Privacy Policy

Last updated: 2026-11-05

Controller and contact

Clariva is the controller of the personal data described in this policy.

  • Address: Trade Centre Rd, Dubai, United Arab Emirates
  • Website: https://clariva.co
  • Privacy: privacy@clariva.co
  • Support: help@clariva.co

Scope and jurisdictions

Clariva helps adults living in the United Arab Emirates manage their own personal debts by turning documents and other information into a debt diagnosis, self-advocacy options and documents for their review. Users decide whether and how to contact banks or creditors.

Clariva is a self-help and drafting tool. It does not provide legal, financial or debt-counselling advice, contact or negotiate with creditors on users’ behalf, or determine whether creditor conduct is lawful.

Data categories, purposes, and lawful bases

Users retain ownership of their uploaded data and content. The service processes uploaded data only under the following limited permission: A limited permission to store and process the user's documents, financial information and communications only as needed to produce the diagnosis, options and documents the user requests. Personal data is not sold, used for targeted advertising, or shared for unrelated purposes.

Clariva processes the following data for the purposes and on the bases listed:

  • Account and contact information: To create and secure accounts through Clerk and keep users’ display names, email addresses and phone numbers. Basis: Performance of a contract.
  • Identity details used to open protected bank statements: To unlock password-protected bank PDFs using the date of birth, last four digits of the Emirates ID and last digits of the phone number provided by the user. Clariva does not collect the full Emirates ID number. Basis: Performance of a contract.
  • Uploaded and emailed financial documents: To store documents users upload or forward to their personal Clariva inbound address and extract balances, transactions, interest and account details. For emailed documents, Clariva also keeps the sender, subject and recipient. Basis: Performance of a contract.
  • Debts, accounts, loans, buy-now-pay-later records, income and expenses: To build the user’s debt picture, budget and affordability position for the diagnosis and documents. Basis: Performance of a contract.
  • Private creditors: To record debts to family, friends or other private lenders added by the user. Users can choose to hide a creditor’s name in generated letters. Basis: Performance of a contract with the user; legitimate interests for the private creditor's details, limited to what the user enters.
  • Creditor communications log: To keep the user’s record of calls, emails, messages and meetings with creditors or collectors, including the counterparty and content, and note possible collector violations reported by the user. Basis: Performance of a contract.
  • Generated documents and case analysis: To produce statements, letters, requests, case packs and analyses for the user to review and use. Basis: Performance of a contract.
  • AI prompts and outputs: To draft letters and proposals and read buy-now-pay-later or card screenshots provided by the user. Basis: Performance of a contract.
  • Security and operational log data: To operate, secure and troubleshoot the service and prevent abuse. Basis: Legitimate interests.
  • Support and privacy request communications: To answer support, privacy and deletion requests and record the response. Basis: Legitimate interests and legal obligation.

Users retain ownership of their documents and data. Clariva stores and processes their documents, financial information and communications only as needed to produce the diagnosis, options and documents they request. Clariva does not sell personal data, use it for advertising or share it for unrelated purposes.

Public MCP / Plugin data flows when enabled

A public MCP or Plugin integration is not enabled.

Subprocessors

Clariva uses these service providers:

  • OpenAI: AI drafting of hardship letters and settlement proposals and reading user-provided buy-now-pay-later and card screenshots.
  • Anthropic: Backup provider for the same AI tasks when OpenAI is unavailable.
  • Clerk: Sign-in and session management.
  • Convex: Application database, backend functions and document file storage.
  • Vercel: Application hosting and delivery.
  • Postmark: Receiving documents forwarded to users’ personal Clariva inbound email addresses.
  • Supabase: Legacy database and file storage kept read-only as a rollback copy of data migrated to Convex.

International transfers

Service providers may process data outside the United Arab Emirates. Where a safeguard is required, Clariva relies on the provider’s contractual data-protection commitments or another lawful transfer mechanism.

Security

Clariva uses authenticated access through Clerk and checks each request against the signed-in user. Measures also include encryption in transit, managed infrastructure, a personal revocable inbound email address for each user, a managed secrets store and deletion of stored files when a user deletes a document. Raw inbound email capture is switched off at the email provider.

No system is guaranteed to be completely secure.

Retention

  • Account, profile, debts, budgets, communications and generated documents: Kept for the life of the account and afterwards only as needed to complete a deletion request, comply with law or resolve disputes.
  • Uploaded documents and extracted data: Kept until the user deletes the document. Deleting it also deletes its extraction results, linked loan and payment records and stored file.
  • Legacy rollback copy: Kept read-only until the migration rollback window closes, then deleted. It is also covered by deletion requests.
  • Security and operational logs: Kept for the shortest period reasonably needed for security, troubleshooting and legal obligations.
  • Support and privacy request records: Kept as long as needed to handle the request, demonstrate the response and comply with applicable law.

Individual rights and requests

Users may request access to and a copy of their personal data, correction of inaccurate or incomplete data, or deletion of their account and remaining data, subject to lawful exceptions. They may also delete individual documents in the app, object to or restrict certain processing where applicable, withdraw consent where consent is the basis, and lodge a complaint with the relevant authority.

To request deletion of an account and remaining data, email privacy@clariva.co from the account’s email address with the subject “Privacy Request (Clariva)”. Clariva responds without undue delay and within 30 days, or sooner where applicable law requires.

Deletion exceptions include records required to meet a legal obligation or establish, exercise or defend legal claims; information needed to prevent fraud, abuse or security incidents; and residual copies in managed backups and provider logs until they rotate out under the provider’s normal cycle.

Children

Clariva is intended only for adults managing their own personal debt and is not directed to children. A parent or guardian who believes a child has submitted personal data should contact privacy@clariva.co.

Automated decision-making when applicable

Clariva does not use automated decision-making. AI suggestions are starting points for the user to review; the user decides whether to use, change or send a document.

Changes and contact

For privacy questions or requests, contact privacy@clariva.co. For support, contact help@clariva.co.

© 2026 Clariva