Privacy Policy

We recognize that instructional materials, enterprise training curricula, corporate source documents, and learner interaction logs represent confidential, proprietary business assets. We maintain a strict and verifiable policy regarding generative artificial intelligence:

We do not use your proprietary content, source documents, prompts, scripts, generated media, or learner interaction data to train, retrain, or fine-tune public foundation models, proprietary artificial intelligence models, or third-party commercial algorithms.

When you utilize our generative AI capabilities—including Content Studio storyboarding, scriptwriting, voiceover generation, image synthesis, or conversational role-plays—your inputs are processed via secure enterprise API endpoints with our authorized foundation model providers (such as Google Cloud Vertex AI and OpenAI). Under our commercial enterprise agreements with these providers:

• Your inputs (prompts, source files, reference images) and outputs (scripts, storyboards, audio, graphics) are not retained by the model providers for model training or machine learning improvements.
• All data in transit to and from AI inference endpoints is encrypted using high-grade TLS protocols.
• Model processing occurs transiently in-memory to generate the requested response, after which persistent assets are stored exclusively in your designated project repository.

Back to top

We use the personal information we collect for the following specific business and operational purposes:

• Service Delivery and Operation: To create and maintain your account, authenticate authorized users and AI agents, process project files, generate storyboards, render synthesized voiceover audio, produce synchronized captions, and serve cloud data widgets.
• Billing and Account Administration: To process subscription payments, calculate credit consumption, manage automated credit refills, issue tax-compliant invoices, and prevent fraudulent billing activity.
• Communication and Support: To deliver essential transactional emails, service alerts, security advisories, billing receipts, and administrative notices, and to respond to technical support inquiries.
• System Security and Integrity: To monitor API and MCP endpoint traffic, detect and prevent malicious attacks, enforce rate limits, investigate suspicious activity, and maintain the security of our infrastructure.
• Product Enhancement and Reliability: To identify software bugs, analyze aggregated platform usage trends, optimize server capacity, and refine platform workflows without using your private course content for public model training.
• Legal Compliance: To comply with applicable statutory obligations, tax regulations, law enforcement subpoenas, and court orders, and to enforce our Terms of Service.

Back to top

We recognize that organizations operating in regulated industries, government sectors, or specific jurisdictions must adhere to strict data sovereignty and residency rules. For our persistent data services, Cluelabs provides customers with the capability to select their preferred primary data storage region.

Supported Persistent Offerings

When you configure any of the following offerings, you are presented with options to select the geographic region where your project assets, learner records, and database entries are stored:

• Content Studio: Storyboard databases, project files, generated audio clips, captions, and graphics.
• xAPI Learning Record Store (LRS): Complete xAPI statement streams and learning analytics data.
• User Flow Analytics: Learner slide transition logs and session drop-off analytics.
• Data Cloud: Persistent learner course variables and cloud database records.
• Translation: Stored multi-language translation dictionaries and localized strings.
• PDF Maker (Stored Templates): Stored DOCX templates and generated document repositories.

We currently offer data storage options across more than 40 certified data centers on 6 continents, including dedicated regions in the United States, European Union, United Kingdom, Canada, and Asia-Pacific.

Stateless and Pass-Through Services

Certain platform widgets operate as stateless pass-through utilities that do not store learner records, transactional inputs, or personal data on our servers. These include:

• Closed Captioning: Converts audio tracks directly to timed captions in real time without storing media copies.
• Two-Way Google Sheets Sync: Authenticates and routes data directly between course instances and your Google Sheets spreadsheet without intermediate storage or logging.
• Dynamic PDF Generation: Compiles and outputs personalized PDF documents dynamically to the learner's browser without retaining generated copies.
• Timers and Progress Bars: Run entirely client-side in the learner's browser without transmitting learner identity or state back to our servers.

Back to top

We retain personal information and project data only for as long as necessary to fulfill the operational purposes for which it was collected, maintain your account in good standing, satisfy legal, tax, and accounting requirements, and resolve potential disputes.

• Active Account Data: Project files, storyboards, uploaded media, and generated assets are retained for the active lifecycle of your account.
• Learner Records (Processor Data): xAPI statements, User Flow logs, and Data Cloud records are retained according to the retention window or storage tier selected by the customer in their account settings.
• Billing Records: Transaction history, invoices, and payment receipts are retained for a minimum of seven (7) years to comply with statutory accounting and tax audit regulations.
• Server and Diagnostic Logs: Network access logs, API telemetry, and diagnostic logs are retained on a rolling cycle, typically between thirty (30) and ninety (90) days, after which they are permanently deleted or anonymized.

