Last updated: September 11, 2026
This Privacy Policy explains what Chardson Petithomme, an individual doing business as Clavis ("Clavis," "we," "us," or "our"), collects when you use the Clavis service at clavisagent.com, including our API, SDK, MCP server, and dashboard (the "Service"), how we use it, who sees it, how long we keep it, and what choices you have. Clavis is operated from the United States and is built for developers and businesses. It is not directed to children, and we do not knowingly collect information from anyone under 18.
Email address and a hashed password (we never store your password in plain text). Your Clavis API key is also stored hashed. If you connect Clavis to Claude through Anthropic's Connectors Directory, the connection is an authorization handshake against the account you already created with us. Anthropic does not send us your name, email address, or any other information about you; we receive only the technical parameters needed to complete the authorization.
API keys, tokens, and secrets for third-party services you explicitly add to your vault (for example, OpenAI, Stripe, GitHub, or Kalshi). These are encrypted before they are written to storage (see Section 3). When you or your agent sends a request through Clavis, the relevant credential is decrypted in memory only long enough to attach it to that request.
Timestamps of credential access, which service was accessed, and request metadata (IP address, user agent) for security and rate-limiting purposes. The contents of the requests and responses we proxy pass through our servers in transit. We do not store or log them, and we do not read them except as needed to route them or to investigate abuse or a security incident.
If you subscribe to a paid plan, payment processing is handled by Stripe. We never receive or store your full card number. Stripe provides us a payment token and limited details (plan, subscription status, last four digits of your card) for account management.
If you contact support, we retain that correspondence to resolve your issue and improve the product.
We do not set cookies, and we do not use analytics, advertising, or tracking technologies of any kind. To keep you signed in, the dashboard stores a session token in your browser's local storage. It expires after 24 hours and is used only to authenticate you.
We do not sell your personal information or share it for targeted advertising. We do not use your stored credentials or their contents for any purpose other than fulfilling requests you or your agents initiate.
All stored credentials are encrypted at rest using authenticated, industry-standard symmetric encryption. Encryption keys are managed separately from the database and are never stored alongside encrypted data. Technical details of our encryption and infrastructure are published at clavisagent.com/security.html.
Access to decrypted credentials requires valid, non-revoked authentication, and every access is logged in an audit trail visible to you.
No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your account or your stored credentials, we will notify you by email without undue delay, and in any event within the time the law requires, and will tell you what we know so you can revoke or rotate the affected credentials.
Audit logs are pruned automatically on a weekly schedule, tiered by event type:
We take automated, encrypted backups of our database every night. Local copies are kept for 14 days and then deleted automatically. An off-site encrypted copy is kept for disaster recovery and deleted after 30 days.
Retained for as long as your account is active. See Section 5 for what happens when you delete a credential or your account.
You can delete individual stored credentials at any time from your dashboard, which removes them immediately from active storage. Service connections you remove are marked as deleted and are purged when your account is deleted. To delete your account entirely, email hello@clavisagent.com from the address on your account. We will confirm the request and delete your account within 30 days. Account deletion removes your account data and stored credentials from active storage. Residual copies may persist in encrypted backups for up to 30 days before they are purged. We keep audit and billing records for the periods in Section 4 even after deletion, and we may keep information for longer where the law requires it.
Deleting a credential from Clavis does not revoke it at the service that issued it. If you want a credential to stop working, revoke or rotate it at its source.
We share data only with:
We do not share your data with advertisers or data brokers.
Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it, delete it, or export it in a portable format, by emailing hello@clavisagent.com. We will verify your identity (usually by confirming the request from the email address on your account) and respond within 30 days. We do not sell personal information or use it for targeted advertising, and we will not treat you differently for exercising these rights.
The laws where you live may give you additional rights, such as the right to object to or restrict certain processing, to withdraw consent, or to complain to a data protection authority. You can raise any of them with us at the same address. If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing your information are performance of our contract with you (providing the Service), our legitimate interests in securing, operating, and improving the Service, and compliance with law.
Clavis is operated from the United States, and your information is stored and processed in the United States. If you use the Service from outside the United States, you are sending your information to the United States, where privacy laws may differ from those where you live.
We will update the "Last updated" date above and, for material changes, notify active users by email before the changes take effect.
Questions about this Policy or requests about your information: hello@clavisagent.com. Security concerns: security@clavisagent.com.