---
title: "Privacy Policy | Cleo"
description: "This Privacy Policy explains how we collect, use, and protect your personal data on our platform."
canonical_url: "https://usecleo.io/legal/privacy"
last_updated: 2026-08-19
meta:
  "og:description": "This Privacy Policy explains how we collect, use, and protect your personal data on our platform."
  "og:image": "https://usecleo.io/_og/s/o_5395d159fbb8cca6.png"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Privacy Policy | Cleo"
  "twitter:image": "https://usecleo.io/_og/s/o_5395d159fbb8cca6.png"
---

> Index of every page on this site: [llms.txt](https://usecleo.io/llms.txt)

**Legal**

# **Privacy Policy **

Last updated: 19 August 2026

**No AI training**

Your inputs are not used to train our own models.

**GDPR compliant**

Built to meet EU data protection requirements.

**Data secure**

Encryption, access controls & regular audits.

**You control your data**

Access, export or delete your information anytime.

## Scope & definitions

This Privacy Policy explains how collects, uses, stores, discloses and protects your personal data in connection with Cleo, being an AI-powered information, analysis, productivity, and assistance service, together with any related software, content, outputs, subscriptions, support, Site features, and ancillary paid or unpaid services made available on the website https://app.usecleo.io/ (the "Site" and the "Services").

This Privacy Policy applies to business, professional, entrepreneurial, trade, and other non-consumer users of Cleo and the Site, and to individuals acting on their behalf. Please read this Privacy Policy carefully before using the Site, registering for an account, purchasing a subscription, or otherwise using Cleo. By using the Site or Services, or by registering an account, you acknowledge the data processing practices described in this Privacy Policy.

Under Regulation (EU) 2016/679 (the General Data Protection Regulation or "GDPR"), the GDPR applies to the processing of personal data of individuals in the European Economic Area where the relevant territorial scope requirements are met, including where such processing is carried out by an organisation established outside the European Economic Area in connection with offering services to such individuals or monitoring their behaviour.

Accordingly, will process the personal data you provide in compliance with applicable data protection laws, including the GDPR where applicable. This Privacy Policy provides the information required by Article 13 of the GDPR, where applicable.

This Privacy Policy applies only to the Site, Cleo, the related restricted-area functions, subscriptions, outputs, support, and other services identified in this Policy, and does not apply to other websites, platforms, products, or services that may be accessible through links or that are provided by third parties under their own terms and notices.

For the purposes of this Privacy Policy, "Personal Data" has the meaning given in Article 4(1) GDPR and means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.

For the purposes of this Privacy Policy, "Processing" has the meaning given in Article 4(2) GDPR and means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

## Personal data we collect

We may collect the following categories of personal data and related information, depending on how you use the Site and Cleo:

\- Email address: used for account access, authentication, onboarding, account activation, service communications, billing, security matters, support responses, and, where permitted by law, marketing communications.

\- First name and surname: used for account administration, user identification, personalised communications, onboarding, support, and improving your experience of the Site and services.

\- Telephone number: optional data you may provide to facilitate communications with you, including sales, onboarding, account, billing, support, security, or other operational contact where appropriate.

\- Profile image or avatar: optional data you may upload to personalise your profile or account.

\- User prompts, chat messages, instructions, uploads and related inputs submitted through Cleo or any AI chat or interactive features: used to provide responses, generate outputs, perform analysis, drafting, summarisation, workflow assistance and other requested functionalities, and to maintain service security, compliance, abuse prevention, troubleshooting, and limited service improvement where permitted by law.

\- AI interaction data and generated outputs: including conversation history, prompts, chat transcripts, model responses, outputs, preferences, feedback, ratings, logs, and related metadata used to operate, personalise, troubleshoot, support, secure, and improve Cleo and related services.

\- Business, commercial and operational data: including information you submit about your business, services, products, customers, suppliers, operations, personnel, marketing strategy, financial assumptions, objectives, internal documents, and related materials in order to receive Cleo services, analyses, recommendations, summaries, drafts, automations, or other outputs.

\- Technical and usage data: including IP address, approximate location data, device data, browser type, log data, session data, identifiers, pages viewed, feature usage, timestamps, and information about how you use the Site, restricted area, platform, subscriptions, and Cleo features, including data used to help determine user identity, location, onboarding, billing, compliance, and service requirements.

For billing and payments:

\- Company name or full name, tax identification number, VAT number, billing address, town or city, county, postcode, country, purchase records, subscription details, and payment-related information: essential for purchases, invoicing, tax compliance, subscription administration, payment processing, fraud prevention, compliance with applicable sanctions, anti-terrorism and anti-money laundering obligations, and the provision of paid products and services, but not generally required merely to browse the Site.

