Legal
Privacy Policy
This policy explains how Cloverr (“Cloverr”, “we”, “us”) collects, uses and protects personal data when you visit cloverr.ai, sign in to Cloverr, or otherwise use our training-operations platform (the “Service”). We are based in Ireland and we process personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and the Irish Data Protection Acts 1988–2018.
1. Who we are
Cloverr is based in Ireland and is responsible, as controller, for the personal data described in this policy.
Privacy enquiries: hello@cloverr.ai.
2. Controller or processor
Cloverr is a business-to-business service. Our customers are training providers (“Customers”) who use Cloverr to manage their trainers, courses, venues, bookings and attendees. Our role depends on whose data it is:
- Customer Data — we are a processor. Personal data a Customer puts into the Service (for example trainer profiles, qualifications, attendee names, contact details and certificates) is processed on the Customer’s behalf and on its documented instructions, under our Data Processing Agreement. The Customer is the controller. If you are a trainer or attendee of one of our Customers, please direct privacy requests to that training provider; we will assist them in responding.
- Account, website and business data — we are the controller. Data about the people who sign up for, sign in to and administer Cloverr accounts, visit our website, or contact us, is processed by us as controller, as described in this policy.
3. Data we collect
Data you give us
- Account data: name, work email address, organisation, role, and — if you use a password — a salted hash of your password (we never store the password itself).
- Communications: the content of emails, support requests and demo requests you send us.
- Billing data: billing contact, company name, VAT number and billing address. Card details are collected and held by our payment processor, Stripe; we never see or store full card numbers.
Data from third-party sign-in
- If you choose Sign in with Google, we receive the limited profile data described in section 4.
Data collected automatically
- Technical and security logs: IP address, browser and device type, timestamps, pages and API endpoints requested, and sign-in events. We use these to keep the Service secure and working.
- Strictly necessary cookies — see section 12. We do not use advertising or cross-site tracking cookies.
4. Google user data
Cloverr offers Sign in with Google as a way to log in. It is optional — where your organisation allows it you can also sign in another way.
What we access
We request only the following Google OAuth scopes: openid, email and profile. From these we receive:
- your Google account identifier;
- your email address and whether Google has verified it;
- your name and, where available, your profile picture URL;
- for Google Workspace accounts, your hosted domain.
We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google service.
How we use it
- to authenticate you and match you to the Cloverr user account your organisation created for you (or to your organisation’s permitted email domain);
- to display your name and picture inside the Service;
- to keep a security log of sign-in events.
How we share, store and protect it
- We do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to provide the Service (our hosting provider, listed in section 7), to comply with law, or with your consent.
- We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.
- It is stored encrypted at rest in our database in the EU (AWS, Ireland region) and in transit over TLS.
- We keep it for as long as your Cloverr account exists, and delete it as described in section 9.
Cloverr’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Cloverr’s access at any time at myaccount.google.com/permissions. To have the data we already hold deleted, email hello@cloverr.ai or ask your organisation’s Cloverr administrator to remove your account.
5. How we use data and our legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and run your account; sign you in; provide the Service | Account, Google sign-in, technical | Performance of our contract with your organisation (6(1)(b)) and our legitimate interest in providing the Service to its authorised users (6(1)(f)) |
| Security, fraud and abuse prevention; audit logs | Technical, account | Legitimate interests (6(1)(f)); legal obligation where applicable (6(1)(c)) |
| Billing, invoicing and tax records | Billing, account | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Service emails (password resets, invitations, booking notifications) | Account | Contract (6(1)(b)) |
| Responding to enquiries and demo requests | Communications | Legitimate interests (6(1)(f)) |
| Product news to business contacts | Name, work email | Legitimate interests (6(1)(f)) with an unsubscribe in every message, or consent where the ePrivacy Regulations (S.I. 336/2011) require it |
| Improving reliability and performance | Aggregated technical data | Legitimate interests (6(1)(f)) |
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
6. AI features
Cloverr includes an optional AI assistant that lets authorised users query and update their organisation’s data in natural language. When it is used:
- the prompt and the minimum Customer Data needed to answer it are sent to a large-language-model provider acting as our sub-processor ([Amazon Bedrock, EU region]);
- the provider is contractually prohibited from using that data to train its models, and does not retain it beyond what is needed to return a response and meet its abuse-monitoring obligations;
- any change the assistant proposes to your data is shown for a user to confirm before it is saved.
We do not use Customer Data or Google user data to train AI models.
7. Who we share data with
We share personal data only with the service providers below, who act on our instructions under written data-processing terms, and otherwise only when required by law or to protect our legal rights. We do not sell personal data.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, file storage, transactional email (SES), AI model hosting (Bedrock) | EU (Ireland) |
| Stripe Payments Europe, Ltd. | Payment processing | EU (Ireland); onward transfers under SCCs |
| Google Ireland Limited | Sign in with Google; web fonts on cloverr.ai | EU / US |
| [Other — e.g. support desk, error monitoring] | [purpose] | [location] |
An up-to-date list of sub-processors is available on request from hello@cloverr.ai. If Cloverr is involved in a merger or acquisition, personal data may transfer to the successor, which will remain bound by this policy.
8. International transfers
We host the Service in the European Union. Where a provider processes personal data outside the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified US recipients) or the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed. You can request a copy of the relevant safeguards from us.
9. Retention
- Account and Google sign-in data: for as long as the account is active; deleted within [30] days of the account being deleted.
- Customer Data: for the term of the Customer’s subscription, then returned or deleted in line with the Terms (normally within [90] days of termination), except where law requires us to keep it.
- Security logs: up to [12 months].
- Billing and tax records: 6 years from the end of the relevant financial year, as required by Irish tax law.
- Enquiries: up to [24 months] after our last contact.
Backups are overwritten on a rolling cycle of up to [35] days.
10. Security
We use appropriate technical and organisational measures, including encryption in transit (TLS) and at rest, database-level tenant isolation so one Customer’s data cannot be read by another, role-based access control, hashed passwords, least-privilege access for our staff, and logging of administrative actions. No system is perfectly secure; if a personal data breach occurs we will notify the Data Protection Commission and affected Customers or individuals as the GDPR requires.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased;
- restrict or object to processing, including processing based on legitimate interests and all direct marketing;
- data portability;
- withdraw consent at any time, where we rely on consent.
Email hello@cloverr.ai to exercise any of these. We will respond within one month and may need to verify your identity. Where we process your data as a processor for a Customer, we will pass your request to that Customer.
You also have the right to lodge a complaint with the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — www.dataprotection.ie — or with the supervisory authority where you live or work. We would appreciate the chance to address your concern first.
12. Cookies
We use only strictly necessary cookies, which do not require consent under Regulation 5(5) of the ePrivacy Regulations:
| Cookie | Purpose | Duration |
|---|---|---|
| Session / authentication | Keeps you signed in to the Service on your organisation’s Cloverr address | [session – 7 days] |
| Sign-in state | Protects the Google sign-in flow against forgery (CSRF) while you are redirected | Minutes |
Our marketing website sets no cookies. It loads fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads. We do not use analytics, advertising or social-media tracking. If we introduce any non-essential cookies we will ask for your consent first and update this section.
13. Children
Cloverr is a business service and is not directed at children. Account holders must be at least 18. Customers may record data about attendees who are under 18 (for example apprentices); in that case the Customer, as controller, is responsible for having a lawful basis and providing any required notices.
14. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new “last updated” date and, where the changes are material, notify account administrators by email or in the Service before they take effect.
15. Contact us
Cloverr
Ireland
Email: hello@cloverr.ai