Privacy Policy

This policy covers our websites, account administration, sales and business communications, customer support, and the personal information handled through our Services. It distinguishes information we use to manage our business from information we process for our customers.

For website visitors, business contacts, and account administration, Clark determines why and how personal information is used. Where applicable, this makes us a controller or business under privacy law. When customers submit engagement records, documents, prompts, or other information to the Services (“Customer Content”), we generally process that information on their behalf as a processor or service provider.

Our customers determine the purposes for which they use Customer Content and which people and services may access it. Our processing of that content is governed by the applicable customer agreement, including any data processing terms. This policy does not reduce obligations under those agreements or rights under applicable law.

If your information was supplied to Clark by an accounting firm, employer, or other organization, contact that organization with questions about its use of your information. We assist customers with requests relating to information we process for them.

The information we receive depends on the relationship, features used, and permissions granted. It may include the following categories:

• Account and business details. Names, work contact details, employer, role, account identifiers, authentication information, and administrator settings provided by you or your organization.
• Subscription and billing records. Plan details, invoices, transaction status, and billing contacts supplied by customers or payment service providers.
• Customer Content. Documents, spreadsheets, workpapers, financial records, prompts, messages, and generated results submitted or produced through the Services. Depending on the engagement, records may contain names, Social Security numbers, dates of birth, compensation, banking information, or other sensitive personal information.
• Connected-service information. Files, records, communications, account details, and related metadata made available through integrations authorized by a customer or user.
• Support and correspondence. Messages, attachments, feedback, and records of demonstrations, onboarding, and support interactions.
• Device and activity information. IP addresses, browser and device characteristics, access times, referring pages, feature interactions, and diagnostic, authentication, and security events collected through the Services and associated technologies.

We receive information directly from individuals, from customers and their authorized users, from connected services, and from providers supporting our operations. Some technical information is collected automatically when our websites or Services are used.

We use account, business contact, and technical information to establish and manage accounts; authenticate users; deliver and support the Services; administer subscriptions and billing; communicate service notices; diagnose faults; improve performance and usability; and prevent or investigate fraud, abuse, and security incidents.

We also use business contact information to respond to inquiries, organize demonstrations, manage customer relationships, and send relevant business communications where permitted. Information may be used to meet legal obligations, maintain appropriate business records, resolve disputes, and protect our rights and the rights of others.

We process Customer Content to provide the functionality requested by customers, including document processing, accounting workflows, analysis, and AI-assisted actions. We do not use Customer Content to market to our customers’ clients or to target advertising at them.

When information is necessary to create an account or provide a requested feature, choosing not to supply it may prevent us from providing that account or feature.

AI-enabled features may send relevant prompts, documents, or other inputs to AI service providers and return results to the Services. The information involved depends on the selected feature, the customer’s instructions, and the applicable configuration.

We do not use Customer Content to train general-purpose AI models or permit our AI service providers to use it for that purpose.

An optional PII redaction pipeline can be enabled on request to redact supported sensitive information before it is sent to AI models. This processing does not itself delete personal information from original files stored in the platform. The availability and coverage of redaction depend on the supported content and configuration.

A website assistant, where offered, is a separate interaction from a customer engagement. Information voluntarily entered there may be processed to respond to inquiries and support the website experience. Please do not submit client records or other confidential information through public website chat.

When you or your organization connect a third-party service, Clark accesses information within the permissions granted to support the enabled features. Depending on the connection, this may involve importing documents or records, reading spreadsheet content, or writing requested results back to the connected service.

For Microsoft Excel and other supported Microsoft integrations, the information processed may include selected workbook content and account or organization identifiers needed for the feature. Available permissions and organization settings determine the scope of access.

Permissions can be managed through the connected service and, where supported, through Clark. Revoking access prevents further access through that authorization; it does not automatically delete information previously imported into Clark. Requests to remove retained information are handled under the applicable agreement and the rights described below.

Where Clark receives information from Google APIs, its use and transfer of that information will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Applicable Google Workspace policies also govern Google Workspace data. These restrictions take precedence over broader uses described elsewhere in this policy.

Google account information, file content, and related metadata are accessed within the permissions granted for the user-facing integration. We use this information to provide the authorized functionality, address security issues, and meet applicable legal requirements. We do not sell Google user data, use it for advertising or creditworthiness decisions, or use it to train general-purpose AI models.

Transfers of Google user data and access by personnel are limited to circumstances allowed by the applicable Google policies, such as providing the authorized feature, investigating security issues, complying with law, or accessing specific information with the user’s affirmative agreement. Customers may revoke access through their Google account or Workspace administration settings and request deletion through the contact details below.

