Privacy Policy

1. Scope and roles

This policy applies to Clerkora’s public website, account and dashboard experience, embedded Website Chat, Phone Receptionist, and the supporting booking and business-management features.

When a business configures Clerkora and decides what customer information to collect, that business is responsible for its customer relationship and instructions. Clerkora uses the information to provide the configured service. Customers should also review the privacy information provided by the business they contacted.

2. Information Clerkora handles

Account and authentication information

Clerkora uses Supabase Authentication for account access. We handle account identifiers, email addresses, authentication/session records, and profile information such as a display name, phone number, or avatar when supplied.

If you continue with Google, Google and Supabase make basic account information available for authentication, including your Google account identifier, email address, name, and profile image. Clerkora requests the openid, email, and profile scopes; it does not request access to Google Drive, Gmail, calendars, or contacts through this sign-in flow.

Business workspace information

Business users may provide organization and profile details, contact information, website and location details, service area, time zone, brand voice, staff assignments, services, prices, durations, deposits, hours and breaks, booking rules, travel settings, FAQs, policies, intake questions, contract text, assistant settings, and external payment instructions or links.

If a business asks Clerkora to read its public website, Clerkora may fetch submitted pages and store source URLs, page titles, extracted text, excerpts, proposed business facts, review decisions, and import diagnostics. Business users review proposed information before applying it to the workspace.

Leads, customers, schedules, and bookings

Depending on the business’s configuration and what a customer shares, Clerkora may store names, phone numbers, email addresses, notes, service interests, requested dates or times, preferences, intake answers, appointment details, status, location, pricing and deposit snapshots, staff assignment, booking source, and scheduling or conflict records.

Website Chat

Website Chat stores customer and assistant messages, timestamps, conversation status, whether a message came from a customer, assistant, or staff member, booking state, and lead details extracted from the conversation when confidence and workflow rules permit. The widget also records the authorized website origin, expiring session records, and a one-way hash derived from the visitor IP address for abuse prevention and rate limiting. Raw widget session tokens are not stored.

Phone Receptionist

Phone records can include caller and called numbers, provider call identifiers, caller name, reason for calling, requested service, callback preference, call status and outcome, duration, summaries, errors, booking state, and linked lead, customer, or appointment records. When transcription is enabled for the business, Clerkora stores caller and receptionist transcript content.

For GPT-Live calls, Clerkora also records session and tool-event diagnostics such as model and transport names, call and session identifiers, timestamps, tool names and outcomes, booking revisions, latency, interruptions, delegated turns, token/audio usage, estimated cost, close reason, and bounded error details. The gateway sends a bounded transcript to Clerkora at finalization when transcription is enabled.

Technical information

Clerkora and its hosting and communications providers process ordinary request, device, network, and operational information needed to deliver and protect the service. The current public application uses essential Supabase authentication cookies. Clerkora does not currently include a dedicated advertising tracker or product-analytics SDK, and does not currently use information for cross-context behavioral advertising.

3. How information is used

Clerkora uses information to:

• authenticate users and maintain account sessions;
• create and operate tenant-specific business workspaces;
• answer customer questions from business-approved services, facts, FAQs, and policies;
• capture leads, manage conversations, check availability, and create validated appointments;
• operate phone calls, transcriptions, booking tools, and requested follow-up workflows;
• import and review public business website information;
• prevent abuse, enforce tenant and channel boundaries, diagnose failures, measure usage, and estimate service costs; and
• provide support and protect Clerkora, its users, and the public.

4. AI and automated processing

Website Chat may send relevant conversation messages, configured business facts, customer context, and booking state to an OpenAI-compatible model endpoint to prepare responses or structured lead information. The Phone Receptionist may send live call audio and conversation context to OpenAI for speech and realtime responses, and may use a delegated model for approved business tools.

AI output can be incomplete or incorrect. Clerkora’s booking tools separately validate services, availability, offered slots, contact readiness, confirmation state, scheduling conflicts, and database writes. Businesses remain responsible for reviewing their configuration and handling requests that require human judgment.

5. Who receives information

Information is available to authorized members of the relevant business workspace according to their access. Clerkora also uses service providers where necessary to operate the product:

• Supabase for authentication and application database services;
• Google as the provider of optional Google authentication;
• Vercel for the Clerkora web application and server routes;
• Railway for the durable Phone Live gateway;
• Twilio for phone numbers, call routing, voice features, speech handling, and call metadata; and
• OpenAI for configured AI text and realtime audio processing.

These providers process information under their own terms and service configurations. Clerkora may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect people or the service, investigate abuse, or support a business transaction involving Clerkora. Clerkora does not currently sell personal information.

6. Payment-related information

The current product can store business-configured deposit amounts, payment methods, e-transfer instructions, and external payment links. Clerkora does not currently provide an integrated Stripe checkout or directly process customer card payments. If a business directs a customer to an external payment service, that service’s privacy terms apply.

7. Retention and deletion

The current product does not apply one automatic deletion period to all account, business, customer, conversation, call, or appointment records. Core records generally remain available to the relevant workspace unless they are archived, replaced, or removed through database or account administration. Website Chat credentials and session records expire, but expiry of a session does not automatically delete its conversation messages.

Clerkora does not currently offer a self-service account-deletion control. To ask about access, correction, or deletion of an account or workspace record, contact hello@clerkora.com. If you contacted a business using Clerkora, contact that business first because it controls the customer relationship and may need to retain or correct its records.

8. Security and tenant access

Clerkora uses authentication, row-level tenant access rules, organization-scoped database functions, signed provider requests, restricted service credentials, and hashed public-widget tokens as safeguards appropriate to the current architecture. No internet service can promise absolute security. Business users are responsible for protecting their credentials and limiting workspace access to authorized people.

9. Choices and requests

Business users can update many workspace records and disable configured channels from the dashboard. Google users can also review or revoke Clerkora access from their Google Account. Depending on where you live, applicable law may provide additional privacy rights. Contact us to make a request; we may need to verify the request and determine whether Clerkora or the relevant business is responsible for responding.

Privacy concerns, access or correction requests, and related questions can be submitted to the Privacy Officer at hello@clerkora.com. Requests and concerns will be handled in accordance with applicable law.

10. Changes and contact

We may update this policy as Clerkora’s product and providers change. The date above identifies the current version. Material product changes should be reflected here before the affected feature is launched.

Privacy Officer
hello@clerkora.com