Privacy Policy

• This Privacy Policy explains how “Sunny Side Labs P.C.”, operating under the distinctive title “Clam AI”, a company established under the laws of Greece, with its registered seat at Leof. Kifisias 44, Marousi, 15125 (“we”, “us”, “our”) collect, use, share, and protect personal data when you visit our website, register for an account, and use the Clam Services (the “Services”). This Policy applies to everyone who uses the Services or visits our website. It explains how we handle personal data, such as your account and authentication data, billing, support correspondence, and our communications with you.

1. Personal Data We Collect

• We process different categories of personal data depending on how you use the Services, the services and accounts you connect, and the instructions and permissions you provide. Data may be collected from different sources, including directly from you, from accounts and services you choose to connect, from our service providers and authentication or payment partners, and automatically through your use of the Services and our websites. In particular, the categories of personal data we may process include:
• Account and profile information: This includes information used to create and manage your account, such as your name, email address, account identifiers, authentication information, preferences, and account settings.
• Connected account and email data: When you connect your email account for the provision of the Services, we access and process certain information made available through that connection. This includes email addresses and other identifiers of senders and recipients, email subject lines, dates and times, email metadata, attachments, labels, folders, and other information contained in or associated with your communications. This information may relate to you or to other individuals with whom you communicate.
• Instructions, prompts, and agent configuration data: This includes instructions, prompts, rules, permissions, access controls, agent configurations, approval requirements, schedules, preferences, and other information you provide to configure the Services.
• Activity and operational data: This includes information about activities performed through the Services, such as actions requested or executed by AI agents, timestamps, action status, relevant identifiers, execution results, classifications, approvals, and other information necessary to operate, secure, monitor, and audit the Services.
• Communications and support data: This includes information contained in communications you send to us, including support requests, feedback, inquiries, and other correspondence.
• Subscription and billing information: This includes information relating to your subscription and transactions, such as billing details, subscription status, transaction history, and billing contact information. Payment information may be collected and processed directly by our payment service providers.
• Cookie and similar technology data: We may collect information through cookies and similar technologies, including information about your preferences, interactions with our websites and Services, and usage of our online properties, in accordance with applicable law and your choices where required.

2. How and Why We Use Personal Data

• This Section explains the purposes for which we use personal data and, where the law applicable to you requires us to identify a legal basis for doing so, the legal basis on which we rely.

3. How We Share Personal Data

• We share personal data with third-party recipients, only to the extent necessary for the purpose described, and only where the recipient is bound by appropriate confidentiality and data protection obligations. In particular, we utilize the following categories of third-parties:
  • • To operate the Services, we rely on providers that host our application and database infrastructure, handle account authentication and email authorisation, and execute and sequence Shell actions on our behalf. We also rely on providers that deliver our automated Service emails and approval notifications. Lastly, information about you may be collected by our payment providers that process subscription payments.
  • • Email content and the instructions you give us are shared with our artificial intelligence providers, which classify email content and generate the access policies applied to your Shells. Each of those providers processes that data under its own standard terms. The current list of these and all our other providers is available in the DPA.
  • • We use support and error-monitoring tools to respond to your requests and to diagnose technical problems. Our error-monitoring tooling is configured to exclude mailbox content, Shell policies, classification data, credentials and message bodies. Separately, analytics and advertising partners measure use of our public marketing pages only, and operate subject to the cookie choices you make. No mailbox content, Shell configuration or signed-in activity is shared with those partners.
  • • Lastly, we may disclose personal data to our professional and legal advisers, and to regulators, courts or law enforcement authorities, where necessary to comply with a legal obligation, to establish, exercise or defend legal claims, or to protect our rights or the rights of others. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor entity, which will remain bound by this Policy or by a policy offering equivalent protection.
• We do not sell your personal data, and we do not use your account data or the contents of your mailbox to serve advertising to you.

