Privacy Policy

1. Who We Are

AppHouse Pty Ltd
ABN: 28 694 651 011
Australia
Contact: legal@apphouse.com.au

AppHouse Pty Ltd is the data controller for personal information collected through Cluera.

2. Information We Collect

We collect the following categories of personal information:

• Account information: Your email address, provided when you authenticate via Etsy OAuth.
• Etsy shop data: Your Etsy shop ID, shop name, and OAuth access tokens (used solely to read your shop reviews via the Etsy API).
• Generated reports: AI-generated analysis reports created from your review data, stored in your account.
• Usage analytics: Anonymised and pseudonymised usage data collected via PostHog, including pages visited, features used, and session information.
• Payment information: Billing details (name, card information) are processed directly by Stripe. We do not store card numbers.
• Communications: Email correspondence you send us.

We do not collect sensitive information as defined under the Privacy Act (e.g. health, biometric, or government identifier data).

3. How We Use Your Information

We use your personal information to:

• Provide and operate the Cluera service, including connecting to your Etsy shop and generating weekly review-analysis reports.
• Deliver your weekly email reports and other transactional emails (e.g. account notifications, billing receipts).
• Process subscription payments via Stripe.
• Improve the service through aggregated, anonymised usage analytics.
• Respond to support requests and enquiries.
• Comply with legal obligations.

We process your data on the following legal bases: performance of a contract (providing the service), legitimate interests (service improvement, fraud prevention), and your consent where required.

4. Third-Party Service Providers

We share your information only with the following trusted third parties, each bound by their own privacy obligations:

• Etsy, Inc. — OAuth authentication provider. Your Etsy login credentials are never seen by us; Etsy handles authentication entirely. Etsy's privacy policy applies to that interaction.
• Anthropic PBC — AI analysis provider. Review text is passed to Anthropic's Claude API to generate insights. Anthropic does not use your data to train models under its API terms.
• Supabase, Inc. — Database and authentication infrastructure. Your account data, tokens, and reports are stored in Supabase-hosted PostgreSQL databases.
• Stripe, Inc. — Payment processing. Stripe handles all payment card data and is PCI-DSS compliant. We receive only a customer reference ID.
• Resend, Inc. — Email delivery. Your email address and report content are transmitted to Resend to deliver your weekly reports.
• PostHog, Inc. — Product analytics. Anonymised usage data is collected to help us understand how the service is used.
• Vercel, Inc. — Hosting and infrastructure. Cluera is deployed on Vercel's platform, which processes request data as part of hosting.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

5. Cookies and Tracking Technologies

We use the following cookies:

• Session cookie: A secure, HTTP-only cookie used to maintain your authenticated session. This cookie is strictly necessary for the service to function.
• PostHog analytics cookies: Used to track anonymised usage behaviour. You can opt out of analytics tracking by contacting us or using your browser's cookie controls.

We do not use advertising, retargeting, or third-party tracking cookies.

6. Data Retention

We retain your personal information for as long as your account is active. Specifically:

• Your account data and reports are retained while you maintain an active account.
• If you disconnect your Etsy shop or close your account, your Etsy tokens are deleted immediately and your personal data is deleted within 30 days, unless we are required to retain it by law.
• Anonymised and aggregated analytics data may be retained indefinitely as it cannot be linked back to you.
• Backup data may persist for up to 90 days following deletion.

7. Data Security

We implement commercially reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include encrypted data storage, HTTPS transmission, access controls, and row-level security on our database.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. International Data Transfers

Cluera is operated from Australia, but some of our third-party service providers are based in the United States and other countries. By using Cluera, you acknowledge that your information may be transferred to and processed in countries outside Australia. We take steps to ensure that appropriate safeguards are in place for such transfers, including relying on providers who comply with applicable data protection frameworks.

9. Your Rights

Under the Australian Privacy Act and, where applicable, the GDPR, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information (subject to legal retention obligations).
• Data portability — receive your data in a structured, machine-readable format (GDPR users).
• Object to or restrict certain processing activities (GDPR users).
• Withdraw consent where processing is based on consent.

To exercise any of these rights, email us at legal@apphouse.com.au. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or (for EU users) with your local data protection authority.

10. Children's Privacy

Cluera is not directed at children under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, by email. Continued use of Cluera after a change constitutes your acceptance of the updated policy.

12. Contact Us

For privacy-related enquiries, requests, or complaints:
AppHouse Pty Ltd
Email: legal@apphouse.com.au