long as it is needed. Uninstall deletes the items marked "deleted on uninstall".

Buyers' raw contact details (emails, phones, addresses) are not kept in the snapshot, usage, event and log stores. They are kept in the vendor cache, the IP observations and the data sync copy, for the periods above.

8. Uninstall

When a merchant uninstalls Clue (or Stripe tells us the app was de-authorised):

• Stopped: reading the merchant's Stripe account, and adding to the synced copy.
• Deleted immediately: vendor lookup results, IP observations, merchant profile versions, the stored key, the Dashboard users' contact emails and the business support contact.
• Deleted within 30 days of uninstall: the synced copy of the merchant's Stripe data, including Radar data.
• Kept: verdict snapshots, usage records and product events, which hold Stripe object ids and hashed ids but not raw buyer contact details; the merchant's account settings, credit ledger and Terms acceptance record so a reinstall restores them.
• Kept and why: for security, audit and billing, and to let the merchant reinstall without losing settings.

9. Sharing and sub-processors

We share data only with:

• Sub-processors that host the service, provide lookups, and run the AI model, listed at gocanonical.com/subprocessors, with 30 days' notice of changes for customers who subscribe to notices;
• Stripe, as the platform we receive data from and return results through (Stripe is an independent controller of its own data);
• the merchant whose buyer data it is;
• Authorities and advisers, when the law requires or to protect rights, and in a sale or merger, under confidentiality.

We do not sell personal information or share it for cross-context behavioural advertising.

10. Your rights

If you are a buyer

The merchant is the controller of your data. Ask the merchant first about access, correction, deletion, objection or restriction. You can also contact us at support@gocanonical.com. We will tell you who the merchant is where we can, pass the request on, and help the merchant respond. We will act directly on a request about data we control (for example our website data).

Person-record opt-outs. One of our sources keeps an opt-out list. We refresh it and delete matching results from our cache at least every 30 days.

Per-person requests. We handle requests about a named buyer manually: when a merchant asks, we find and delete the lookup results and IP observations we hold for that buyer, or provide a copy, within 30 days.

EU/UK

You have rights under GDPR/UK GDPR to access, correct, delete, restrict, object, port your data, and to complain to your supervisory authority (in the UK, the ICO).

California and other US states

We act as a service provider/processor for buyer data. We do not sell or share it, and we use it only for the business purposes the merchant gives us. If you are a California resident, you have rights to know, delete, correct and opt out; requests about buyer data go to the merchant, and we help. We will not discriminate against you for exercising them.

11. International transfers

Our systems are in the United States. Stored data stays in the United States (AWS us-east-1). Our AI provider may process requests in the United States or other countries where it operates. For personal data from the EEA, UK or Switzerland, we rely on Standard Contractual Clauses and the UK Addendum, through our DPA.

12. Security

We encrypt the database at rest and in transit, limit access, separate each merchant's data, verify every request from Stripe by signature, and keep audit logs. No system is perfectly secure. We are working toward a new SOC 2 Type II report.

13. Children

Our products are for businesses, not for children. We do not knowingly process data about children under 13 (or 16 where the law requires) for our own purposes. A merchant's buyers are the merchant's customers and are their responsibility.

14. Changes

We will post changes here with a new date and, for material changes, notify merchants by email and in the product 30 days before they take effect.

15. Contact

support@gocanonical.com · 2261 Market Street, STE 10849, San Francisco, CA 94114, United States. This replaces earlier contact addresses.