Back to Clawless

Privacy Policy

Last updated: May 10, 2026 (v4)

This Privacy Policy explains how Clawless ("Clawless", "we", "us") collects, uses, stores, and protects information when you use our service. Clawless is an AI assistant accessible through WhatsApp and Telegram. The service domain is myclawless.com. The customer-facing channel is the Clawless bot — for privacy questions or data-subject requests, message the bot from the WhatsApp or Telegram account on file. The support@myclawless.com address is monitored for regulator and security disclosures.

1. Information We Collect

From your messaging app (WhatsApp or Telegram):

From your subscription:

From connected Google accounts (only if you choose to connect):

Cookies on the website (myclawless.com):

2. How We Use Your Data

We do not sell your data. We do not use your conversation content or your Google data to serve advertising or for any advertising purpose. We do not use your data to train any AI model.

3. Connected Google Accounts & Google API Services

Clawless can optionally connect to your Google account so the assistant can read or write specific data on your behalf. You initiate this connection through Google's standard OAuth consent screen, which lists the exact scopes Clawless is requesting. You can revoke at any time.

Scopes Clawless may request (only when you authorize them):

Scope What it grants
.../auth/calendar.readonly Read your calendar events so the assistant can answer questions like "what's on my calendar today?"
.../auth/calendar.events Read and write your calendar events when you ask the assistant to schedule, reschedule, or cancel meetings
.../auth/calendar.app.created Create a single secondary calendar named "Clawless" inside your Google account; the assistant can only manage events it created in this calendar — it cannot access your other calendars
.../auth/gmail.readonly Read your Gmail messages when you ask the assistant to summarize or search your inbox
.../auth/gmail.send Send Gmail messages on your behalf when you instruct the assistant to draft and send mail
.../auth/gmail.modify Read, send, and modify mail labels — used when you ask the assistant to triage your inbox (e.g., archive, label). We do not permanently delete mail.

Limited Use of Google User Data.

Clawless's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

How your Google credentials are stored.

Your Google OAuth refresh token is encrypted at the application layer with a per-account encryption key managed by Google Cloud KMS. The encryption key for your account is gated by an IAM condition bound to the hashed identifier of your phone number, so the key can only be used while processing your own requests. We never store your Google account password.

Revoking access: you can revoke the Clawless connection at any time at myaccount.google.com/permissions, or by messaging the bot "disconnect google", or by deleting your Clawless account (which destroys the per-account key — see Section 7). Once revoked, Clawless can no longer call Google APIs on your behalf.

4. WhatsApp Business Solution Data

We use the WhatsApp Business Platform (Meta Cloud API) to receive and send messages. Meta is the hosting provider for WhatsApp messages and processes them subject to Meta's WhatsApp Privacy Policy and the WhatsApp Business Solution Terms.

5. Payment Processing

Subscription payments are processed by PayPal. PayPal collects and processes your payment information directly — Clawless never sees or stores your full card or bank details. PayPal's handling of your payment data is governed by their Privacy Policy. We retain only the PayPal subscription identifier, the billing-period start/end dates, and the last 4 characters of the email on your PayPal account (used as a self-service deletion challenge).

6. Data Storage & Security

Clawless runs on Google Cloud Platform. Your data is stored as follows:

All data in transit is protected with TLS. Production access to user-data systems is restricted to a small set of administrative service accounts; routine engineering work uses no-PII tooling and audit logs of every privileged access are written to a separate, append-only audit project.

7. Account Deletion & Cryptographic Shredding

You can delete your Clawless account at any time. Identity is verified by control of the phone number on the account — Clawless does not store or rely on a customer email address. The two deletion paths are:

On account deletion we cancel any active PayPal subscription, then irrevocably destroy the KMS encryption key unique to your account. Once that key is destroyed, all data encrypted with it (conversation history, memory, OAuth refresh tokens, workspace files) becomes cryptographically inaccessible — this is sometimes called "crypto-shredding". The per-user virtual machine is then torn down. We target completion within 24 hours of receiving the request; in practice it normally completes within minutes.

After deletion, residual non-personal records may persist for legal and accounting reasons (e.g., the fact that a subscription existed and the dates it was active), but no message content, no Google user data, and no OAuth tokens remain.

8. Data Retention

9. Third-Party Sub-processors

We share the minimum data necessary with the following sub-processors so they can deliver their part of the service:

10. International Data Transfers

Your per-user virtual machine is hosted in the EU or US, selected automatically by your phone country code. Other infrastructure (Firestore, KMS, audit logs) is in EU regions. AI model providers may process data in the US or EU. We rely on Standard Contractual Clauses, where applicable, for transfers between jurisdictions.

11. Your Rights

Subject to applicable data-protection law in your jurisdiction (e.g., GDPR in the EU/EEA, UK GDPR, CCPA in California), you have the right to:

To exercise any of these rights, message the Clawless bot from the WhatsApp / Telegram account on file (which proves control of the phone number — our identity primitive). The operator monitors the support@myclawless.com address for regulator and security disclosures, but customer-account actions (access, export, deletion) are handled through the phone-number channel.

12. Children's Privacy

Clawless is not directed at children under 13 (or 16 in jurisdictions where that is the digital-consent age). We do not knowingly collect personal information from children below those ages. If you believe we have received such data, contact us and we will delete it.

13. Security Disclosure

Clawless follows defense-in-depth practices: per-user encryption keys, central enforcement of usage limits, cryptographic shredding for deletion, IAM-conditional access to user data, and append-only audit logging in a separate Google Cloud project. If you believe you have found a security vulnerability, please email support@myclawless.com with details.

14. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated by updating the "Last updated" date and, where required by law, by direct notice to active users. Continued use of the service after changes take effect constitutes acceptance of the updated Policy.

15. Contact

For privacy questions, data-subject requests, or security disclosures, contact support@myclawless.com.