Account Termination and Erasure

You may request the deletion of your account and associated personal data at any time by contacting us through our contact page. Upon receiving a verified deletion request:

• Your user account will be deactivated and inaccessible.
• Your project files, customer materials, storyboards, and custom variables will be removed from our primary production databases.
• Backups and disaster recovery snapshots will overwrite and purge deleted records in accordance with standard backup rotation schedules (typically within 30 to 90 days).

Back to top

This Section applies solely to residents of California and other United States jurisdictions with comprehensive consumer privacy laws (including Virginia, Colorado, Connecticut, and Texas). This disclosure describes our practices regarding the collection, use, and disclosure of Personal Information in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

Notice at Collection: Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information for business purposes:

• Identifiers: Real name, professional email address, account password hash, IP address, unique online identifiers, and API tokens.
• Commercial and Financial Information: Records of products purchased, subscription tiers, credit package transactions, billing address, and payment card metadata (last four digits and expiration).
• Internet and Electronic Network Activity: Browser type, operating system, page interactions, referring URLs, API endpoint request logs, and platform telemetry.
• Professional or Employment-Related Information: Job title, department, employer or educational institution name provided during account setup.
• Geolocation Data: General geographic location derived from IP address (country and city level).
• Audio and Visual Materials: Narration voice recordings, synthesized speech audio files, custom avatar prompts, and reference graphics submitted to Content Studio.

We collect these categories directly from you, automatically via your device, and from our payment processor, Stripe. We use these categories for the business purposes described in Section 4 of this Policy.

Sale and Sharing of Personal Information

In the preceding twelve (12) months, Cluelabs has not sold personal information and has not shared personal information for cross-context behavioral advertising. We have no actual knowledge of selling or sharing personal information of consumers under sixteen (16) years of age.

California Consumer Rights

As a California resident, you possess the following rights under the CCPA:

• Right to Know and Access: The right to request disclosure of the specific pieces and categories of personal information collected, the sources of collection, the business purpose for collection, and the categories of third parties with whom data is shared.
• Right to Delete: The right to request the deletion of personal information collected from you, subject to statutory retention exceptions.
• Right to Correct: The right to request the correction of inaccurate personal information maintained in your profile.
• Right to Opt-Out of Sale / Sharing: Although we do not sell or share personal information, you maintain the right to register your opt-out preference. We recognize the Global Privacy Control (GPC) signal transmitted by compatible web browsers.
• Right to Non-Discrimination: We will not discriminate against you in pricing, service level, or platform availability for exercising any statutory privacy rights.

To exercise your California privacy rights, please submit a verifiable consumer request via our contact page or email privacy@cluelabs.com.

Back to top

We maintain comprehensive administrative, technical, and physical safeguards engineered to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure. Our security controls include:

• Encryption: All web traffic and API calls are secured using Transport Layer Security (TLS 1.3/HTTPS). Stored project assets, databases, and backup files are encrypted at rest using industry-standard AES-256 encryption algorithms.
• Access Control: Platform infrastructure and internal databases operate under strict role-based access control (RBAC), multi-factor authentication (MFA), and the principle of least privilege.
• Network Security: Virtual private cloud (VPC) isolation, web application firewalls (WAF), automated distributed denial-of-service (DDoS) mitigation, and continuous intrusion monitoring.

Data Breach Notification

In the event of a confirmed security incident resulting in the unauthorized access, disclosure, or destruction of personal data under our custody, we will take immediate remediation steps to contain the incident. If the breach presents a risk to the rights and freedoms of individuals, we will notify affected account holders and relevant regulatory authorities without undue delay and within the timeframes mandated by applicable law (including 72-hour notification where required under GDPR).

Back to top

We use cookies and similar browser storage technologies to operate the Platform securely and efficiently:

• Strictly Necessary Cookies: Essential for platform functionality, user authentication, session security, CSRF protection, and load balancing. These cookies cannot be disabled without disabling access to the Platform.
• Functional Cookies: Remember your interface preferences, such as selected language locale, active workspace views, and regional data storage defaults.
• Performance and Analytics: Collect aggregated, anonymized metrics regarding page response times, navigation patterns, and application errors. We do not use third-party behavioral tracking cookies or advertising pixels.

You can configure your browser settings to reject or delete cookies. However, if you disable all cookies, you will not be able to log in, authenticate, or access core features of the Platform.

Back to top

We reserve the right to revise, modify, or update this Privacy Policy at our discretion to reflect platform enhancements, operational changes, subprocessor updates, or evolving legal requirements. When modifications are made, we will update the "Last Updated" date at the top of this Policy and publish the revised version on the Platform.

For material modifications that significantly alter how we process your personal data, we will provide reasonable advance notice through an in-app banner or an electronic communication delivered to your registered email address. Your continued access to or use of the Platform following the effective date of the updated Policy constitutes your acknowledgment and acceptance of the revised terms.

Back to top