Privacy Policy

The data controller responsible for your personal data is:

Clagus Group OÜ
Trading as Clagus Solutions
Tallinn, Estonia
Email: contact@clagus.com

When you create a Clagus account or use the platform, we collect:

• Account details — your name, email address, and password (stored as a salted hash, never in plain text).
• Business details — legal business name, trading name, country, and base currency, provided during account setup.
• Authentication data — passkey (WebAuthn) public-key credentials and multi-factor authentication enrollment data, if you enable them.
• Payment and transaction records your business processes through Clagus — amounts, currencies, statuses, and reconciliation records. Card numbers and CVVs are never collected or stored by Clagus; they go directly from your customer's browser to our connected, regulated payment providers, and Clagus only ever receives a provider-issued token.
• Audit and security logs — a record of actions taken in your account, kept for security and compliance purposes.

Contract (Art. 6(1)(b) GDPR): processing your account and business data is necessary to provide the Clagus platform under the terms you agree to when you create an account.

Legitimate interests (Art. 6(1)(f) GDPR): we process certain data — audit logs, security monitoring, fraud prevention — to operate and secure the platform, where our interest in doing so does not override your rights and freedoms.

Legal obligation (Art. 6(1)(c) GDPR): we retain certain records where required by applicable financial recordkeeping or tax law.

• Operating your Clagus account and dashboard.
• Coordinating onboarding with the regulated payment and banking partners you connect to.
• Routing, processing, and reconciling payments on your instruction through those connected partners.
• Detecting fraud, securing accounts, and maintaining an audit trail for compliance purposes.
• Complying with our own legal and regulatory obligations.
• Operational communications about your account (e.g. security notices). We do not currently send marketing email, and we do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

We share data with the following categories of recipient, strictly for the purposes above:

• Regulated payment service providers and banking partners you connect your business to — only the data necessary for onboarding review and to process the payments you instruct.
• Infrastructure providers — our application is hosted on Vercel and Render, and our database runs on Supabase. These providers act as data processors and do not use your data for their own purposes.

We do not sell your data to third parties, and we do not currently use any advertising or analytics trackers on this platform (see Section 7).

We retain account and transaction data for as long as your account remains active, and for a limited period afterward as required to meet legal, tax, and financial recordkeeping obligations. You may request deletion of your account data at any time, subject to those obligations — see Section 8.

Strictly necessary only. Clagus uses a session cookie and a CSRF-protection cookie to keep you securely signed in. These are required for the platform to function and are not set until you sign in.

We do not currently use analytics, advertising, or marketing tracking technologies (such as Google Analytics or the Meta Pixel) anywhere on this platform. If that changes, this policy — and, where required, a cookie consent mechanism — will be updated before any such tracking is enabled.

As a data subject under GDPR, you have the right to:

Access (Art. 15)

Request a copy of the personal data we hold about you.

Rectification (Art. 16)

Request correction of inaccurate or incomplete data.

Erasure (Art. 17)

Request deletion of your data (‘right to be forgotten’).

Restrict processing (Art. 18)

Request that we limit how we use your data.

Data portability (Art. 20)

Receive your data in a structured, machine-readable format.

Object (Art. 21)

Object to processing based on legitimate interests.

To exercise any of these rights, email contact@clagus.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Our infrastructure is hosted in the United States (Vercel, Render, and Supabase). Where personal data originating in the EU/UK is transferred outside the EEA, we rely on Standard Contractual Clauses or another valid transfer mechanism under GDPR Chapter V.

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes. We encourage you to review this policy periodically.

For any questions about this Privacy Policy or your personal data, contact us at contact@clagus.com.