Skip to content
Clarvia
Sign in

Privacy

Clarvia AS - Privacy Policy

Last updated: September 13, 2026

1. Data Controller

Clarvia AS (org. no. [org. no.]) ("Clarvia", "we", "us", "our") is the data controller responsible for the processing of your personal data. We operate the Clarvia platform at clarvia.io, which measures how often AI names you.

Contact details:
Clarvia AS
Org. no. [org. no.]
Kråketorpveien 8A
1626 Manstad, Norway
Email: post@clarvia.io

For questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, contact us at the email address above.

2. Data We Collect

We collect and process the following categories of personal data in connection with your use of the Clarvia platform:

  • Account information - your name, email address, and company name, as provided during registration or onboarding.
  • Page URLs submitted for analysis - the web page addresses you submit to Clarvia for AI-powered analysis. By submitting a URL, you represent that you have the right to authorize analysis of the content at that address.
  • AI-generated analysis results - scores, suggestions, reports, and other outputs produced by our AI analysis of your submitted URLs.
  • Usage data - credit consumption, feature usage, actions performed within the platform, and session metadata used for service delivery and abuse prevention.
  • Technical metadata - IP address, country derived from IP (geolocation), browser user-agent string, page referrer, and UTM campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). Collected automatically when you visit or use Clarvia. Used for security and abuse prevention, locale and language detection, aggregate marketing analytics, and to debug failed requests. Retained for 90 days, then purged automatically.
  • Form and survey responses - anything you enter into a form we publish, including contact forms, waitlists, surveys and pre-call questionnaires. Section 15 sets out in full what we do with these.
  • Payment information - all payment processing is handled by Stripe. Clarvia never stores, processes, or has access to your full payment card details. Stripe operates as an independent data controller for payment data under their own privacy policy.

3. Legal Basis for Processing

Under GDPR Article 6 and the Norwegian Personal Data Act (Personopplysningsloven), we process your personal data based on the following legal grounds:

  • Performance of a contract (Art. 6(1)(b)) - processing your account information, submitted URLs, and AI analysis results is necessary for performing our contract with you (i.e., delivering the Clarvia service you have subscribed to).
  • Legitimate interest (Art. 6(1)(f)) - processing usage data for platform improvement, security monitoring, fraud prevention, and anonymized analytics. Our legitimate interest in improving and securing the service does not override your fundamental rights and freedoms.
  • Consent (Art. 6(1)(a)) - optional analytics cookies are only activated with your consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
  • Legal obligation (Art. 6(1)(c)) - retaining certain financial and transactional records where required by Norwegian accounting law (Bokføringsloven) or tax regulations.

4. How We Use Your Data

We use the data we collect strictly for the following purposes:

  • Service delivery - to scrape, analyze, and score web pages you submit, and to generate reports and suggestions.
  • AI analysis - to process page content through our AI pipeline and produce actionable insights.
  • Transactional communications - to send you emails related to your account, analyses, subscription status, and service updates.
  • Platform improvement - to analyze anonymized, aggregated usage patterns to improve our product, fix bugs, and develop new features.
  • Legal compliance and security - to detect and prevent fraud, abuse, and unauthorized access, and to comply with applicable legal obligations.

We do not sell, rent, or trade your personal data to any third party. We do not use your data for advertising or profiling purposes unrelated to service delivery.

5. AI Processing and Automated Decision-Making

When you submit a URL for analysis, we scrape the publicly accessible content of that page and transmit a processed version to a third-party AI inference provider for analysis. This processing is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). The following safeguards apply:

  • Our AI inference providers do not store or retain your data after processing is complete. Content is processed in-transit only.
  • Our AI inference providers do not use API inputs to train or improve their AI models.
  • We transmit only page content relevant to analysis. Your personal account information (name, email, payment details) is never sent to the AI provider.

Automated decision-making (Art. 22 GDPR). Clarvia uses AI to generate visibility scores, content suggestions, and optimization recommendations for web pages you submit. These scores are produced through automated processing. However, they are informational and advisory in nature - they do not produce legal effects or similarly significant effects on you. The scores are intended to assist your content optimization decisions, not to replace human judgment. You are free to accept, modify, or disregard any AI-generated suggestion.

