Privacy Policy

Clove Ai ("we", "us") provides a personal finance and expense tracking service at cloveai.app and through an Android application, and an iOS application once released (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, with whom it is shared, how long it is kept, and the rights you have over it.

The data controller is Jason Pieter Kusumajaya, an individual sole trader, of Jl Taman Ubud Asri I No. 15, Tangerang, Banten 15810, Indonesia. For any privacy question or request, contact support@cloveai.app.

• Account data: email address, display name, optional profile photo, hashed authentication credentials, two-factor authentication settings, and, if you sign in with Google or GitHub, that provider's identifier for you and the email address it reports.

• Financial records you create: descriptions, amounts, currencies, categories, dates, tags, budgets, subscriptions you track, and notes. You decide what you enter. Please do not enter another person's data without a lawful basis.

• Content submitted to AI Features: only if you enable AI Features: the text you type into natural-language entry or AI chat, images of receipts you scan, and a summary of your spending that is attached to AI chat requests so that answers are relevant to you.

• Planning and organisation data you create: savings goals and the amounts you record against them, trips (a name, a date range and a budget), spending rules you define, and any tags or categories you add.

• Your money profile (Pro): a monthly income figure, a pay day, fixed monthly costs, goals and a free-text note about what you are trying to change. You can type these yourself. On Pro, Clove Ai also fills in fields it can work out from your own records (for example a recurring income, a pay day, or fixed costs), marks them "Learned by Clove Ai", and lets you keep, edit or clear each one; a field you have typed or cleared is never overwritten. We do not verify any of it. If AI Features are enabled, this profile is included in AI chat requests so the assistant stops asking you the same questions. Leave it blank and nothing is sent. See section 5 for the one AI step involved in learning.

• Change history: an append-only record of changes to your expenses, budgets, tags, categories and goals: what changed, from what value to what value, and when. It exists so you can restore something you deleted. See section 8 for how long it is kept.

• Files you import: if you use bulk import, the contents of the spreadsheet or statement file you upload, held as reviewable rows until you commit or discard the import.

• Subscription and payment data: your plan, the store product identifier, a store transaction identifier, the subscription expiry date and renewal status. If you pay on the web, we also keep a record of each payment (reference, amount, currency, status and date), your Xendit customer and plan identifiers, the date your web Pro runs to, and whether auto-renew is on; your name and email address are passed to Xendit to open the payment page. Payment is made to Google (or Apple, once the iOS app is released) or to Xendit on its own page; we never receive your card number, security code, e-wallet or bank details.

• Progress data: streaks, points, in-app rewards and daily usage counters (for example how much of your daily AI allowance you have used), which exist to run those features and enforce plan limits.

• Email we send: transactional email (verification, password reset, sign-in codes and alerts, account-change notices, web Pro renewal reminders) and, if you switch them on under Pro, weekly or monthly spending summaries. These are sent from our own mail server at our hosting provider.

• Device and technical data: each sign-in creates a session record holding your IP address and browser or device description, and we keep a sign-in history (device, approximate location derived from your IP address, IP address and time) that you can see in Settings. We also hold failed-attempt counters used to lock an account that is being guessed at, your time zone, and, if you allow notifications in the Android app, a push-notification token.

• Kept on your device only: your AI chat history is stored in your browser's local storage or the app's on-device storage, not on our servers (the text of each request is sent to the AI provider when you send it, see section 5, and is not kept by us afterwards). Receipt images are used for the scan and are not stored by us or kept in your chat history. The Android app also keeps an offline copy of your expenses and budgets and preference data on the device. Signing out removes the account-specific items from your browser; on Android, signing out clears them from the app.

• Preferences: theme, colour, language, currency and notification settings, stored on your device and in your profile.

We do not collect precise or approximate location, contacts, calendar data, health data, biometric data, audio recordings, browsing history or advertising identifiers. We do not ask for your postal address, phone number or any government identification number. We do not ask for your date of birth. When you sign up you confirm that you meet the minimum age by ticking a box, or by continuing with Google or GitHub (section 12); we keep only the record that you accepted the Terms.

