Privacy Policy
Effective date: April 16, 2026
Last updated: April 16, 2026
This policy explains how Claro ("Service"), operated by Nternet Company BV ("we", "us", "our"), collects, uses, and protects your personal data. Claro helps people build websites through WhatsApp conversation.
1. Data Controller
The data controller responsible for your personal data is:
Nternet Company BV
Keizersgracht 241, 1016EA Amsterdam, Netherlands
KvK: 96112107
Email: claro@nternet.company
For privacy-related questions, contact us at the email above or through your Claro WhatsApp chat.
2. Data We Collect
We collect only what is necessary to provide and improve the Service.
Data you provide
- Contact data: your WhatsApp phone number (required) and optionally your email address.
- Message content: text messages, images, links, and other media you send to Claro.
- Website content: text, images, social links, and configuration you create through Claro for your published site.
Data received from Meta / WhatsApp
When you message Claro, we receive your phone number, display name (if set), message content, and message metadata (timestamps, status) via the WhatsApp Business API. The source of this data is Meta Platforms (Art. 14 GDPR).
Data collected automatically
- Conversation history: messages exchanged between you and the Claro agent, stored to maintain conversation context.
- Subscription and billing metadata: plan type, subscription status, billing period, and Stripe customer/subscription identifiers. We do not store your payment card details — Stripe handles that directly.
- Admin session data: IP address, user agent, and session tokens for admin dashboard authentication (email OTP).
- Error and diagnostic data: anonymised error reports and performance metrics sent to our error tracking service.
We do not collect special categories of personal data (health, race, political opinions, etc.) or national identification numbers.
3. Legal Basis for Processing
Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Provide the Service (generate and host your website) | Contract performance — Art. 6(1)(b) |
| Process AI-assisted content generation via OpenAI | Contract performance — Art. 6(1)(b) |
| Process payments and manage subscriptions | Contract performance — Art. 6(1)(b) |
| Send service-related communications | Contract performance — Art. 6(1)(b) |
| Protect the Service from spam, account takeover, and webhook abuse | Legitimate interest — Art. 6(1)(f) |
| Diagnose production errors and investigate bug reports to keep the Service reliable | Legitimate interest — Art. 6(1)(f) |
| Retain billing records for tax/accounting | Legal obligation — Art. 6(1)(c) |
| Non-essential or marketing communications | Consent — Art. 6(1)(a) |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights. Our specific legitimate interests are (a) keeping Claro secure against spam and abuse, and (b) diagnosing and fixing production errors. You can request details of these assessments by contacting us.
4. How We Use Your Data
- Provide, operate, and maintain the Service.
- Generate and host your website, including AI-assisted content creation.
- Process payments and manage subscriptions.
- Send service-related and billing communications via WhatsApp and email.
- Detect and prevent fraud, abuse, and security incidents.
- Improve the Service based on usage patterns and error diagnostics.
- Comply with legal and regulatory obligations.
Your phone number is required to use the Service — without it, we cannot create or manage your account (Art. 13(2)(e) GDPR).
5. AI and Automated Processing
Claro sends your messages and website content to OpenAI to generate website suggestions and edits. This is core to how the Service works.
- What is sent: your message content and conversation context.
- Purpose: generating and editing your website content.
- Legal basis: contract performance (Art. 6(1)(b) GDPR).
- OpenAI's role: data processor, operating under a Data Processing Agreement (DPA) with us.
We do not use your data to train AI models. We encourage you to review OpenAI's privacy policy.
No fully automated decisions with legal or similarly significant effects are made about you (Art. 22 GDPR). The AI assists with content generation; you remain in control of what gets published.
6. Service Providers
We share data with the following third-party processors, only to the extent necessary to operate the Service:
| Provider | Purpose | Location |
|---|---|---|
| Meta / WhatsApp | Messaging platform | US (DPF + SCCs) |
| Cloudflare | Hosting, storage, database, CDN | US (DPF + SCCs) |
| OpenAI | AI content generation | US (DPF + SCCs) |
| Stripe | Payment processing | US (DPF + SCCs) |
| Resend | Transactional email | US (SCCs) |
Each provider operates under a Data Processing Agreement (DPA) with us. Copies of these agreements are available on request.
