Privacy policy
Last updated: 28 October 2026
Draft, to be reviewed by a lawyer before the service opens.
Clearwing is in development and not open to customers yet. Today, only this site and our email address process personal data. The rest of this policy describes how the service will work once it opens; we will update it before then.
Who we are
Clearwing is published by Talvin Ackbaraly EI, 21 rue Pasteur, 94270 Le Kremlin-Bicêtre, France (“we”). Contact: ops@clearwing.app.
Our two roles
- Controller for the visitors of this site, the people who write to us and the users of Clearwing accounts.
- Processor for the data about our customers’ website visitors and their own customers. Each customer remains the controller of that data; we process it only on its instructions, under a data processing agreement (DPA).
This site
This site sets no cookies, loads nothing from other sites and uses no analytics. Our host, Netlify, logs technical data (IP address, browser, page requested, time) to deliver and protect the site. Legal basis: our legitimate interest in a secure site.
Emails you send us
We use your address and messages to answer you. Legal basis: our legitimate interest in answering you.
Clearwing accounts
We will process your name and login email, your password as a hash only, your two-factor and passkey settings, your sessions without a raw IP address, and an audit log of changes without email or IP address. Legal basis: the contract between us.
Data processed for our customers
On a customer’s site, Clearwing will record page views, ad clicks, forms and purchases, then match them with the customer’s payments and CRM. Emails and phone numbers will be stored only as SHA-256 hashes, after normalization. Without the visitor’s consent, a visit will not be linked to a sale and nothing will be sent to an ad platform. No raw personal data will ever be sent to an AI model.
If you visited the site of a business that uses Clearwing, contact that business first: it decides how your data is used, and we will help it answer you.
Data from and to ad platforms
Customers will connect their ad accounts through each platform’s own sign-in (OAuth). Clearwing will request only the access its features need, and use the data only to provide those features to that customer.
| Platform | Clearwing reads | Clearwing sends |
|---|---|---|
| Meta (Marketing API, Conversions API) | Ad accounts, campaigns, ad sets, ads and pixels, with their daily spend, impressions, clicks and reported conversions | Conversion events, and each ad’s share of a sale (AppendAttribution) |
| Google Ads (Google Ads API, Data Manager API) | Accounts, campaigns, ad groups, ads and conversion actions, with their daily metrics | Conversions, with their click ID (gclid, gbraid or wbraid) and the visitor’s consent signals |
| TikTok (API for Business, Events API) | Advertiser accounts, campaigns, ad groups, ads and pixels, with their reports | Conversion events |
| LinkedIn (Advertising API, Conversions API) | Ad accounts, campaigns, ads and conversion rules, with their analytics | Conversions, and UTM parameters on campaign links |
| Microsoft Advertising API | Accounts, campaigns, ad groups, ads and conversion goals, with their daily performance | Offline conversions |
A conversion holds its type, time, value and currency, an order or event ID, the ad click ID and, where the platform uses them, the SHA-256 hashes of the email address and phone number, plus, for Meta and TikTok, the IP address and browser user agent. Only conversions of visitors who consented are sent.
If a customer turns on ad control, Clearwing will also change budgets and turn ads on or off, each time after a user confirms, and log every change. Clearwing will store the access tokens, encrypted with AES-256-GCM, and the name of the platform account that granted access.
We will never sell this data, use it for advertising, pass it to data brokers or use it to train AI models. Our team will read it only with the customer’s permission, for security, or when the law requires it.
Clearwing’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To disconnect an ad account or have its data deleted, see Data deletion.
How long we keep data
| Data | Kept |
|---|---|
| Logs of this site, at Netlify | 30 days, according to Netlify |
| Emails you send us | 3 years after our last exchange |
| Clearwing account | Until you delete it |
| Email of a person invited to a team | Until the invitation is accepted, declined, cancelled or expires: 7 days at most |
| Audit log, without email or IP address | 12 months |
| Questions asked to the AI assistant | 12 months |
| Events from customers’ sites | 25 months |
| Raw IP addresses | 7 days |
| Visitor cookie on customers’ sites | 13 months, never extended |
| Calls (hashed caller number, no recording) | 25 months |
| Conversions, hashed emails and phone numbers | While the customer’s account exists |
| Ad platform data | While the ad account is connected, within each platform’s limits; deleted within 10 days after it is disconnected |
| Access tokens, encrypted | Until the ad account is disconnected or its access revoked |
Subprocessors
| Provider | Purpose | Country |
|---|---|---|
| Netlify, Inc. | Hosting of this site | United States |
| OVH SAS (OVHcloud) | Domain name, DNS and email; servers of the service, once it opens | France |
| Scaleway SAS | Emails sent by the service, once it opens | France |
We will add the AI assistant’s provider here before the assistant opens. When data leaves the European Union, the transfer is covered by the European Commission’s standard contractual clauses or by the EU-U.S. Data Privacy Framework, which Netlify complies with.
Security
Data will be encrypted in transit and at rest, and each customer’s data kept apart from the others’.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Write to ops@clearwing.app: we answer within one month. You can also complain to the CNIL, the French data protection authority, at cnil.fr.
Changes
We will post any change on this page, with its date. Account users will be told by email before a material change.