Privacy Policy

This Privacy Policy explains how Cogaid Solutions Private Limited("MakersClaw", "we", "us") collects, uses, shares, and protects personal data when you use the MakersClaw platform, its AI agent service, and related websites and APIs (together, the "Service"). It applies to users worldwide, including users in the European Economic Area (EEA), the United Kingdom, and California.

1. Data Controller

The controller of your personal data is Cogaid Solutions Private Limited, 8/1/1 Hardutt Rai Chamaria Road, Howrah, West Bengal 711101, India. For all privacy requests: hello@makersclaw.com.

1.1 EU/EEA Representative

Pursuant to Article 27 of the EU General Data Protection Regulation, our representative in the European Union for data subjects and supervisory authorities is:

Shreyans Kumar Bhansali
Liselotte Herrmann Strasse 38, 10407 Berlin
Germany
Email: bhansali@cogaid.tech

EU/EEA data subjects may contact our EU representative in any official EU language in connection with the processing of their personal data by MakersClaw.

1.2 United Kingdom

MakersClaw does not currently maintain a dedicated UK representative under Article 27 of the UK GDPR. Until a UK representative is appointed, UK data subjects may contact us directly at hello@makersclaw.com for data-subject requests. We will update this section as our UK presence expands.

1.3 Processing on behalf of business users

When a business or individual user uses their MakersClaw agent, or a website or application deployed through the Service, to interact with their own customers or end users, that user is the data controller for those end users' personal data, and MakersClaw acts as the data processor, processing that data solely on the user's instructions and for the purpose of operating the Service. Our Data Processing Addendum governs that relationship. If you are an end user whose data is being processed through MakersClaw, please contact the user who operates the workspace or application in the first instance; we will cooperate with them to address your request.

2. What data we collect

2.1 Information you provide

• Account data: name, email address, username, password hash (via Supabase Auth), avatar, profile metadata, and OAuth identifiers if you sign in with Google.
• Workspace content: chat messages and prompts, files you upload, agent configurations (skills, memories, briefs, and automations), websites and applications you deploy, data you store in workspace databases, and anything else you choose to store in your workspace.
• Payment data: billing address, tax identifiers, and subscription details. Card data is entered directly with our payment processor (Paddle) and is not stored on our servers.
• Communications: support requests, feedback, and correspondence with us.

2.2 Information collected automatically

• Usage and device data: IP address, browser type, operating system, device identifiers, referring and exit pages, and timestamps.
• Cookies and similar technologies: see our Cookie Policy.
• Analytics: we do not currently use a third-party analytics provider. Usage figures shown in the product are computed from your own workspace activity in our database.
• Logs and telemetry: error logs, performance metrics, and security events used to operate the Service.

2.3 Information from third parties

If you sign in with Google, we receive basic profile information from Google in accordance with the permissions you grant. If you connect a third-party application or messaging channel to your workspace, we receive the minimum identifiers and data needed to operate that integration.

3. How we use your data

We process personal data to:

• create and manage your account;
• provide, operate, and maintain MakersClaw and your workspace agent;
• process payments, manage subscriptions, and invoice you via Paddle;
• provide customer support and respond to your requests;
• secure the Service, prevent abuse, enforce our Terms, and comply with legal obligations;
• send transactional emails (for example account, billing, and service notices);
• with your consent, send product updates and marketing emails (you can unsubscribe at any time);
• analyze usage to improve the Service, fix bugs, and develop new features.

We do not use your content, prompts, agent memory, or AI outputs to train, fine-tune, or evaluate any machine learning model, and we do not sell or rent your personal data.

4. Legal bases (EEA/UK users)

If you are in the EEA or the United Kingdom, we rely on the following legal bases under Article 6(1) GDPR:

• Contract (Art. 6(1)(b)): to provide the Service you signed up for, including account management, billing, and the workspace agent.
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and abuse, analyze aggregate usage, and improve the product. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): for optional analytics cookies, marketing emails, and any other processing that requires consent. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, and other legal requirements.

5. Subprocessors and sharing

We share personal data with the companies below. Each subprocessor processes it only on our instructions and is bound by a written agreement with data-protection obligations. Where a service acts for itself or for you, we say so. We tell you before we add a subprocessor, replace one, or move where your data is held (see section 6 of our Data Processing Addendum). The "Last updated" date at the top of this page changes whenever this list changes.