4. International Data Transfers

• Our core application and database infrastructure is hosted within the European Economic Area. However, some of the recipients of your personal data may process or store personal data outside the country or region where you are located. Where we transfer personal data internationally, we put in place appropriate safeguards required under applicable law, such as standard contractual clauses or other internationally recognized transfer mechanisms, and we assess the protections available in the receiving country before the transfer takes place.

5. Data Retention

• We keep personal data only for as long as we need it for the purposes described in this Policy, and then delete it or render it irreversibly anonymous. Where no fixed period is specified below, the retention period is determined by reference to the purpose for which the personal data is held, the period for which retention is necessary in order to provide and support the Services, any retention period prescribed by applicable law, and the period within which a claim relating to the personal data could reasonably be brought. Personal data may be retained beyond those periods to the extent necessary to comply with a legal obligation, to resolve a dispute, or to establish, exercise or defend legal claims.

6. Security

• We implement technical and organisational measures appropriate to the risk presented by our processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Those measures include the encryption of personal data in transit and at rest; authentication and access controls that limit access to personal data to those who require it for a defined purpose; logging of access to our systems and of the actions carried out through the Services; and periodic review of our measures as the Services develop. We select infrastructure providers and sub-processors that maintain recognised security practices, and we impose confidentiality and security obligations on them by contract.

7. Your Rights

• Depending on where you live, you may have rights to: access the personal data we hold about you; correct inaccurate data; request deletion; restrict or object to certain Processing; receive a copy of your data in a portable format; and withdraw consent at any time where Processing is based on consent, without affecting the lawfulness of Processing before withdrawal. You can exercise many of these choices directly within your account — including revoking Shell access, adjusting notification preferences, and requesting account deletion — or by contacting us at privacy@useclam.ai. You may also have the right to lodge a complaint with the data protection authority or equivalent regulator responsible for your location. We will not discriminate against you for exercising these rights.

8. Cookies and Similar Technologies

• We use cookies and similar technologies for analytics, advertising measurement and retargeting. Depending on your location, optional analytics and advertising cookies are set only with your consent, obtained through a cookie control that lets you make separate choices for analytics and advertising, reject cookies as easily as you accept them, and withdraw your consent at any time. Where the law applicable to you permits these technologies to be used without your prior consent, we use them on that basis and you may opt out at any time using the controls available on our website.

9. Google User Data

• Clam connects to your Gmail mailbox through Google's APIs, using the permission you grant at Google's consent screen. We request a single Gmail scope, https://www.googleapis.com/auth/gmail.modify, which lets us read, label, draft, send, archive and move to trash messages in your mailbox on your behalf and on the instructions you give us. We do not request, and cannot perform, permanent deletion of your mail. You can review or withdraw this access at any time in your Google Account's security settings, or by disconnecting your mailbox in Clam.
• Clam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
• We use data obtained through Google Workspace APIs only to provide and improve the user-facing features described in this Policy. We do not retain or use that data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models, and we do not permit our artificial intelligence providers to do so. Where email content is sent to an artificial intelligence provider in order to classify messages or to generate the access policies applied to your Shells, it is processed only to return that result to you.
• We do not sell data obtained through Google APIs, we do not transfer it to third parties for advertising, credit assessment or lending purposes, and we do not use it to serve or personalise advertising. No human reads that data except where you have given us your explicit consent (for example, to resolve a support request you raise), where it is necessary for security purposes such as investigating abuse, where we are compelled to do so by applicable law, or where the data has been aggregated and anonymised so that it no longer identifies you or the people you correspond with.

10. Children's Privacy

• The Services is not directed to children. We do not knowingly collect personal data from individuals that may be deemed children under the applicable legislation. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

11. Changes to This Policy

• We may update this Policy from time to time. The “Effective date” at the top of this Policy indicates when it was last revised.

12. How to Contact Us

• If you have questions about this Policy or wish to exercise a right, contact us at privacy@useclam.ai.