We disclose personal information where needed for the purposes described in this policy, subject to the restrictions that apply to Customer Content and connected-service data:

• Service providers. Providers of hosting, storage, security, communications, support, analytics, billing, customer relationship management, and AI processing that assist us in operating our business and Services.
• Authorized recipients. Users, administrators, integrations, and destinations selected or authorized by the customer. Organization administrators may manage accounts, permissions, and access to information within their organization.
• Professional advisers. Legal, accounting, audit, and insurance advisers where disclosure is necessary for their work.
• Legal and security recipients. Authorities or other appropriate parties where disclosure is required by law or necessary to investigate misuse, protect rights and safety, or enforce agreements.
• Business transactions. Relevant parties to a proposed or completed financing, merger, acquisition, reorganization, or asset transfer, subject to applicable confidentiality, contractual, and legal restrictions.

Our arrangements with service providers are intended to restrict their use of information to the authorized services and require appropriate protection. Customer agreements and integration-specific requirements may impose additional restrictions.

Our websites and Services use cookies and similar technologies for functions such as authentication, preferences, security, performance measurement, and understanding how features are used. Website marketing tools may also measure visits and campaign activity.

You can manage cookies through browser settings and any privacy controls provided on the relevant website. Restricting cookies may affect functionality. Where consent or an opt-out is required, the relevant controls and notices describe the choices available.

You can unsubscribe from marketing emails using the link provided in those emails or by contacting us. Service, security, and account messages may still be sent when necessary for the relationship.

We do not sell Customer Content or use it for targeted advertising. Disclosures of website identifiers or activity through analytics and advertising technologies may be treated as a “sale,” “sharing,” or targeted advertising under some privacy laws, even when no money is exchanged.

Where applicable, you may request to opt out of these activities through our privacy contact and available website controls. Choices for website advertising do not change our contractual restrictions on Customer Content.

Retention depends on the information and its purpose. We consider the period needed to provide a requested service, the customer relationship, the sensitivity of the information, applicable recordkeeping requirements, and the need to resolve disputes or protect security.

Customer Content is retained, exported, or deleted according to the customer’s instructions and agreement. Customers may contact us about available export options before account closure. Account, billing, support, and security records may have separate retention requirements.

Deletion from active systems and expiration from backups may occur on different schedules. Information subject to a legal preservation requirement may be retained for that purpose. Where we continue to hold information, applicable protections remain in place.

We use technical and organizational safeguards designed to protect personal information, including access controls and encryption in transit and at rest. Access by Clark personnel is restricted to authorized individuals with a legitimate need, such as customer support, troubleshooting, security investigation, or service recovery. No system can guarantee absolute security.

Clark uses AWS infrastructure in the United States for its customer platform. The locations involved in other processing depend on the services used, applicable providers, and authorized support arrangements. Hosting location alone does not determine every location from which information may be processed or accessed.

Where international transfers require safeguards, we use the mechanisms applicable to the transfer and describe them in the relevant contractual documentation or supplementary notice. You may contact us for information about safeguards relevant to your personal information.

Depending on applicable law and our role, you may have rights to access or obtain information about processing; correct inaccurate information; request deletion; receive a portable copy; restrict or object to processing; withdraw consent; or opt out of qualifying sales, sharing, targeted advertising, or certain profiling.

Send requests to privacy@getclark.com. We may request information reasonably necessary to verify identity, authority, and the scope of a request. Authorized agents may submit requests where permitted by law. We respond within applicable legal timeframes and explain any lawful reason for denying or limiting a request. We do not discriminate against individuals for exercising applicable privacy rights.

Where an appeal right applies, reply to our decision or contact the same address with “Privacy appeal” in the subject line. Individuals may also complain to the relevant privacy regulator. Requests about Customer Content should ordinarily be directed to the organization that supplied it; we support that organization in responding.

For processing subject to European or UK data protection law, our legal bases depend on the purpose: performing a contract with an individual where applicable; legitimate interests in operating and protecting our business, supporting customers, and communicating with business contacts; compliance with legal obligations; or consent where required. Where we rely on legitimate interests, we consider the impact on individuals and their rights. Consent may be withdrawn without affecting the lawfulness of prior processing.

You may object to direct marketing at any time. You may also raise a concern with your local supervisory authority. If Clark processes your information solely on behalf of a customer, that customer is responsible for identifying the legal basis for its processing.

Residents of California and other US states may have additional rights relating to categories and sources of information, disclosures, sensitive information, and opt-outs. Sections 2, 3, 7, and 9 describe these activities, and Section 13 explains how to contact us.

Clark is designed for business use and is not directed to children. Customer-uploaded records may nevertheless include information about minors, which we process on the customer’s behalf under the applicable agreement. Contact us if you believe a child has independently provided personal information through our website or account registration.

Third-party websites and services linked from Clark have their own privacy practices. When you choose to use an external service, review its privacy notice and the permissions you grant. This does not alter our responsibilities for information we disclose to our own service providers.

We may revise this policy as our services, practices, or legal obligations change. We will update the last revised date and provide additional notice or obtain consent where required. The applicable customer agreement continues to govern our processing of Customer Content.

For questions about this policy or to submit a privacy request, contact:

Clark, formerly uiAgent Email: privacy@getclark.com