5.1 Subprocessors (they act on our instructions)

• Supabase, Inc. — database, authentication, and object storage (your account, workspace records, chat history, and files). Region: United States (Amazon Web Services, N. Virginia, us-east-1).
• Vercel Inc. — application hosting, serverless compute, sandboxed execution environments for your workspace agent, and hosting of websites and applications you deploy. Region: United States (Washington, D.C. area, Vercel region iad1, which is Amazon Web Services us-east-1). Vercel also caches pages and files on a global edge network, so a copy of public content may be served from a location near the visitor. Vercel's own control systems and build machines are also in the United States.
• Neon Inc. — managed Postgres databases for your workspace and the applications you create through the Service. Region: United States. New workspace databases are created in N. Virginia (us-east-1). Some existing ones are in Ohio (us-east-2) or Oregon (us-west-2).
• AI model providers (such as Anthropic and OpenAI), reached through the Vercel AI Gateway — process your prompts, relevant workspace context, and generated outputs solely to produce responses. Under the provider terms we rely on, your data is not used to train their models. Region: we do not pin where a request is processed. It may be processed in the United States or in another country where the model provider operates.
• Resend — transactional email and newsletter delivery (sign-in codes, account and billing notices). Region: United States (Amazon Web Services us-east-1). Resend stores account data and logs in the United States.
• Tavily (AlphaAI Technologies, Inc.) — web search and page fetch, when your agent searches the web. It receives the search query or page address, which can contain personal data. Region: United States (Amazon Web Services us-east-1).
• Composio (Sampark Inc.) — brokers OAuth connections to third-party applications you explicitly connect; receives the identifiers and data needed to run the actions you or your agent request there. Region: not published by the provider.
• Zero (The People's Internet Experiment, Inc., doing business as ZeroClick) — marketplace for paid external capabilities; receives only the request data needed when your agent uses one on your instruction. Region: United States (Oregon). A record of each payment is written to a public ledger that cannot be edited or deleted.
• Cloudflare, Inc. — Turnstile, the bot check on the email sign-in form. It sees your IP address, browser identifier, and connection fingerprint. Region: Cloudflare's global edge network (no region choice).
• Sanity — our content system for public blog and newsletter text. It holds no member data; the only personal data is that of our own editors. Region: Belgium (Google Cloud europe-west1).
• Zoho — our team email. It holds the messages you send to hello@makersclaw.com, including privacy requests and support. Region: India (Zoho .in data centre).

5.2 Services that act for themselves or for you

• Paddle.com Market Limited — Merchant of Record: payment processing, invoicing, tax. Paddle is an independent controller of payment data under its own privacy notice. Its entities are in the United Kingdom, Ireland, the United States, and Canada. It publishes no hosting region.
• Google — if you choose "Sign in with Google", Google handles that sign-in under its own privacy policy, and we receive the basic profile information described in section 2.3. Region: global.

We may also disclose personal data (a) to comply with law, court orders, or lawful requests from public authorities; (b) to enforce our Terms, protect our rights, or investigate suspected abuse; and (c) to a successor entity in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

6. International transfers

Our main hosting is in the United States. Our database, sign-in, and file storage run on Amazon Web Services in N. Virginia, through Supabase. Our application servers and your workspace's execution environment run in Vercel's Washington, D.C. area region. Your workspace database runs on Neon in the United States. Section 5 gives the location of every subprocessor. A few are elsewhere: for example, Sanity (Belgium) holds only our public blog and newsletter text, Zoho (India) holds our team email, and requests to AI model providers may be processed in other countries where the provider operates.

MakersClaw is run from India, and India has no adequacy decision from the European Commission. So when personal data moves from the EEA, the UK, or Switzerland to us, or from us on to a subprocessor in the United States or elsewhere, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, the Swiss addendum, and supplementary measures such as encryption in transit and at rest and access controls. Our agreements with subprocessors carry the SCCs or an equivalent safeguard.

You can ask for a copy of the safeguards that apply to you by writing to hello@makersclaw.com.

7. Retention

We retain personal data only for as long as we need it to provide the Service. Specifically:

• Active accounts: we retain your account data and content for the lifetime of your account.
• User-initiated deletion: when you delete a workspace or your account, the associated personal data, workspace content, and deployed resources are deleted immediately. There is no soft-delete or grace period. Backup copies are overwritten on our normal backup rotation.
• Payment failures and empty balances: if a renewal payment fails or your credit balance reaches zero, paid features are suspended but we do not automatically delete your account or workspace data; it is retained until you delete it or your account is closed.
• Legal, tax, and accounting records: invoices, billing history, and records required to comply with tax, accounting, anti-fraud, or other legal obligations are retained for the period required by applicable law (typically 6–8 years under Indian tax law), regardless of account deletion.
• Audit and security logs: retained for a reasonable period for fraud prevention, dispute resolution, and security investigations.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (right to be forgotten);
• Restrict or object to certain processing, including direct marketing;
• Portability: receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, email hello@makersclaw.com. We will respond within the time limits set by applicable law, typically within 30 days.

9. California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information as defined under the CCPA/CPRA. We do not sell or share personal information as defined under California law. You may exercise your rights by emailing hello@makersclaw.com. We will not discriminate against you for exercising your rights.

10. Security and breach notification

We implement technical and organizational measures appropriate to the risk of processing, including encryption in transit (TLS), encryption at rest for databases and storage, role-based access controls, row-level security policies, isolated per-workspace execution sandboxes, regular backups, and access logging. No system is perfectly secure. If you become aware of a security issue, please contact hello@makersclaw.com immediately.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify affected users and the relevant supervisory authorities without undue delay and, where required by law, within 72 hours of becoming aware of the breach, in accordance with Articles 33 and 34 of the GDPR and equivalent obligations under other applicable laws.

10a. Support communications

When you contact us at hello@makersclaw.com or any other published address, we retain your message, any attachments, and our replies so we can handle your request, follow up, and improve support quality. Support correspondence is retained for as long as needed to resolve the matter and for a reasonable period thereafter for audit and training, and is deleted or anonymized on request subject to legal and accounting retention obligations.

11. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided personal data to us, please contact us and we will delete the data promptly.

12. Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you through solely automated means. We operate automated systems for abuse detection, rate limiting, and security (for example, to flag suspicious sign-ups or payment activity), but any permanent action against an account — such as suspension or termination for cause — is reviewed by a human before it takes effect, except where immediate action is required to prevent imminent harm to the Service or its users.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, notify you by email or an in-product notice before the changes take effect.

14. Contact

For privacy questions, data-subject requests, or complaints, please contact us at hello@makersclaw.com, or by post to Cogaid Solutions Private Limited, 8/1/1 Hardutt Rai Chamaria Road, Howrah, West Bengal 711101, India.