1. Who is responsible
- Controller
- Cultioo Inc. (provider of Clurno)
- Address
- 8 The Green, Dover, DE 19901, United States
- Privacy contact
- support@cultioo.com · contact form
When you use Clurno to process personal data of other people (for example contacts, leads or customers in your files and chats), you decide why and how that data is processed, and we process it on your behalf.
2. Data we process
- Account data: email address or phone number, name, and — if you sign in with Google — your Google account ID and profile picture. One-time sign-in codes are stored only as a hash.
- Workspace data: your Dots and their settings, goals, tasks, chats, rooms, meetings, contacts, settings and other content you create in the app.
- Files: documents you send to your Dots (for example invoices or contracts) and text extracted from them.
- Messenger data: if you link Telegram or WhatsApp, your chat ID or phone number, display name, and the messages exchanged with your Dots. Voice messages are transcribed to text.
- AI keys: API keys you connect for AI providers, stored encrypted.
- Billing data: billing details (name, optional company, address, country, optional VAT ID, invoice email), subscription status and invoices. Card data is handled by Stripe; we never receive your full card number.
- Contact requests: what you send us through the contact form or by email.
- Technical data: IP address, browser type, time of requests and error logs, created when you use the Service.
3. Purposes & legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service: accounts, sign-in, storing your workspace, running your Dots, messenger replies | Contract (Art. 6(1)(b)) |
| Payments, invoices, bookkeeping | Contract; legal obligation (Art. 6(1)(b), (c)) |
| Security, abuse prevention, rate limits, error analysis | Legitimate interests (Art. 6(1)(f)) |
| Answering support and contact requests | Contract or legitimate interests |
| Optional features you switch on (for example linking a messenger or connecting an AI provider) | Contract; your request |
We do not use your data for advertising, we do not sell or “share” it for cross-context behavioral advertising, and we do not make decisions with legal effect about you based solely on automated processing.
4. AI processing
To answer you, the relevant parts of your request — your message, recent chat history, the Dot’s instructions and matching excerpts from its knowledge files — are sent to an AI model:
- by default to Google Gemini via Vertex AI (the model included in your plan);
- or, if you connected your own key, to the provider you chose (for example OpenAI, Anthropic, Mistral and others). That provider then processes the data under its own terms and privacy policy.
We do not use your content to train AI models. Under Google’s terms for Vertex AI, Google does not use this data to train its models either.
5. Service providers
We use the following providers to run the Service. They process data on our behalf and only for the stated purpose.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Secret Manager) | Backend and database hosting | EU (Belgium) |
| Google Firebase Hosting | Delivering the website and app | Global CDN |
| Google Vertex AI (Gemini) | Included AI model, voice transcription | Google Cloud |
| Google Sign-In | Optional sign-in with Google | USA / global |
| Stripe | Payment processing, subscriptions | USA / EU |
| Resend | Sending sign-in codes, invoice emails, contact messages | USA |
| Twilio | Sending sign-in codes by SMS (if you use a phone number) | USA |
| Telegram | Messenger chats with your Dots (if you link Telegram) | Telegram’s infrastructure |
| Meta (WhatsApp Business Platform) | Messenger chats with your Dots (if you link WhatsApp) | USA / global |
| AI providers you connect | Running your Dots with your own key | Depends on provider |
| Google Fonts, cdnjs (Cloudflare), jsDelivr | Fonts and open-source libraries loaded by your browser; they receive your IP address | Global CDN |
6. International transfers
Cultioo Inc. is based in the United States, and some providers process data outside your country. Where the GDPR applies, transfers outside the EEA/UK rely on adequacy decisions (such as the EU-U.S. Data Privacy Framework, where the recipient is certified) or on the European Commission’s Standard Contractual Clauses.
7. Retention
- Account, workspace, files and messenger messages: until you delete them or delete your account.
- Sign-in codes: 10 minutes. Sessions: until you sign out or they expire.
- Invoices and the billing details printed on them: as long as tax and accounting laws require (generally up to 10 years), even after account deletion.
- Technical logs: typically up to 30 days.
- Contact requests: as long as needed to handle your request.
Delete your account in the app under Settings → Your data → Delete account. This removes your account, workspaces, files, AI keys, messenger links and messages from our database.
8. Browser storage & cookies
We do not use tracking or advertising cookies and no analytics tools. The app stores your session token and a copy of your workspace in your browser’s local storage so it loads quickly and works offline for a while. Signing out deletes this data from the browser. If you use Google Sign-In, Google may set its own cookies.
9. Security
- All connections are encrypted with TLS.
- AI keys and other secrets are stored encrypted (AES-256-GCM); session tokens and sign-in codes are stored only as hashes.
- The database runs in a managed Google Cloud environment; access is restricted to the backend.
- Telegram and Stripe webhooks are verified with secret signatures; invoice links are signed.
10. Your rights
Depending on where you live, you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time. Under the GDPR you can also lodge a complaint with a supervisory authority. California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights; we do not sell or share personal information.
Many rights you can exercise directly in the app (edit your data, export your workspace under Settings → Your data, delete your account). For anything else write to support@cultioo.com; we may need to verify your identity.
11. Children
The Service is not intended for anyone under 16, and we do not knowingly collect data from children.
12. Changes
We may update this policy when the Service or the law changes. We will announce material changes by email or in the app. The date at the top shows the latest version.