Privacy Policy

Last updated: September 4, 2026

This Privacy Policy describes how The Optimist Studio, LLC ("ClawPow," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the ClawPow platform, website (clawpow.com), command-line interface, APIs, and related services (collectively, the "Service").

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect information provided through our authentication provider, WorkOS:

• Email address
• First and last name
• Authentication identifiers (WorkOS user ID)

1.2 Onboarding Information

During onboarding, we may collect:

• Your experience level with AI agents
• How you heard about ClawPow (referral source)
• Which AI agents you intend to use
• Your planned use cases

1.3 Payment Information

We use Stripe to process payments. We store:

• Stripe customer ID and subscription ID
• Subscription status and billing period dates
• Credit balance and top-up transaction records

We do not store your credit card number, bank account details, or other payment instrument data. This information is collected and stored directly by Stripe in accordance with Stripe's Privacy Policy.

1.4 Connected Third-Party Account Data

When you connect third-party platform accounts, we collect and store:

1.5 User-Generated Content

We store content you create through the Service, including:

• Social media posts (text, media, scheduling data)
• Blog articles (titles, body text, metadata, cover images)
• Documents and spreadsheets
• Brand identity data (logos, colors, fonts, descriptions)
• Image prompts and generated images
• Video prompts, reference images, and generated videos
• Tasks (titles, descriptions, status)
• Feedback submissions

1.6 Usage and Operational Data

We automatically collect:

• Metering data: Records of each AI or API operation, including operation type, provider, model, cost, duration, and success/failure status
• Run events: Execution logs for operations (creation, progress, completion, failure)
• Analytics snapshots: Periodic snapshots of your connected accounts' metrics (follower counts, post engagement, revenue figures, traffic data, SEO rankings)
• Storage usage: Total file storage consumed and asset counts

1.7 Third-Party Customer Data

If you connect revenue analytics (Stripe), we may access and store limited data about your customers, including customer email addresses and transaction descriptions, as reported by the Stripe API. This data is used solely to provide analytics within the Service.

2. Google User Data

This section applies when you connect your Google account to the Service and supplements the rest of this Privacy Policy. ClawPow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.1 What Google User Data We Access

When you connect your Google account, you choose which permissions (scopes) to grant. We access only the data covered by the scopes you grant:

We also store the OAuth access and refresh tokens Google issues, your Google account email address, the GA4 property ID and Search Console site URL you select, and the scopes you granted.

2.2 How We Use Google User Data

We use Google user data solely to provide user-facing features of the Service that you request: displaying your website traffic analytics, tracking your search keyword rankings, and exporting documents you create to your Google Drive. We do not use Google user data for any other purpose. Specifically, we do not sell Google user data, we do not use it for advertising of any kind, and we do not use it to develop, improve, or train generalized (non-personalized) AI or machine learning models.

2.3 How We Store and Protect Google User Data

OAuth tokens and data retrieved from Google APIs are stored in our database (Convex), encrypted in transit (TLS/HTTPS) and at rest. Access is protected by the security measures described in the "Data Security" section of this policy, including server-side authentication and ownership checks on every request.

2.4 How We Share Google User Data

We do not share, transfer, or disclose Google user data to anyone, except to our infrastructure subprocessor (Convex, our database host, where it is stored encrypted) as necessary to operate the Service, or where disclosure is required by law. No human at ClawPow reads your Google user data except with your explicit permission (for example, when you request support), for security purposes, or where required by law.

2.5 Retention and Deletion of Google User Data

When you disconnect your Google account in the Service settings, we revoke our access with Google, delete the stored OAuth tokens, and delete the analytics snapshots derived from Google data (traffic and search performance metrics) immediately. Any remaining derived data is in all cases automatically purged after 90 days, and everything is deleted when you delete your account. You may request complete deletion of all Google user data at any time by contacting support@clawpow.com; we process such requests within 30 days.

2.6 Revoking Access

You can revoke ClawPow's access to your Google account at any time, either by disconnecting the account in the Service settings or through your Google Account security settings at myaccount.google.com/permissions.

3. How We Use Your Information

We use your information to:

• Provide the Service: Authenticate your identity, execute operations, publish content, generate media, process transactions, and deliver analytics.
• Process payments: Manage subscriptions, meter usage, charge for credit top-ups, and maintain billing records.
• Maintain connected integrations: Refresh OAuth tokens, synchronize data with third-party platforms, and execute scheduled operations.
• Improve the Service: Analyze usage patterns, debug errors, optimize performance, and develop new features.
• Communicate with you: Send transactional notifications (billing confirmations, service alerts, account security notices), and respond to support requests.
• Enforce our Terms: Detect, prevent, and address fraud, abuse, security incidents, and Terms of Service violations.
• Comply with legal obligations: Respond to lawful requests from law enforcement or regulatory authorities, and maintain records as required by applicable law.

