Your data, plainly

Clear Saga runs the website at clearsaga.com and the Clear Saga app ("we", "us"). This policy covers both. Write to hello@clearsaga.com with any question about it.

For the data a store sends us about its own shoppers and site visitors, the store is in charge of that data and we process it on the store's behalf and on its instructions. For the data about our own customers (your account, your workspace and your billing), we are in charge of it.

You choose which platforms to connect and which accounts within them. For each one, this is exactly what we read, why, and what we never do with it.

A store or website that adds our tag sends us a record of each page view. A record holds the page address, the address the visitor came from, campaign tags in the link (UTM tags, and ad click IDs such as gclid and fbclid when the site turns on ad attribution), the browser, operating system and device type, and the country, region and city worked out from the IP address.

The IP address itself is never stored. By default visitors are told apart by a one-way hash that changes every day, so no cookie is set and a person cannot be followed from one day to the next. If a site switches on returning visitors, a first-party cookie remembers a random ID instead, and the site is responsible for asking its visitors' consent where the law requires it. The tracking privacy page has every detail.

• Your name, email address and a hash of your password. We never see the password itself.
• Your workspaces, sites, members and their roles, and the settings you choose.
• For each signed-in session, the browser and IP address it signed in from, so you can see and end your sessions.
• Billing details, held by Shopify for App Store installs or by Stripe for direct customers. We never see full card numbers.
• The messages you send us.

Only to run Clear Saga for you:

• To credit orders to the visits, campaigns and ads behind them, and to work out spend, profit and the other numbers in your reports.
• To send the emails you ask for, such as reports and alerts, and messages about your account.
• To keep the service secure and to stop abuse, such as bot traffic and misuse of the API.

We do not sell data, use it to advertise to anyone, combine one customer's data with another's, or use it to train AI models. If you connect an AI agent through our MCP server or API, the agent reads your data with a token you create and can revoke.

Only the providers that run the service, each bound to protect the data and use it for nothing else:

• Cloudflare, which hosts the app and the tracking tag, and stores all data.
• Shopify and Stripe, which handle payments.

We disclose data to authorities only when the law requires it. If Clear Saga is ever sold or merged, this policy keeps applying to the data collected under it, and we will tell you first.

• Visits, page views and events: 3 years.
• Orders and refunds: 3 years.
• The profile of a returning visitor, when that is switched on: 13 months after their last visit.
• Ad spend and results: while the platform is connected. Access tokens are deleted the moment you disconnect.
• After you disconnect a platform, uninstall the Shopify app or delete your account, the data from it is deleted within 30 days, backups included.

• All traffic is encrypted in transit, and all stored data is encrypted at rest.
• Platform access tokens and signing secrets are encrypted again with their own key before they are stored.
• Each site's data is kept apart from every other site's, and only members of your workspace can see it, with the role you give them.
• We look at your data only when you ask us to help, or to investigate a security problem.

You can see, correct, export or delete your data at any time, most of it from the app itself. For anything else, email hello@clearsaga.com. We answer within 30 days. Depending on where you live, laws such as the GDPR, the UK GDPR, PIPEDA and the CCPA give you these rights and the right to complain to your data protection authority.

If you shop at a store that uses Clear Saga, ask that store first: it decides what happens with your data, and we help it answer. Shopify passes us its customer data and erasure requests, and we act on them. The data deletion page explains each way to have data removed.

• This website sets no analytics or advertising cookies. Your theme and animation choices stay in your browser's own storage.
• The app sets one cookie to keep you signed in.
• The tracking tag sets no cookie unless a site switches on returning visitors.

Cloudflare runs the service on its global network, so data may be processed outside the country you live in. Where the law asks for it, transfers are covered by Cloudflare's data processing terms and the standard contractual clauses.

Clear Saga is a business tool and is not meant for anyone under 16.

When this policy changes we update the date at the top. If a change affects how your data is used, we email the owner of every workspace before it takes effect.