• Camera and photo library: used only when you choose to scan a receipt or set a profile photo. Receipt images are sent to an AI provider only if AI Features are enabled.

• Notifications: used for reminders and account alerts you have enabled. You may withdraw this permission at any time in your device settings.

We do not request access to your microphone, location or contacts.

We process personal data to: (a) create and operate your account and synchronise your records across devices; (b) provide dashboards, budgets, reports and exports, and, on Pro, suggest money-profile entries from your own records; (c) provide AI Features that you have enabled; (d) take and verify payments and manage subscriptions; (e) send transactional messages such as two-factor codes, sign-in alerts, password resets and notifications you have enabled; (f) secure the Service and prevent fraud and abuse; and (g) comply with legal obligations.

Where the GDPR, the UK GDPR, Indonesia's Personal Data Protection Law (UU No. 27 of 2022) or a similar law applies, we rely on: performance of a contract for (a), (b), (d) and (e) (the profile suggestions in (b) are part of the Pro service you chose); your explicit consent for (c) and for push notifications; our legitimate interests in operating a secure service for (f); and legal obligation for (g).

We do not use your personal data for advertising, we do not profile you for marketing purposes (the Pro money-profile suggestions are used only inside the product, are shown to you and can be cleared), and we do not make decisions producing legal or similarly significant effects about you by automated means.

AI Features are disabled by default. Nothing is sent to an AI provider until you enable them, and our servers refuse AI requests while they are disabled. We request your explicit consent separately from acceptance of this Policy because a free-text description or a photographed receipt may incidentally reveal special-category data (for example relating to health or religion), for which explicit consent is the applicable legal basis (GDPR Art. 9(2)(a)).

If you have filled in your money profile (section 2), it is included in AI chat requests while AI Features are enabled, so the assistant does not re-ask what you have already told it. It is transmitted on the same basis as everything else in this section and stops being sent the moment you clear the fields or disable AI Features.

When enabled, the content you submit is transmitted to our AI providers solely to generate the requested result. We do not store it after the reply, and we do not use it to train AI models. Each provider handles API data under its own terms and privacy policy, which can differ from one model to another, and we cannot control what a provider does with it. You may withdraw consent at any time in Settings; withdrawal stops all further transmission immediately but cannot recall content already processed. Declining affects AI Features only; all other features remain available.

The Pro money-profile suggestions are worked out on our servers from your own records without any AI provider. Once a week at most, and only if AI Features are enabled, one extra step sends an AI provider your spending category totals and your most frequent merchant names with counts (no per-expense amounts or dates) to infer a short household description, which you can edit or clear. This uses your daily AI allowance.

When a currency conversion in AI chat or a budget needs an exchange rate that our rate table does not have, and AI Features are enabled, one extra step asks an AI provider with web search for that rate. Only the two currency codes are sent (for example "USD" and "IDR"): no amount, message text or account data. The answer is read back by our code, the arithmetic is done by our code, the reply says the rate is approximate, and the step uses your daily AI allowance.

The interactive demonstration on our home page is not connected to any account. Text typed into it is sent to an AI provider to produce a reply. Please use example data only and do not enter real financial or sensitive information into it.

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. We disclose it only to the service providers below, which process it for the purposes stated and under their own data processing or privacy terms, and to public authorities where required by law.

• Dewaweb, our hosting provider in Indonesia: hosting of the website, API, database and outgoing email; processes your account data, financial records, requests, IP addresses, server logs and the emails we send you (Indonesia).

• Xendit: processing of web payments (QRIS, bank transfer, e-wallets, cards, retail outlets, and card auto-renew) on its own payment page; receives your name, email address and payment details and tells us whether a payment succeeded; acts under its own privacy policy (Indonesia and other countries where Xendit operates).

• OpenRouter Inc. and the AI model providers it routes requests to: AI inference, only when AI Features are enabled (United States and other countries where those model providers operate). If a standby AI provider is configured for outages, it is named here before it is enabled.