For deliveries:

\- Address, town or city, county or state, postcode and country: essential for the delivery of physical products where applicable, but not generally required to use digital services.

We collect Personal Data directly from you when you complete forms, register for or access the restricted area, submit a purchase order, purchase products or services, subscribe to Cleo, submit billing information, contact sales, onboarding or support personnel, communicate with us by e-mail, messaging or telephone, interact with Cleo or other AI features, upload content, or otherwise communicate with us. We also collect certain technical and usage information automatically through the operation of the Site and services and, where permitted by law, from service providers that help us process payments, prevent fraud, support onboarding, or operate the services.

## How we use personal data

We use Personal Data for the following purposes, as applicable to the relevant relationship, transaction, subscription, or use of Cleo:

\- Email address: to provide account access, authentication, onboarding, activation, purchase confirmations, service notices, billing notices, security communications, customer support, and, where lawful, marketing communications.

\- First name and surname: to personalise communications, tailor the user experience, and administer your account.

\- Telephone number: to communicate with you regarding sales, onboarding, your account, services, billing, support, security, or other operational matters where appropriate.

\- Profile image or avatar: to personalise your profile or account.

\- Billing data: to process payments, issue invoices or receipts, comply with tax and accounting obligations, administer subscriptions and refunds, detect and prevent fraud, perform sanctions and anti-money laundering checks where required, and manage paid services, including collection or invoicing through affiliated or associated companies where disclosed in the applicable terms.

\- Delivery data: to deliver physical products where applicable.

\- User prompts, business data, operational data, chat history and related inputs: to provide AI-assisted responses, suggestions, recommendations, analysis, drafting, summarisation, workflow support, personalisation, and other requested service outputs or subscription features.

\- Support and account data: to verify your identity, respond to enquiries, provide customer care, troubleshoot issues, investigate complaints, resolve disputes, and improve service quality.

\- Compliance, trust and safety data: to enforce our terms, verify eligibility, prevent abuse, fraud, payment-card fraud, cyber fraud, unlawful or unauthorised use, misuse of outputs or services, security incidents, and other conduct that may expose us, our users, or third parties to legal, contractual, regulatory, or reputational risk, and to establish, exercise, or defend legal claims.

\- Recordings and communications data: where permitted by applicable law, to record, retain, and review conversations or communications with sales personnel, onboarding staff, support personnel, or business development representatives for service delivery, training, compliance, dispute resolution, and quality-improvement purposes.

## Who we share data with

We may disclose some or all of your Personal Data, only where necessary and proportionate, in order to comply with legal obligations, perform our contractual obligations, operate the Site and the Services, process orders and subscription payments, provide support, prevent fraud or misuse, protect our rights or the rights of others, or establish, exercise or defend legal claims, to the following categories of recipients:

1\. Employees, staff, contractors and professional advisers of who need access to the data for the purposes described in this Privacy Policy;

2\. External service providers engaged to support operational, administrative, accounting, financing, invoicing, certification, communications, hosting, analytics, onboarding, customer support, payment, subscription management, security, fraud prevention, or other business functions;

3\. Auditors, accountants, lawyers, consultants, and other independent professionals subject to duties of confidentiality who assist ;

4\. IT, cloud hosting, software, artificial intelligence and model providers, cybersecurity, data storage, communications, and infrastructure service providers;

5\. Authorities, regulators, supervisory bodies, courts, arbitrators, law-enforcement agencies, sanctions-screening or compliance counterparties, and public bodies where disclosure is required or permitted by law or reasonably necessary to protect our rights or comply with legal process;

6\. Affiliated or associated companies involved in payment collection, invoicing, receipts, finance administration, service operations, or internal business support, including where identified in the applicable terms or order process.

**Data Controller**  
, with its registered office at

**Data Protection Contact**  
For privacy-related requests, please use the support or privacy contact details made available on the Site or in your account materials. Where required by applicable law, details of any data protection representative or other relevant contact will also be made available there.

**Legal Bases for Processing**  
Depending on the circumstances, we process your Personal Data on one or more of the following legal bases: your consent; the performance of a contract with you or with the organisation on whose behalf you act, or steps taken at your request before entering into a contract; compliance with legal obligations; and our legitimate interests in operating, securing, supporting, billing for, improving, documenting and personalising the Site and the Services, using service providers including artificial intelligence and model providers where necessary to deliver requested functionalities, maintaining logs and records, preventing fraud and misuse, recording and reviewing permitted business communications, enforcing our terms, and protecting our business, users, and legal rights, provided those interests are not overridden by your rights and freedoms.

