Privacy Policy

1. Who We Are

CLPeasy® is operated by Michaela Feeley. Our registered business address is CLPeasy, 66 Paul Street, London, EC2A 4NA. We are the data controller for your personal data.

Contact: support@clpeasy.com

2. What Data We Collect

Data	Why we collect it	Legal basis
Email address	Account creation, login, system emails	Contract performance
Password (hashed)	Account security	Contract performance
Business name & address	Appears on your CLP labels (saved in your browser, not in your CLPeasy account)	Contract performance
Label data (scent name, hazard info etc)	Generating your labels. Saved labels are kept in your browser. When you download a label, we record its product name, product type, shape and size with the download, to count your downloads and allow free re-downloads of the same label within 7 days	Contract performance
Payment data	Processing subscriptions and Pay As You Go purchases (handled by Stripe — we do not store card details). For Pay As You Go, your request for the credits to be added straight away, with its date and time, is recorded with the payment	Contract performance
Usage data (pages visited, features used)	Improving the service. Page visits are counted with Plausible Analytics, which produces aggregated statistics and does not use cookies. You can turn analytics off at any time with "Essential only" on the cookie banner or in our Cookie Policy	Legitimate interests
Questions you type into Guide Me (in the Builder) or the Knowledge Base search	Answering your question. Only what you type is sent to Anthropic: your Knowledge Base question, or for Guide Me your message with up to the last 8 messages of the conversation, together with fixed instructions written by CLPeasy. We do not send your name, email address, account details or label data. Using these features is optional; both are labelled as AI. Please do not type personal information you do not want shared	Legitimate interests (giving you the help you ask for)
Support form messages (name, email, description of the problem and browser details you choose to give)	Answering your support request (delivered to us by email through Brevo)	Legitimate interests
IP address	Security, fraud prevention, and limiting how many Guide Me and Knowledge Base questions can be asked each day	Legitimate interests

3. How We Use Your Data

We use your data to:

• Provide and maintain the CLPeasy service
• Send account-related emails (verification, password reset, subscription notifications)
• Process payments and manage your subscription
• Improve and develop the service
• Comply with legal obligations
• Prevent fraud and abuse
• Send a confirmation email when you pause your subscription. We do not send offers to stay or invitations to come back after you cancel.

We will never sell your personal data to third parties or use it for advertising purposes.

4. Data Storage and Security

Your data is stored securely in Supabase (AWS eu-west-2, London region). All data is encrypted in transit using TLS and encrypted at rest. We implement appropriate technical and organisational measures to protect your data.

Payments are processed by Stripe — we do not store your card details. Stripe is PCI DSS compliant.

Your saved labels, business details, label folders and history are stored in your own browser, not in our database. The SDS text you paste into Smart Paste is processed in your browser to read the hazard information; it is not sent to CLPeasy or to any third party.

Our database (Supabase) is hosted in London. Some of our service providers store or process data outside the UK:

• Zoho Mail, Brevo and Plausible store data in the European Union (Zoho's EU data centre; Brevo in France, Germany and Belgium; Plausible in Germany). The UK recognises the EU as providing adequate protection for personal data.
• Stripe: transfers from the UK are covered by the UK International Data Transfer Addendum, which Stripe incorporates in the Data Transfers Addendum to its Data Processing Agreement.
• Anthropic (United States): transfers are covered by the Standard Contractual Clauses in Anthropic's Data Processing Addendum, which forms part of Anthropic's Commercial Terms.
• Netlify (United States): Netlify is certified under the UK Extension to the EU-U.S. Data Privacy Framework, and its Data Processing Addendum also includes Standard Contractual Clauses.
• When you sign in with Google, or when your browser loads fonts from Google Fonts or software libraries from jsDelivr or cdnjs, your browser connects to those services directly, and they handle that connection under their own privacy policies.

5. Data Retention

We retain your account data for as long as your account is active. Specifically:

• If you cancel your subscription, your account remains open unless you request deletion. Labels saved in CLPeasy are currently stored in the browser and device where you created them rather than in your CLPeasy account, and may be lost if that browser's site data is cleared. Keep downloaded label files and source records safely backed up.
• If you request deletion of your account, we will delete your personal data within 30 days of your request.
• Financial records (payment history, invoice data) are retained for 7 years as required by UK tax law, even after account deletion.
• Labels you have downloaded to your own device are yours to keep and are not affected by account deletion.
• Download records (product name, type, shape and size) are kept while your account exists and are deleted automatically when your account is deleted.
• Daily question-limit records (an IP address, the date and a count of questions) are not currently deleted automatically.
• Questions sent to Anthropic: under Anthropic's standard terms for API customers, inputs and outputs are deleted within 30 days, except where Anthropic's automated systems flag a request as breaching its usage policy (kept for up to 2 years).

To request account deletion, email us at support@clpeasy.com with the subject line "Account deletion request". We will confirm deletion within 30 days.

6. Third Parties

We share data with the following third parties only where necessary to provide the service:

• Supabase — database and authentication (AWS London region)
• Stripe — payment processing
• Zoho Mail — our support@ and noreply@ mailboxes (EU data centre), including messages you send to support@clpeasy.com, and sending of account emails such as sign-up verification and password reset
• Brevo — onboarding and account email delivery (e.g. welcome, trial reminder, subscription pause and cancellation emails), and delivery of messages you send through our support form
• Anthropic — AI service that answers questions you type into Guide Me in the Builder or the Knowledge Base search (your question is sent to Anthropic to generate the answer)
• Plausible Analytics — privacy-focused website visit statistics
• Google — optional Google OAuth login (only if you choose to sign in with Google)
• Netlify — website hosting
• Google Fonts, jsDelivr and cdnjs — deliver fonts and software libraries to your browser when pages load, which means your browser's IP address is sent to them

All third parties are required to handle your data in accordance with applicable data protection law.

7. Cookies

We use cookies and similar technologies. Please see our Cookie Policy for full details.

8. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a portable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any of these rights, contact us at support@clpeasy.com. We will respond within 30 days. For account deletion requests, please use the subject line "Account deletion request". For data access requests, please use "Data access request". There is no charge for exercising these rights.

9. Children's Privacy

CLPeasy is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email. The date at the top of this page shows when it was last updated.

11. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

12. Contact

For any privacy-related queries, contact us at support@clpeasy.com.