What we collect, why, and who handles it.

1. Who is responsible (controller)

The Plain Works Co., Ltd. operates ClaraDB and is the controller of the personal data described here. Contact for privacy questions and requests: hello@claradb.com. Privacy contact under the Korean Personal Information Protection Act: Privacy team (개인정보보호 담당 부서), hello@claradb.com. This contact also serves supervisory authorities. If we have no establishment in the EU or UK and the law requires a representative, we will name one here.

2. What we collect, why, and the legal basis

We do not make decisions about you by automated means that have legal or similarly significant effects. Providing the data for your account is needed to use the service; giving analytics consent is optional.

3. Who processes it

Processors act on our instructions. Each has a data processing agreement with us.

Paddle is not a processor: it sells paid plans to you as merchant of record and is the controller of your payment data. The full list is on the subprocessors page.

We do not sell personal data and do not share it for cross-context behavioral advertising. We disclose data to authorities only where the law requires it.

4. International transfers

Some processors are in, or can access data from, the United States and other countries outside the EU, EEA, UK and Korea. Where the destination has no adequacy decision, the transfer relies on the European Commission's standard contractual clauses (with the UK addendum or the UK international data transfer agreement for UK data), or on the EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards. For Korean users, the table below gives the notice of overseas transfer under the Personal Information Protection Act.

How to refuse (거부 방법): do not use the service, delete your account in the account settings, or reject analytics for the PostHog transfer. Because these providers run the service, refusing the transfer to Vercel, Supabase or Resend means we cannot provide the service to you. Privacy contact (개인정보 보호 담당): Privacy team (개인정보보호 담당 부서), hello@claradb.com.

5. Analytics, cookies and your choice

• If you are in the EU, EEA, UK or Switzerland (or we cannot tell), analytics do not load until you accept. Rejecting is as easy as accepting. You can change the choice below at any time.
• If your browser sends Do Not Track or Global Privacy Control, we load no browser analytics and treat it as a rejection.
• A sample of visits is recorded as session replay. Form fields are masked, and replay does not run in the signed-in app or on sign-in pages.
• Page addresses sent to analytics have their query strings removed (only campaign tags are kept), and workspace and SKU identifiers and sign-in tokens are replaced. Event properties carry counts and ids, not email addresses or free text.
• Server-side events (sign-up, checks run, inquiries) follow the same choice. They carry your account id, not your email.

6. How long we keep it

7. Your rights

• EU, EEA, UK and Switzerland (GDPR and UK GDPR): access, correction, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time (withdrawal does not affect earlier processing). You may complain to your supervisory authority, for example the ICO in the UK or your national data protection authority in the EU.
• California (CCPA and CPRA): in the last 12 months we collected identifiers (email, IP address, device ids), commercial information you enter (SKU data) and internet activity (analytics), for the purposes in section 2. We do not sell or share personal information, and use no sensitive personal information to infer characteristics. You may ask to know, delete or correct your data, and we will not discriminate against you for asking.
• Korea (PIPA): you may ask to see, correct, delete or suspend processing of your personal information, and withdraw consent. We handle requests within 10 days.
• To use a right, write to hello@claradb.com or use the contact form. We may need to confirm your identity. Workspace owners can also export workspace data from settings.

We reply within one month (GDPR), 45 days (CCPA) or 10 days (PIPA).

8. Children

ClaraDB is for business use and is not directed at anyone under 16. We do not knowingly collect personal data from children. If you think a child has given us data, contact us and we will delete it.

9. Security

Sign-in links are single use and expire. Data is encrypted in transit. Access to workspace data is limited by membership and checked in the database. API keys are stored only as hashes. No system is perfectly secure; we will tell affected users and authorities of a personal data breach as the law requires.

10. Changes

We will update this notice when our processing changes and show the version date at the top. Material changes are announced in the app or by email. See also the terms of use.

Other legal pages

• Terms of use
• Data processing agreement
• Subprocessors
• Security and responsible disclosure
• Billing and refunds