If you have questions about the logic involved in the scoring, or wish to contest a particular result, you may contact us at post@clarvia.io.

6. Third-Party Services and Sub-Processors

We rely on a small set of carefully vetted third-party services to operate Clarvia. We have entered into Data Processing Agreements (DPAs) with each processor in accordance with GDPR Article 28. The named sub-processors we use are:

  • Supabase (Supabase Inc., USA - EU infrastructure region) - managed Postgres database and authentication. Primary storage of account, project and analysis data. Data location: EU (Frankfurt, Germany). Transfer safeguard: Standard Contractual Clauses.
  • Anthropic (Anthropic PBC, USA) - AI inference for content scoring and Canvas rewrite suggestions. Under Anthropic's commercial API terms, our content is never used to train models; the provider retains API data only for a limited period for service delivery and abuse prevention, as set out in its data processing addendum. Transfer safeguard: EU-US Data Privacy Framework certification + Standard Contractual Clauses.
  • OpenAI (OpenAI OpCo LLC, USA) - AI inference for Citation Simulation (ChatGPT engine), and the fallback provider for every other AI call (scoring, rewrites, Ava) when Anthropic is unavailable. Under OpenAI's API terms, our content is not used to train models; API data is retained by the provider only for a limited period for abuse prevention, per its data processing terms. Transfer safeguard: EU-US Data Privacy Framework + Standard Contractual Clauses.
  • Google (Google Cloud / Generative AI APIs, Google Ireland Ltd.) - Gemini inference for Citation Simulation. Transfer safeguard: EU-US Data Privacy Framework + Standard Contractual Clauses.
  • Google Workspace (Google Ireland Ltd.) - hosts the forms and surveys we publish and stores the responses in Google Forms, Sheets and Drive. Receives whatever you enter into one of our forms. Transfer safeguard: EU-US Data Privacy Framework and the Standard Contractual Clauses in the Google Workspace Data Processing Amendment.
  • Perplexity (Perplexity AI Inc., USA) - AI inference for Citation Simulation (Perplexity engine). Receives the brand name and the analysis queries for the site being checked; no account data is sent. API inputs are not used for model training. Transfer safeguard: Standard Contractual Clauses.
  • Stripe (Stripe Inc., USA - Stripe Payments Europe Ltd. for EU customers) - subscription management and payment processing. Stripe acts as an independent data controller for payment data under their own privacy policy. Transfer safeguard: EU-US Data Privacy Framework.
  • Resend (Resend Inc., USA) - transactional email delivery (account, magic-link sign-in, drip sequences, scoring notifications). Transfer safeguard: Standard Contractual Clauses.
  • PostHog (PostHog EU Cloud, Frankfurt, Germany) - anonymised product analytics. Active only after explicit cookie-banner consent. Data location: EU.
  • Sentry (Functional Software Inc. dba Sentry, USA) - error monitoring and crash diagnostics. Form inputs are masked; passwords and payment data are never captured. Transfer safeguard: Standard Contractual Clauses.
  • Cloudflare (Cloudflare Inc., USA - global edge) - DNS, CDN and edge protection. Transfer safeguard: EU-US Data Privacy Framework.
  • Microsoft (Microsoft Ireland Operations Ltd., EU) - application hosting. The Clarvia web application and API run on Microsoft Azure Container Apps in the Sweden Central region, so Microsoft processes the request data that passes through the application. Data location: EU (Sweden). Transfer safeguard: EU Standard Contractual Clauses and Microsoft's Data Protection Addendum.
  • ipinfo (IPinfo.io, USA) - looks up the country and time zone of the IP address a signup came from, so onboarding emails are sent at a sensible local hour. Receives the IP address only. Transfer safeguard: Standard Contractual Clauses.
  • Fiken (Fiken AS, Norway) - accounting. Receives the invoice data the Norwegian Bookkeeping Act requires us to keep (company name, address, amounts). Data location: Norway.
  • Discord (Discord Inc., USA) - our internal operations channel. Receives operational alerts that can include the URL of a site being analysed and, for support cases, an account email address. No page content, no passwords. Transfer safeguard: EU-US Data Privacy Framework.

To subscribe to notifications of changes to this sub-processor register, email post@clarvia.io with the subject line "Sub-processor updates".