4. How We Share Your Information

4.1 Third-Party Service Providers

We share your information with third-party providers as necessary to operate the Service:

4.2 Connected Social and Publishing Platforms

When you publish content through the Service, your content (text, images, videos) is transmitted to the connected platforms (X, LinkedIn, Threads, Instagram, WordPress, Ghost, Webflow) and is subject to those platforms' privacy policies. Published content becomes public on those platforms.

4.3 Legal Requirements

We may disclose your information if required to do so by law, or in the good faith belief that such disclosure is reasonably necessary to: (a) comply with legal process, a court order, or government request; (b) enforce our Terms of Service; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of ClawPow, our users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

4.5 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Data Retention

Upon account deletion, we cascade-delete your data including user records, subscriptions, connected accounts, content, assets, and operational logs. Data already published to third-party platforms cannot be deleted by us.

6. Data Security

We implement technical and organizational measures to protect your data, including:

• Encryption at rest: All data stored in our database (Convex) and file storage (Cloudflare R2) is encrypted at rest.
• Encryption in transit: All data transmitted between your device and our services uses TLS/HTTPS encryption.
• Webhook verification: All inbound webhooks are verified using cryptographic signatures (HMAC-SHA256, Ed25519) with replay protection.
• OAuth security: OAuth flows use PKCE (where supported), HMAC-signed state parameters, and 10-minute state expiration windows.
• Signed URLs: Private assets are served via HMAC-SHA256 signed URLs with time-limited expiration.
• Access control: Server-side authentication checks on every query and mutation, with ownership verification for data access.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If you become aware of a security vulnerability, please report it to support@clawpow.com.

7. Your Rights and Choices

7.1 Access and Portability

You may access and export your data at any time through the Service dashboard or by contacting support@clawpow.com. We will provide your data in a commonly used, machine-readable format.

7.2 Correction

You may update your account information at any time through the Service or by contacting support@clawpow.com.

7.3 Deletion

You may request deletion of your account and personal data by contacting support@clawpow.com. We will process deletion requests within 30 days, subject to our data retention obligations.

7.4 Connected Account Management

You may disconnect any third-party account at any time through the Service settings. Disconnection removes stored tokens from our systems. We recommend also revoking ClawPow's access directly through the third-party platform's settings. For Google accounts, you may revoke ClawPow's access directly at myaccount.google.com/permissions.

7.5 Communication Preferences

You may opt out of non-essential communications by contacting support@clawpow.com. Transactional communications (billing, security alerts, Terms updates) cannot be opted out of while maintaining an active account.

8. International Data Transfers

The Service is operated from the United States. If you are accessing the Service from outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate (including the United States). By using the Service, you consent to such transfers. We ensure that appropriate safeguards are in place for international data transfers in compliance with applicable data protection laws.

9. European Economic Area (EEA), UK, and Swiss Users

9.1 Legal Basis for Processing

If you are located in the EEA, UK, or Switzerland, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you have requested (account management, publishing, payments, analytics).
• Legitimate interests: Processing necessary for our legitimate business interests (service improvement, fraud prevention, security), where those interests are not overridden by your rights.
• Consent: Where you have consented to specific processing, such as connecting third-party accounts or enabling optional features.
• Legal obligation: Processing necessary to comply with applicable laws (tax, anti-money laundering).

9.2 Additional Rights

In addition to the rights above, EEA, UK, and Swiss users have the right to:

• Object to processing based on legitimate interests;
• Restrict processing in certain circumstances;
• Withdraw consent at any time (without affecting the lawfulness of prior processing);
• Lodge a complaint with your local data protection authority.

9.3 Data Protection Officer

For data protection inquiries, contact us at support@clawpow.com.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell or share (as defined by CCPA/CPRA) your personal information.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at support@clawpow.com. We will verify your identity before processing your request.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at support@clawpow.com.

12. Cookies and Tracking

The Service uses essential cookies and local storage for authentication and session management. We do not use third-party advertising cookies or cross-site tracking technologies. Essential cookies include:

• Authentication tokens: To maintain your logged-in session.
• Preferences: To remember your theme and display settings.

Because we only use strictly necessary cookies, no cookie consent banner is displayed. If we introduce analytics or non-essential cookies in the future, we will update this policy and provide appropriate consent mechanisms.

13. AI and Automated Processing

13.1 How AI Is Used

The Service uses AI models provided by third parties (including OpenRouter, Google, and fal.ai) to generate images, videos, text, and analytical insights. When you use AI features:

• Your prompts, brand context, and reference content are transmitted to the applicable AI provider for processing.
• We store your prompts and the resulting outputs in our database.
• AI providers may process your data according to their own privacy policies and data handling practices.

Data received from Google APIs is never included in AI prompts or shared with AI model providers, and is never used to develop, improve, or train AI or machine learning models.

13.2 No Automated Decision-Making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects. AI features are tools that assist content creation; all outputs are subject to your review and approval before publication or use.

14. Third-Party Links and Services

The Service may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of every website and service you interact with.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address associated with your account at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

The Optimist Studio, LLC
701 Tillery Street Unit 12, 1821, Austin, TX 78702, United States
Email: support@clawpow.com