7. International Transfers
Your data is transferred to and processed in the United States, where our service providers operate. We rely on the following safeguards:
- EU-U.S. Data Privacy Framework (DPF): our main US processors (Meta, Cloudflare, OpenAI, Stripe) are certified under the DPF adequacy decision (Commission Decision C(2023) 4745).
- Standard Contractual Clauses (SCCs): as an additional safeguard, we use SCCs (Commission Decision 2021/914) with all US processors.
You may request a copy of the relevant safeguards by contacting us at claro@nternet.company.
8. Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| Account and site data | While account is active | Contract |
| Conversation history | Up to 50 most recent messages; older messages pruned automatically | Contract |
| Stored media (images) | While account is active | Contract |
| Billing / invoice records | 7 years (Dutch tax law, AWR Art. 52) | Legal obligation |
| Error / diagnostic logs | Up to 90 days | Legitimate interest |
| AI processing (OpenAI API) | Per OpenAI DPA (up to 30 days for abuse monitoring) | Contract / processor obligation |
When you request account deletion, we delete your contact record, site data, stored media, and conversation history. See our Data Deletion page for the full process.
9. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (HTTPS/TLS for all communications).
- Encryption at rest for stored data (Cloudflare D1 and R2).
- WhatsApp webhook signature verification to prevent unauthorised access.
- Admin access protected by email OTP authentication.
- Secrets and API keys stored securely via Cloudflare Workers secrets management.
No system is 100% secure. If you become aware of a security issue, please contact us immediately. In the event of a personal data breach, we will notify the Autoriteit Persoonsgegevens within 72 hours (Art. 33 GDPR) and, where required, notify affected users without undue delay (Art. 34 GDPR).
10. Cookies and Tracking
The Claro website uses only essential cookies required for admin dashboard authentication (session cookies). These are strictly necessary and exempt from consent under the Dutch Telecommunicatiewet (Art. 11.7a). We do not use analytics cookies, advertising trackers, or third-party tracking pixels on claro.bio.
Published user sites hosted at claro.bio/<slug> do not set cookies or include tracking scripts.
We do not currently respond to Do Not Track (DNT) browser signals, as there is no industry-standard implementation. Since we do not track users across sites, DNT would not change our behaviour.
11. Your Rights
Under GDPR (EEA residents)
- Access (Art. 15) — request a copy of your personal data.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure (Art. 17) — request deletion of your data (see Data Deletion).
- Restriction (Art. 18) — request limited processing in certain circumstances.
- Data portability (Art. 20) — receive your data in a structured, machine-readable format. You can request an export of your site data and conversation history.
- Objection (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent (Art. 7) — where processing is based on consent, withdraw at any time without affecting prior processing.
- Lodge a complaint — you have the right to file a complaint with:
Autoriteit Persoonsgegevens
Hoge Nieuwstraat 8, 2514 EL Den Haag
autoriteitpersoonsgegevens.nl
Under CCPA (California residents)
If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell your personal data.
To exercise any of these rights, send a message in your Claro WhatsApp chat or email claro@nternet.company. We will respond within one month (Art. 12(3) GDPR).
12. WhatsApp Opt-in and Opt-out
Claro only messages people who have initiated a conversation with us through WhatsApp. You can stop receiving messages at any time by sending "STOP" or requesting account deletion. We honour opt-out requests promptly. If you block our WhatsApp number, we treat that as withdrawal of consent.
Any marketing emails we send will include a one-click unsubscribe link (Telecommunicatiewet Art. 11.7(2)(d)). Unsubscribing from marketing email never affects service-related messages you need to operate your account.
13. Children
Claro is not intended for children under 16 (in line with Art. 8 UAVG, the Dutch implementation of GDPR). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
14. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top and notify you via WhatsApp where appropriate. Continued use of Claro after changes take effect means you accept the revised policy.
15. Contact
For privacy-related questions or to exercise your data rights:
Nternet Company BV
Keizersgracht 241, 1016EA Amsterdam, Netherlands
KvK: 96112107
Email: claro@nternet.company
WhatsApp: send a message in your Claro chat.