Privacy Policy

Last updated: 2026-05-21 Effective date: 2026-05-21

1. Who we are

This Privacy Policy applies to Klar ("Klar", "we", "our", or "us") — a product of AEYEON Technologies Private Limited, a private limited company incorporated in India.

This policy describes what data we collect, how we use it, who we share it with, and what rights you have over it.

2. What we collect

We collect three categories of information:

2.1 Account information you provide

• Email address
• Full name
• Company name (optional)
• Password hash (never your plaintext password)
• Workspace name + role
• Billing details (handled by Paddle — see §4.4)

2.2 Usage telemetry we collect automatically

• Pages you visit within Klar
• Features you use (e.g. number of dashboards generated, datasets uploaded)
• Browser type, IP address, session timestamps (for security and abuse detection)
• Error logs and performance metrics (for debugging)

We use this telemetry to operate and improve Klar — never for marketing without your consent.

2.3 Customer Data you connect or upload

This is the most important category. Customer Data is the business data you bring to Klar so we can render dashboards on your behalf:

• Files you upload — CSVs, Excel files, copy-pasted tabular data
• Database connections you configure — for Postgres, MySQL, Snowflake, BigQuery, we store your connection credentials encrypted (AWS Secrets Manager) and read your tables on your behalf when you load a dashboard
• OAuth-connected SaaS data — when you connect Stripe, Google Analytics, or Google Sheets, we read data from those services using OAuth access tokens you grant us

You retain ownership of all Customer Data. Klar acts as a data processor; you (or your organization) are the data controller. Section §6 explains data retention.

2.4 Data we read via Google OAuth (specific disclosure for Google verification)

When you connect a Google service to Klar, you grant us read-only OAuth access via Google's standard consent flow. The exact scopes Klar requests, and how we use the data:

Klar does not write to, modify, or delete any Google data. The scopes are read-only by design.

Klar does not use Google user data to develop, improve, or train generalized AI/ML models. Customer Data sent to our AI provider (Anthropic — see §4.3) is used only to render dashboards and insights for the specific request, then is subject to Anthropic's standard 30-day retention policy. We have not opted into Anthropic's user-feedback program or Development Partner Program; Anthropic does not train models on API data.

You can disconnect any Google OAuth connection at any time from Klar's Connections page. On disconnect, we revoke the access token and delete cached data for that connection within 30 days.

3. How we use information

We use information to:

We do not:

• Sell your data to third parties
• Use your Customer Data to train any AI/ML model (ours or third-party)
• Share Customer Data with advertising partners
• Profile you for advertising targeting

4. Subprocessors

We share data with the following subprocessors, each bound by a Data Processing Agreement:

4.1 AWS

We host all Klar infrastructure on AWS. Data at rest is encrypted using AWS-managed keys (S3 SSE, RDS encryption). All connections are TLS 1.2+.

4.2 Cloudflare

We use Cloudflare for DNS resolution and DDoS protection of our public API surface.

4.3 Anthropic (AI inference)

Klar uses Anthropic's Claude API to generate dashboard plans and write insight narratives. When you trigger an auto-dashboard, schema metadata and small data samples are sent to Anthropic for the duration of each AI request.

Under Anthropic's commercial terms:

• Request/response data is retained for up to 30 days for safety and abuse-review purposes, after which it is automatically deleted
• Anthropic does not use Customer Data sent via the API for training or improving its models
• We have not opted into Anthropic's user-feedback program or Development Partner Program — neither of which would share Customer Data for training

If your organization requires zero data retention (ZDR) with Anthropic, contact us at privacy@aeye-on.com — ZDR is available to enterprise customers.

4.4 Paddle (billing)

Paddle.com Market Limited acts as our Merchant of Record. When you subscribe, your billing details (name, email, billing address, payment method) are processed by Paddle, not Klar. We receive limited information back (subscription status, last 4 digits of card). Paddle's privacy policy is at https://www.paddle.com/legal/privacy.

5. Customer Data flow when you connect external services

All connection credentials and OAuth refresh tokens are stored encrypted via AWS Secrets Manager.

6. Data retention

On account cancellation: all Customer Data is deleted within 30 days. You can request immediate deletion by emailing privacy@aeye-on.com.

7. Your rights

If you are in the EU/UK (GDPR), in California (CCPA), or in India (DPDP Act 2023), you have the following rights:

We respond to verified rights requests within 30 days.

8. Cookies and tracking

Klar uses two categories of cookies:

We do not use third-party advertising cookies. We use Sentry for error reporting which sets a session cookie for crash correlation only.

9. Data residency

By default, Klar stores all data in AWS ap-south-1 (Mumbai, India). Some auxiliary services (Anthropic AI inference, Paddle billing) are based outside India — we transfer the minimum data necessary for those services to function, under standard contractual clauses where required.

EU-region storage is available on Enterprise plans by request.

10. Security

We implement technical and organizational measures to protect your data:

• Encryption at rest: AWS S3 SSE-S3, RDS encryption
• Encryption in transit: TLS 1.2+ for all connections
• Access controls: SSO / MFA for our team; per-tenant data isolation
• Audit logs: internal logs of who-accessed-what (Pro+ tier exposes these to customers)
• Secrets management: AWS Secrets Manager for all credentials
• Vulnerability disclosure: report security issues to security@aeye-on.com

We are pursuing SOC 2 Type II compliance. For our current compliance posture, contact privacy@aeye-on.com.

11. Children's privacy

Klar is a B2B SaaS product not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, contact privacy@aeye-on.com and we will delete the account.

12. International users

If you are accessing Klar from outside India, your data will be transferred to and processed in India and other countries where our subprocessors operate. By using Klar, you consent to this transfer.

For EU/UK customers: transfers outside the EEA/UK are protected by Standard Contractual Clauses (SCCs).

13. Changes to this policy

We may update this policy as Klar evolves or as laws change. When we make material changes:

• We update the "Last updated" date at the top
• We notify active customers by email at least 14 days before the change takes effect
• Continued use after the effective date constitutes acceptance

14. Contact

AEYEON Technologies Private Limited India

For our registered office address, contact privacy@aeye-on.com.