## Data retention & security

**Data Retention**  
Personal Data may be stored or processed in the United States, the European Economic Area, the United Kingdom, and in other jurisdictions where we, our affiliates, or our service providers operate. Where Personal Data is transferred outside the United Kingdom, the European Economic Area, or Switzerland, as applicable, we will ensure that appropriate safeguards are in place in accordance with applicable data protection law, including adequacy regulations or decisions, standard contractual clauses, or other lawful transfer mechanisms.

We retain Personal Data for no longer than is necessary for the purposes for which it was collected, including to provide services, maintain your account, administer subscriptions, process refunds, respond to support requests, document transactions, prompts, chat histories, outputs, logs and communications, comply with legal, tax, accounting, compliance and regulatory obligations, detect and investigate fraud or misuse, resolve disputes, enforce agreements, and protect our legitimate business interests. Retention periods may vary depending on the category of data and the nature of your relationship with us. Where data is no longer required, we will delete it or anonymise it, unless continued retention is required or permitted by law.

**Security Measures**  
We implement appropriate technical and organisational security measures designed to protect your Personal Data, taking into account the nature of the data and the risks associated with the Site, the Services, AI-enabled features, billing, and account access, including where appropriate:

\- Firewalls

\- Intrusion detection

\- Multi-factor authentication

\- Activity monitoring

\- Encryption

\- Access controls, role-based permissions, logging, testing, and safeguards intended to reduce unauthorised access, security incidents, fraud, misuse of Cleo or its outputs, and inappropriate use or disclosure of user-submitted business, operational, financial, or other sensitive information

## Your rights

Subject to applicable law, including the GDPR where applicable, you have the right to:

\- Request access to, rectification of, or erasure of your Personal Data.

\- Object to the processing of your Personal Data.

\- Request restriction of processing of your Personal Data.

\- Request portability of your Personal Data.

\- Withdraw consent previously given, where processing is based on consent.

\- Lodge a complaint with a competent data protection supervisory authority, including in the Member State of your habitual residence, place of work, or alleged infringement where the GDPR applies.

You may contact us at [support@usecleo.io](mailto:support@usecleo.io) to exercise your rights or to make any other request relating to your Personal Data.

## AI processing notice

We do not sell your Personal Data. We may share your Personal Data with third parties where necessary to provide our services, including payment providers such as Stripe, hosting and software providers, analytics providers, customer support tools, artificial intelligence and model providers, professional advisers, and where otherwise required or permitted by law.

AI-related processing and risk notice. If you submit Personal Data in prompts, messages, uploads, or other materials to Cleo, that information may be processed by automated systems, including third-party artificial intelligence or model providers acting on our behalf where necessary, to generate responses, analyses, summaries, drafts, suggestions, and other outputs. Because Cleo is an AI-powered service, outputs may be incomplete, inaccurate, outdated, biased, non-unique, or inappropriate for your purposes. You should not include personal data unless reasonably necessary for your intended use of the service, and you remain responsible for reviewing, validating, and lawfully using any output and for ensuring that you have an appropriate legal basis or authorisation to submit any personal data, confidential information, or third-party materials through the service. Unless we expressly state otherwise at the point of collection or in service-specific documentation, we do not use your prompts, uploads, or outputs to train our own general-purpose models; however, we may use such data for service delivery, security, abuse prevention, debugging, support, compliance, and limited service improvement as permitted by law. We do not ordinarily use Cleo to take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you; where that changes and applicable law requires it, we will provide any additional notice and rights information required.

## Changes & contact

**Changes to this Privacy Policy**  
We may update this Privacy Policy from time to time. Where appropriate, we will notify you of material changes by email, through your account, or by notice on our website.

**Contact Us**  
If you have any questions about this Privacy Policy, please contact us at [support@usecleo.io](mailto:support@usecleo.io).

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://usecleo.io/#website","@type":"WebSite","name":"Cleo","url":"https://usecleo.io/","publisher":{"@id":"https://usecleo.io/#identity"},"workTranslation":{"@id":"https://usecleo.io/it#website"}},{"@id":"https://usecleo.io/legal/privacy#webpage","@type":"WebPage","description":"This Privacy Policy explains how we collect, use, and protect your personal data on our platform.","name":"Privacy Policy","url":"https://usecleo.io/legal/privacy","isPartOf":{"@id":"https://usecleo.io/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://usecleo.io/legal/privacy"]}],"primaryImageOfPage":{"@id":"https://usecleo.io/#logo"}},{"@id":"https://usecleo.io/#identity","@type":"Organization","name":"Cleo","url":"https://usecleo.io","logo":{"@id":"https://usecleo.io/#logo"}},{"@id":"https://usecleo.io/#logo","@type":"ImageObject","caption":"Cleo","contentUrl":"https://usecleo.io/logo.svg","inLanguage":"en","url":"https://usecleo.io/logo.svg"}]}
```

## Sitemap

See the full [sitemap](https://usecleo.io/sitemap.md) for all pages.