Privacy Policy

Clove AI ("Clove", "we", "us") provides an AI-assisted expense tracking service at clove.ai. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. It applies to the website, web app, and any related services.

We are the data controller for the personal data described here. For privacy questions or requests, contact support@clove.360framed.com.

• Account data — email address, display name, hashed authentication credentials, and OAuth identifiers if you sign in with a third-party provider (e.g. GitHub).

• Financial entries you create — expense and income descriptions, amounts, currencies, categories, dates, tags, budgets, and notes. You control what you enter; do not enter other people's data without their consent.

• Plan and billing data — your selected plan and billing period. Card payments are processed by our payment processor; we never see or store your full card number, CVC, or banking credentials.

• Technical data — IP address, browser type, device information, and security logs (sign-in events, failed attempts), used for security and abuse prevention.

• Preferences — theme, surface style, brand colour, language (English/Indonesian), and currency settings, stored locally on your device and/or in your profile.

We process your data to: (a) operate your account and sync your data across devices; (b) parse your natural-language input with AI models to extract structured expense data; (c) generate dashboards, budgets, reports, and insights for you; (d) process subscription payments; (e) secure the Service, prevent fraud and abuse, and debug problems; (f) communicate service messages such as billing notices and material changes; and (g) comply with legal obligations.

Legal bases (where GDPR or similar laws apply): performance of contract for (a)–(d); legitimate interests for (e); legal obligation for (g); and consent for optional communications, which you can withdraw at any time.

When you type an expense in plain language, the text is sent to a third-party AI model provider to extract structured data (amount, category, date, tags). The text of your request is processed transiently to generate the result and is not used by us to train generalized AI models. We do not sell your data to AI providers, and we choose providers that contractually commit not to train on customer API data.

Your data is stored in a managed, access-controlled cloud database. Data is encrypted in transit (TLS) and at rest. Access within the database is restricted by per-user authorization rules so that one account cannot read another account's data.

We follow the principle of least privilege internally, keep audit logs of administrative access, and apply security patches promptly. No system is 100% secure; if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

We do not sell or rent your personal data, and we do not share it with third parties for their own advertising. We share data only with processors that help us run the Service, each bound by data-processing agreements, and with authorities where the law requires it.

Current processors include: Supabase Inc. (database and authentication infrastructure), Groq Inc. (AI model inference for expense parsing and chat — your input is processed transiently and not used for training), and Apple / Google (subscription billing and receipt verification — payment details are collected by the store, never by us). Each processor has committed by contract to protect your data and not use it for purposes beyond the service provided.

Your data is retained while your account is active. If you delete your account (or request deletion at support@clove.360framed.com), we delete your personal data and financial entries within 30 days, except for minimal records we must keep for legal, billing, or fraud-prevention purposes, which are kept only as long as required. Backups containing deleted data expire on a rolling schedule within 35 days.

Depending on your jurisdiction, you have the right to: access a copy of your data; correct inaccurate data; export your data in a portable format (CSV/JSON export is built into the app); delete your data; restrict or object to certain processing; and lodge a complaint with a supervisory authority.

To exercise any right, use the in-app Settings (export, delete) or email support@clove.360framed.com. We respond within 30 days and may ask you to verify your identity first.

We use strictly necessary session cookies for authentication, and local storage for your preferences (theme, style, brand colour, language). We may also use optional analytics cookies to understand how the Service is used, and optional marketing cookies to measure the effectiveness of our communications. These optional categories are inactive by default and are only enabled if you choose to accept them via our cookie banner.

We do not use advertising or cross-site tracking cookies for financial data, and we do not share your financial entries with any advertising platform.

Our processors may store data in data centres outside your country. Where data leaves a jurisdiction with data-protection laws (such as the EEA or Indonesia), we rely on appropriate safeguards such as standard contractual clauses with our processors.

The Service is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

We may update this Privacy Policy. For material changes we will give at least 30 days' notice by email or in-app notice. The "Last updated" date at the top always reflects the current version.

Privacy questions or requests: support@clove.360framed.com — or see our Contact page.