Privacy Policy
Who we are
Claru is an Easy Read and Plain English Document Conversion service. We help Organisations make their Documents easier to understand.
We follow UK data protection laws. This includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who is responsible for your information
Claru is run by a UK company called CeeSquared Ventures Ltd, the data controller for this service.
Company details:
Company Number 15827079 | Registered in England and Wales
Registered Office: C/O Vantage Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB
ICO Registration Reference: ZC220300
What information we collect
When you convert a Document
- The Document or Website you upload for Conversion
- Your Email address (to send your Download Link)
- Payment information (handled entirely by Stripe — we never see your Card details)
- Your IP address
When you claim a free Conversion
- Your Email address (stored as a one-way hash — we cannot reverse it)
- Your IP address
- Whether you consent to marketing updates
When you contact us or give Feedback
- Your name and Email address (if you provide them)
- Your Feedback message
How we use your information
For Document Conversion
- Extract text from your Document
- Send the text to our AI service for Conversion
- Generate your Easy Read or Plain English PDF and Word file
- Send you a secure Download Link by Email
For Payments
- Calculate the cost of your Conversion
- Process your Payment through Stripe
For Service Feedback
- Send you one Feedback request 24 hours after your Conversion
- Use your Feedback to improve the service
For marketing updates (only if you consent)
- Send you updates about new features and improvements
- Share helpful accessibility resources
Where your Document is processed
This is one of the most important things to know about our service.
AI Conversion — UK Servers
We use Azure OpenAI (Microsoft) to convert your Document. This service runs in Microsoft's UK South data centre in London.
Your Document text does not leave the United Kingdom during AI Conversion. Microsoft contractually guarantees UK data residency and does not use your Documents to train AI models.
Our Website and Servers — US-based
Our Website runs on Replit, which uses Google Cloud servers in the United States.
While your Document is being converted, it passes through these servers. It is only held there while we work on it. Then it is deleted.
Stored Files — Encrypted, US-based
We store some Files for a short time using Replit Object Storage. This also runs on Google Cloud servers in the United States. These Files are:
- your uploaded Document, while it waits to be converted
- your converted PDF, Word File, Studio File and Readability Certificate, for 7 days
- your original Document, for 14 days, only if you choose Post-Editing
- pictures our Post-Editing team adds to your Document, for 7 days
Every File is encrypted with AES-256-GCM before it is stored. This is a very strong encryption standard. Each File has its own key. Google cannot read your Files.
When a File expires, we delete the File and its key. Cloud providers often keep backup copies. Without the key, those copies can never be read again. This is called crypto-shredding. It is recognised by the UK National Cyber Security Centre (NCSC).
Job Records — US-based
We keep a record of each Conversion in a database on Replit's US-based servers. It never contains your Document's content.
For 30 days, the record includes your Email address and your Document's name. We need these to send your Download Link, reminders and any refund.
After 30 days, we delete your Document's name and replace your Email address with a one-way hash. We keep only the word count, dates and type of Conversion, for our statistics.
Sending information to the United States
Using US servers means some of your information leaves the UK. To protect it, we:
- encrypt every File before it is stored
- keep as little personal information as we can
- delete Files after 7 days (14 days for Post-Editing), and personal details after 30 days
- only use AI in the UK — your Document text is never sent to AI in the US
Who we share your information with
We use the following third-party services to deliver our service. All are engaged under contracts that meet UK GDPR Article 28 requirements.
| Service | Purpose | Data Location |
|---|---|---|
| Microsoft Azure OpenAI | AI text conversion | UK South (London) — UK data residency guaranteed |
| Replit / Google Cloud | Website hosting, encrypted File storage and database | United States — Files encrypted with AES-256-GCM before storage; personal details removed after 30 days |
| Stripe | Payment processing | United States / EU — PCI DSS Level 1 certified |
| Zoho Mail | Emails (Download Links, reminders, replies to you) | European Union |
| Zoho WorkDrive | Sharing Files with our Post-Editing team (Post-Editing only) | European Union |
We never sell your information to other companies.
How long we keep your information
Converted Documents
Your PDF, Word File, Studio File and Readability Certificate are encrypted and stored for 7 days so you can download them when convenient.
After 7 days, the Files and their encryption key are permanently deleted (crypto-shredded).
Original Uploaded Documents
An encrypted copy is kept while your Document waits to be converted. It is deleted as soon as we have read the text. If a Conversion fails, it is deleted within 2 days.
Post-Editing Documents are encrypted and kept for up to 14 days, then permanently deleted.
Your Email and Document Name
Kept with your Conversion record for 30 days. Then your Document's name is deleted and your Email is replaced with a one-way hash.
Statistics
Word counts, dates and Conversion types are kept to power our statistics (for example, total Documents converted).
A hashed Email cannot be turned back into your Email. But someone who already knows your Email could check if it was used. So the law calls this "pseudonymised" data, not anonymous data.
Free Conversion Tracking
Your hashed Email is kept so that each Email can only get one free Conversion. Your IP address is deleted after 30 days.
Marketing Emails
Kept while you remain subscribed. You can unsubscribe at any time via the link in our Emails or our unsubscribe page.
Feedback
Kept to help us improve the service. You can ask us to delete your Feedback at any time.
How we protect your information
- AES-256-GCM encryption — every File we store is encrypted first, including your uploaded Document. This is the same standard used by government and financial institutions.
- Less personal data — after 30 days we delete your Document's name and hash your Email.
- Crypto-shredding — when we delete your File, we also destroy the encryption key. Your data is permanently unreadable, even in cloud backups.
- UK AI processing — your Document text is processed by AI only within UK borders (Microsoft Azure, London). Our Website itself is hosted in the US (see above).
- HTTPS — all connections to Claru are encrypted in transit.
- Secure payments — we use Stripe (PCI DSS Level 1). We never see or store your Card details.
- Unique Download Tokens — your Download Link is protected by a cryptographic token that expires automatically after 7 days.
Our legal basis for processing
We process your information under the following conditions of UK GDPR:
- Contract — processing your Document to deliver the Conversion you have paid for
- Consent — sending you marketing updates (only if you opt in)
- Legitimate interests — preventing abuse of the free Conversion allowance; improving service quality through pseudonymised statistics
Your rights
Under UK data protection law, you have the right to:
Ask what information we hold about you
Ask us to fix wrong information
Ask us to erase your information
Get a copy of your information
Object to how we use your information
Lodge a complaint with the ICO
Cookies
We use cookies to make our Website work properly. These help us:
- Keep your session secure while you use the service
- Process Payments safely through Stripe
We do not use tracking cookies or advertising cookies.
Changes to this policy
We may update this policy from time to time. When we do, we will update the date at the top. Significant changes will be highlighted on our Website.
Contact us
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: