Privacy Policy

Serin Technologies, LLC operates Clair and is the controller of the personal data described in this policy for accounts, billing, support, and the website.

We collect what we need to run accounts, API keys, billing, and support: your email and sign-in details, API key references, usage records, and billing identifiers. Card details are handled by Stripe, not stored by Clair.

API calls are processed to answer them. To fetch a page, the page's address, which is built from your inputs, passes through the providers that fetch pages for Clair. Clair's own access logs leave out query strings, and we do not build a search-history profile of you.

The website uses PostHog, Vercel Analytics, Vercel Speed Insights, and Ahrefs Web Analytics. We do not sell personal data.

Account data: your email address, name if you give one, a hashed password if you sign up with email, and email verification status. If you sign in with Google or GitHub, we receive your name, email address, profile image, and account identifier from that provider. We also keep session records, which include IP address and browser user-agent, to keep you signed in and secure your account.

API keys: keys are issued and verified through our key-management provider. We store key identifiers, names, and metadata with your account so the dashboard can list and manage them.

Usage records: we record each request's API and charge, your plan balance, and usage per billing period to enforce limits and show you your usage. Usage is not sent to Stripe; Stripe sees your plan and its payments.

API inputs: query text, identifiers, domains, filters, cursors, headers, and routing data are processed to authenticate and answer a request. Clair's structured access log records request ID, API, method, path without the query string, status, and duration.

Billing data: Stripe collects your payment method, billing name and address, and tax ID if you provide one. We receive and store your Stripe customer and subscription identifiers, plan, and payment status, not your full card number.

Technical data: hosting, network, and security providers process IP address, user-agent, timestamps, and request metadata in their logs to deliver traffic, diagnose faults, and prevent abuse.

Website analytics: PostHog receives page URLs, referrer and campaign attribution, device and browser information, pageviews, page-leave events, and interaction events, under a pseudonymous browser identifier; after you sign in, those events may be associated with your Clair account. Vercel Analytics records aggregated page views without cookies. Vercel Speed Insights measures page performance (loading, responsiveness, and layout stability) with the page URL, device type, browser, and approximate location, without cookies. Ahrefs Web Analytics is cookie-free, processes page and referrer URLs, user-agent, language, and approximate location, and, according to Ahrefs, discards raw IP addresses.

Cookies and browser storage: we set cookies required for sign-in sessions. The theme choice is stored locally under clair-theme. PostHog may use a cookie or local storage for its pseudonymous identifier.

Communications: we send account email, such as verification and password reset messages. If you email us, we receive your address, message, and anything you choose to include. If you ask us to cover a site from the dashboard, we keep the site and what you said you would use it for with your account, so we can email you when it is available. If you tell us what you are building when you sign up, we keep your answer with your account to decide which data sources to add.

To provide the Service under our contract with you: creating and securing accounts, issuing keys, answering API requests, enforcing plan limits, billing, and support.

For our legitimate interests: keeping the Service available and secure, investigating faults, fraud, and abuse, understanding which pages and documentation are useful, and improving the product. Where the law requires consent for analytics cookies or similar technologies, we rely on consent instead.

To meet legal obligations: keeping tax and accounting records, responding to lawful requests, and enforcing our terms.

We do not use your API inputs or results to train machine-learning models, to build advertising profiles, or for any purpose other than operating the Service. We send account and service email; we send marketing email only where the law allows and you can opt out at any time.

Stripe: payments, invoices, tax, and subscriptions, under Stripe's own privacy policy for data it collects at checkout.

Page-fetching providers: proxy, browser-rendering, and web-access providers that fetch source pages on Clair's behalf. They receive the address of the page to fetch, which can contain your query inputs, but not your account details.

Hosting and infrastructure: Vercel hosts the website and dashboard, Fly.io runs the API, and PlanetScale hosts the database. Network and security providers deliver and protect traffic.

Unkey issues and verifies API keys. Resend delivers account email. An email provider hosts our contact mailbox.

Sign-in providers: Google and GitHub, when you choose to sign in with them.

Analytics: PostHog, Vercel (Analytics and Speed Insights), and Ahrefs, as described above.

Legal and corporate: professional advisers, authorities where the law requires, and a successor in a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal data and do not share it for cross-context behavioral advertising. A current list of providers is available on request.

Clair fetches public pages when a customer calls an API. Those pages can contain personal data that the source published: people named in news articles, reviewers and business owners on review and map pages, recruiters and hiring managers on job pages, founders and executives on company profiles, and the names, email addresses, and phone numbers companies list on their own websites. This data comes from the source, not from the people concerned.

We process this material only to return the fields documented for each API to the customer who asked for it. We do not keep a searchable copy of fetched pages as a product, and we do not combine responses with other sources to build profiles of individuals. The customer who receives a result decides how it is used and is responsible for that use under our terms.

If you are named on a page a customer asked us to fetch and want to exercise your rights, email us with enough detail to identify the page. The original page is controlled by its publisher, so to have it corrected or removed you may also need to contact that source.

Account data is kept while your account is open. Usage and billing records are kept as long as needed for billing, tax, and accounting obligations, typically up to seven years. Operational and infrastructure logs follow configured rotation and provider retention periods and are kept only as long as reasonably needed for reliability, security, and abuse prevention.

Analytics events are kept according to our PostHog, Vercel, and Ahrefs settings. Email correspondence is kept as long as reasonably needed to answer you, keep business records, and resolve disputes.

Data is encrypted in transit, API key secrets are managed by our key-management provider, and access to production systems is restricted. No service can guarantee absolute security; if a breach affects your personal data, we will notify you and the authorities as the law requires.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to receive a portable copy, and to withdraw consent. We will not discriminate against you for exercising them.

Signed-in users can delete their Clair account from dashboard Settings. That erases the account, sign-in details, API keys, and usage balance, and cancels any active subscription immediately. Records we must keep for tax and accounting, and invoices held by Stripe, remain for their retention period.

California residents have the right to know, delete, and correct personal information and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information to infer characteristics. Residents of other U.S. states with comparable laws have similar rights.

Users in the EU, EEA, UK, and Türkiye may also lodge a complaint with their data-protection supervisory authority. To make a request, email us from the address on your account or tell us how to verify your identity.

Clair is a developer service for businesses and is not directed at children under 16. We do not knowingly collect their personal data.

Serin and its providers process data in the United States and in other countries where providers operate, which may have different data-protection laws from where you live.

Where required, international transfers rely on the European Commission's Standard Contractual Clauses, the UK addendum, or another lawful transfer mechanism offered by our providers. Contact us for more information about the safeguards relevant to your data.

We may update this policy as products, providers, and legal requirements change. The current version is published here with its effective date. For material changes, we will also notify account holders by email before they take effect.

Clair is operated by Serin Technologies, LLC, a Delaware limited liability company. Email contact@serinlabs.com for a privacy question, a rights request, or the current list of providers.