• Google LLC (Google Analytics 4): aggregated website usage statistics, only if you accept analytics cookies in the cookie banner; IP addresses are not stored by Google Analytics 4 (United States and other countries where Google operates).

• ipapi.co (Kloudend, Inc.): when you sign in from a device or network we have not seen before, your IP address is sent to this service to look up an approximate location (city, region, country) for the security email we send you; nothing else is sent (United States).

• Google LLC and GitHub Inc.: only if you choose to sign in with them: they confirm your identity and share your name and email address with us, under their own privacy policies.

• Expo (650 Industries, Inc.) and Google (Firebase Cloud Messaging): in the Android app, issuing the push-notification token for your device when you allow notifications (United States). Our reminders are scheduled on your device; our server stores the token but does not currently send notifications through these services. Once the iOS app is released, Apple's push service will be involved in the same way.

• GitHub Inc.: hosts the downloadable Android app file, so GitHub sees the IP address of a device that downloads it (United States).

• Google LLC and, once the iOS app is released, Apple Inc.: sale of store subscriptions and verification of purchases, under their own privacy policies.

Exchange rates are retrieved by our server from a public rates service; no personal data is sent in those requests.

Your data may be processed outside your country of residence, including in Indonesia and the United States. Where personal data is transferred from the EEA, the UK or Indonesia to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) incorporated into each processor's data processing agreement, together with any additional safeguards required by UU PDP. These instruments are only relevant where a processor has agreed them; where a provider offers only its own standard terms, those terms apply.

Change history is kept for three months on the Basic plan and for as long as your account exists on the Pro plan. It is recorded on every plan so that an upgrade does not begin with an empty history; on Basic, entries older than three months are deleted automatically. Deleting your account deletes the history with it.

Imported files are held as reviewable rows only until you commit or discard the import, and the staged rows are deleted when you do.

We keep your personal data while your account is active, including session records and sign-in history (device, approximate location and IP address), which are not deleted while the account is in normal use, except that expired or signed-out session records and one-time links are deleted about 7 days after they stop working, and sign-in history older than 12 months is deleted automatically. When you delete your account in Settings, we delete your account and everything linked to it, including financial records, change history and sign-in history, immediately and in one step, except that we keep a record of each web payment you made (amount, currency, dates and the payment reference, with no name, email address or account identifier) for 10 years, as Indonesian tax law requires for bookkeeping records; if you ask us by email, we do it as soon as we can verify the request. Copies held in backups of our hosting provider disappear as those backups are rotated out, on a schedule set by the host. Deleting your account also ends any web Pro time you had prepaid and stops card auto-renew; it does not cancel a store subscription (see the Terms). Payment providers (Xendit, Google, and Apple once the iOS app is released) keep their own records of payments for as long as the law requires them to. Operational server logs (for example error entries, which can include an account identifier or IP address) are kept only for as long as the host's log rotation keeps them.

Data kept on your device (section 2) stays there until you sign out, clear it or uninstall the app.

Data is encrypted in transit using TLS. Passwords are stored only as salted hashes, sign-in session tokens are stored only as hashes, and authenticator-app secrets are stored encrypted. Every request is checked against the signed-in account, repeated failed sign-ins lock an account for a while, and two-factor authentication (email code or authenticator app, with backup codes) is available. We email you when a sign-in comes from a device or place we have not seen and you can review sign-in activity in Settings. No system is completely secure.

If a personal data protection failure occurs, we will notify affected users and the personal data protection authority in writing within 3 x 24 hours, as Article 46 of UU PDP requires, and the competent supervisory authority under the GDPR where that applies. The notice will state which personal data was disclosed, when and how, and what we are doing about it.

Subject to applicable law, you have the right to: be informed about processing; access and obtain a copy of your data; correct inaccurate data; delete your data; receive your data in a portable format; restrict or object to processing; withdraw consent at any time without affecting the lawfulness of prior processing; and lodge a complaint with a supervisory authority.