7. International Data Transfers

Your primary account data is stored within the European Union (Frankfurt, Germany). However, certain processing activities require transferring data to service providers located outside the EU/EEA, primarily in the United States.

For all transfers of personal data outside the EU/EEA, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including:

  • EU-US Data Privacy Framework - where the receiving organization is certified under the EU-US Data Privacy Framework (adequacy decision by the European Commission, July 2023).
  • Standard Contractual Clauses (SCCs) - where the Data Privacy Framework does not apply, we rely on the European Commission's Standard Contractual Clauses as the legal mechanism for the transfer.

You may request a copy of the relevant transfer safeguards by contacting us at post@clarvia.io.

8. Data Retention

We retain your data according to the following schedule:

  • Active accounts - your data is retained for as long as your subscription is active and your account is in good standing.
  • Cancelled accounts - personal data is retained for 30 days following cancellation to allow for reactivation, after which it is permanently and irreversibly deleted.
  • Analysis HTML content - raw HTML is archived after 6 months to manage storage. Scores, suggestions, and report data are retained for the lifetime of your account.
  • Request logs - the technical metadata above (IP address, request path, timing) is deleted automatically after 90 days by a scheduled job.
  • Self-service - you can download everything we hold about you, or delete your account and its data, from the Privacy section of your Account page at any time. Deletion is immediate and cascades through analyses, pages and reports.
  • Financial records - transaction and billing records may be retained for up to 5 years after the end of the financial year in which the transaction occurred, as required by Norwegian accounting law (Bokføringsloven § 13).
  • Data deletion requests - you may request full deletion of your data at any time by contacting post@clarvia.io. We will process your request within 30 days, except where retention is required by law.

Anonymized and aggregated data that cannot be used to identify you may be retained indefinitely for statistical and product improvement purposes.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven), you have the following rights regarding your personal data:

  • Right to access (Art. 15) - request a copy of the personal data we hold about you, along with information about how it is processed.
  • Right to rectification (Art. 16) - request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17) - request deletion of your personal data, subject to legal retention requirements.
  • Right to restriction of processing (Art. 18) - request that we restrict the processing of your data in certain circumstances, such as when you contest the accuracy of your data or object to our processing.
  • Right to data portability (Art. 20) - receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
  • Right to object (Art. 21) - object to our processing of your personal data where we rely on legitimate interest, including for direct marketing purposes.
  • Right to withdraw consent (Art. 7(3)) - where processing is based on consent (e.g., analytics cookies), you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
  • Right not to be subject to automated decisions (Art. 22) - you have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects on you. See Section 5 for details on how Clarvia uses automated processing.

To exercise any of these rights, email post@clarvia.io. We will respond within 30 days in accordance with GDPR Article 12. We may request verification of your identity before processing your request. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive.

10. Right to Lodge a Complaint

If you believe that our processing of your personal data violates your rights under the GDPR or Norwegian data protection law, you have the right to lodge a complaint with the supervisory authority. In Norway, the competent authority is:

Datatilsynet (Norwegian Data Protection Authority)
Postboks 458 Sentrum
0105 Oslo, Norway
Phone: +47 22 39 69 00
Website: datatilsynet.no

You may also lodge a complaint with the supervisory authority in the EU/EEA member state of your habitual residence or place of work.

11. Data Security

We implement appropriate technical and organizational measures to protect your data, including but not limited to:

  • Encryption in transit - all data is transmitted over HTTPS/TLS.
  • Database security - Row Level Security (RLS) policies ensure users can only access their own data.
  • Credential encryption - CMS API credentials and sensitive integration keys are encrypted at rest using Fernet symmetric encryption.
  • EU-hosted infrastructure - primary data storage is in the EU (Frankfurt, Germany).
  • Access controls - role-based access controls for administrative functions.

While we take commercially reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. Clarvia cannot guarantee absolute security and shall not be held liable for unauthorized access resulting from circumstances beyond our reasonable control, including but not limited to user negligence, compromised credentials, or force majeure events.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (Datatilsynet) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with GDPR Article 34, describing the nature of the breach, likely consequences, and measures taken or proposed to address it.

13. Cookies

We use the following categories of cookies:

  • Essential cookies - required for authentication sessions and locale preferences. These cannot be disabled as they are necessary for the platform to function. No consent is required for essential cookies.
  • Analytics cookies (optional) - anonymized analytics cookies are used to understand usage patterns and improve the product. These cookies are only placed with your prior consent. You may withdraw consent or opt out at any time via the cookie consent banner or your browser privacy settings.

For a complete list of cookies used on our platform, see our Cookie Policy.

14. Children

Clarvia is not intended for use by individuals under the age of 16. We do not knowingly collect, solicit, or process personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us immediately at post@clarvia.io.

15. Forms, Surveys and Other Direct Contact

This section applies to every form we publish, whatever it is called and wherever it sits: contact forms, demo and booking requests, waitlists, newsletter signups, surveys, questionnaires and feedback forms, hosted either on clarvia.io or on a third-party form service, and reached from our website, from an email, or from a link we shared. It applies whether or not you are a Clarvia customer, and it applies to forms we publish in future as much as to the ones running today.

What we collect. Only the fields the form itself shows you. Every form marks which fields are required and which are optional, and we keep the required set to what the form genuinely needs in order to do the thing you are asking for. Where a form asks who you are - name, work email, company, role - you may leave those fields blank unless the form states that they are required. We do not enrich your answers with data bought from third parties, and we do not use forms to build profiles of you.

Why we process it, and on what legal basis:

  • Replying to you and preparing for a call (Art. 6(1)(b) and Art. 6(1)(f)) - where you contact us, request a demo, join a waitlist or complete a form ahead of a booked call, we process what you send in order to answer you and to prepare for that conversation. If you are already a customer, this is performance of our contract with you. If you are not, our legal basis is our legitimate interest in responding to a business enquiry you directed at us.
  • Research and product development (Art. 6(1)(f)) - we use the substance of what you tell us, such as the questions you say your customers ask, to understand the market and to improve Clarvia. We work on aggregated or anonymised data wherever that still answers the question.
  • Anything optional (Art. 6(1)(a)) - sending you a result, adding you to a mailing list, quoting you, or naming your company in published material happens only where you ticked a box asking for it. Those boxes are never pre-ticked, each purpose has its own box, and the form works if you tick none of them. You can withdraw consent at any time by emailing post@clarvia.io, which does not affect the lawfulness of what we did before you withdrew it.

Publication. We may publish findings drawn from form and survey responses. Unless you have given specific consent to be identified, published findings are aggregated or anonymised so that neither you nor your company can be identified from them. We do not publish your answers next to your name or your company name without that separate consent.

Retention. Form and survey responses are kept for 12 months from the date you send them and are then deleted. Where a response belongs to a booked call or an open conversation, it is kept for as long as that conversation is live and then follows the same 12-month clock. Where you asked to be added to a mailing list, we keep your contact details until you unsubscribe or ask us to remove them. Aggregated or anonymised results that can no longer identify you may be kept indefinitely, as described in Section 8.

Access and deletion. Email post@clarvia.io and we will send you a copy of everything you submitted through a form, or delete it, within 30 days. You do not need a Clarvia account to ask, and you do not have to give a reason. The rights in Section 9 apply in full to data collected through a form.

Where the responses are stored. Some of our forms run on a third-party form service rather than on our own infrastructure. The provider is named in the sub-processor register in Section 6, and your responses are processed under that provider's data processing terms and the transfer safeguards recorded there.

16. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. If we make material changes that affect how we collect, use, or share your personal data, we will notify you by email at the address associated with your account at least 14 days before the changes take effect. Your continued use of Clarvia after the updated policy takes effect constitutes your acceptance of the changes. If you do not agree with the updated policy, you must discontinue use of the platform and may request deletion of your data.

17. Contact

For any questions, concerns, or requests related to this Privacy Policy or our data practices, contact us at:

Clarvia AS
Org. no. [org. no.]
Kråketorpveien 8A
1626 Manstad, Norway
post@clarvia.io

This privacy policy was last reviewed for legal compliance on April 8, 2026. This document does not constitute legal advice. Clarvia AS recommends consulting with a qualified legal professional for formal compliance assessment.

Questions about this? Write to post@clarvia.io.