In the app you can correct your records and profile yourself, delete your account in Settings (it asks for your password, and for a second factor if you use one), turn AI Features off, and see your sign-in activity. On every plan, Settings > Download my data gives you a copy of everything your account holds on our servers (JSON); AI chat history is already on your device. The spreadsheet (CSV) export of expenses is part of the Pro plan. For anything else, email support@cloveai.app. We respond to access, correction and deletion requests within 3 x 24 hours as UU PDP requires, and to other requests within 30 days, and may need to verify your identity before acting.

Indonesia. As we are established in Indonesia, UU PDP applies to our processing. You may lodge a complaint with the personal data protection authority designated under UU PDP.

European Economic Area (the EU, Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland. The GDPR, the UK GDPR and the Swiss Federal Act on Data Protection (FADP) apply to our processing of your data. You may lodge a complaint with the supervisory authority of your country of residence or place of work (in Switzerland, the Federal Data Protection and Information Commissioner).

California and other US states: notice at collection. In the preceding 12 months we have collected the following categories of personal information, from you directly, from your device, and from Xendit, Apple or Google for payments and subscriptions: identifiers (name, email address, account ID, IP address, push token); commercial information (plan and subscription status); internet or other electronic network activity (security and sign-in logs); and user content you enter, including your financial records. Account log-in credentials (email and password) are sensitive personal information; we use them only to provide and secure the Service, so no right to limit applies. We use these categories for the purposes in Section 4, disclose them only to the service providers in Section 6, and keep them for the periods in Section 8.

We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the preceding 12 months; we have no actual knowledge of selling or sharing the personal information of consumers under 16. You have the right to know, access, correct and delete your personal information and not to be discriminated against for exercising these rights. You may submit a request by email; an authorised agent may submit a request on your behalf with proof of authorisation. We verify requests by confirming control of the account's email address.

California "Shine the Light" (Civil Code § 1798.83). We do not disclose personal information to third parties for their own direct-marketing purposes.

Do Not Track and Global Privacy Control (CalOPPA). No third party collects personal information about your online activities over time or across different websites through the Service, and we do not track you across other sites. Because there is no sale, sharing or cross-site tracking to switch off, a browser Do Not Track or Global Privacy Control signal does not change how the Service behaves; we treat such a signal as an opt-out request and there is nothing further to opt out of.

Users under 18 (California Business and Professions Code § 22581). You can remove any content or information you have submitted to the Service at any time: delete an individual entry, a budget or a note in the app, or delete your whole account in Settings, or ask us to remove it by email. The Service does not publish your content to other users.

Brazil. If the LGPD applies to you, you may exercise the rights set out in Article 18 of the LGPD by contacting us, and may petition the ANPD.

We use one strictly necessary cookie to keep you signed in (an httpOnly session cookie that scripts on the page cannot read), a second short-lived one during Google or GitHub sign-in, and we store preferences, cached copies of your records and your AI chat history in your browser's local storage. With your consent, we also use Google Analytics 4 to understand how the website is used: it sets analytics cookies and loads only after you choose Accept in the cookie banner, and you can withdraw that consent at any time from Cookie settings in the footer. We do not use advertising or cross-site tracking. Details are set out in our Cookie Policy.

The Service is not directed at children and may not be used by anyone under 13 years of age, or the higher minimum age of digital consent in their country. When you register you confirm that you are at least 13 (and, if you are under 18, that a parent or guardian has permitted you to use the Service), by ticking a box (email) or by continuing with Google or GitHub; we do not ask for your date of birth and we cannot verify anyone's age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Policy. We will give at least 30 days' notice of material changes by email or in-app notice, and the "Last updated" date at the top of this page always reflects the current version. A change that only adds an optional use of data which needs your consent first (for example, website analytics that stay off until you accept them in the cookie banner) is not applied to you until you give that consent, so it takes effect when you opt in rather than after a notice period.

Jason Pieter Kusumajaya, trading as Clove Ai, Jl Taman Ubud Asri I No. 15, Tangerang, Banten 15810, Indonesia. Email: support@cloveai.app.