Privacy Policy

This policy explains what we collect when you use Cleonhill, why we collect it, and the choices you have. We keep it plain so you can actually read it.

1. Who we are

Cleonhill is operated by Cleonhill Proprietary Limited, a private company registered in Botswana and based in Gaborone. We are the responsible party under Botswana's Data Protection Act, and where the EU or UK GDPR applies to you we comply with it and act as thedata controller for your account, billing, support and security data.

For the content you put into the service — your prompts, your project files, the tasks you give the work agent and what it produces — we act as a processor, handling it on your instruction to run the service for you. You decide what goes in.

Questions, requests and complaints: [email protected].

2. What this policy covers

This covers the Cleonhill website, the builder you use to create agents, and the work agent that carries out tasks on its own computer. It does not cover the bots you build and run yourself once they are exported, or the third-party services you choose to connect them to. Those run under their own terms.

3. Information we collect

• Account details, such as your email address, handled through our auth provider. Building requires an account.
• The prompts and messages you send to the builder, and the bot code the AI generates in response.
• Build activity and logs we use to keep the service working and to improve it.
• Your credit balance and usage.
• API keys you paste to connect a third-party service to your bot. These are stored so your bot can run, and are never shown to the AI model or printed in the chat.
• The tasks you give the work agent, what it did to carry them out, the files it produced, and a video recording of its screen while it worked. If you sign in to one of your own services during a task, that screen is part of the recording.
• Things the agent notes about how you like to work, so it does not have to ask twice — a preference, a correction you gave it, a detail about your business. You can ask us to delete these at any time.
• Basic technical data such as IP address and browser type.

Please do not put anything into a task, a prompt or a connected service that you would not want processed by an AI model or recorded on screen. Where a task needs one of your accounts, you sign in yourself — we never ask for your password and do not store it.

4. How we use your information

• To run the builder, which includes sending your prompt and the current state of your bot to our AI model provider so it can write and test your bot.
• To store and show your projects.
• To meter credits and prevent abuse of the service.
• To keep the platform secure and to fix problems.
• To improve the product, using activity data.
• To meet our legal obligations.

5. Why we are allowed to use it

Where the EU or UK GDPR applies, we rely on these legal bases:

• Performance of a contract— creating your account, running builds and tasks, storing your projects, metering credits, taking payment and answering support.
• Our legitimate interests— keeping the platform secure and available, preventing fraud and abuse of free credit, and improving the product from activity data. You can object to processing on this basis and we will consider it.
• Legal obligation— accounting, tax and records we must keep, and responding to lawful requests.
• Consent— where we ask for it, such as optional marketing. You can withdraw it at any time without affecting what came before.

6. The AI model

Building a bot means sending your prompt and build context to our AI provider, OpenRouter, which routes it to one of several AI models, so it can generate and fix your code. We do not sell your data and we do not use it to train third-party AI models. Please do not paste passwords or sensitive personal data into the chat that you would not want processed by an AI model.

7. Who we share data with

We share only what each provider needs to run the platform:

• Supabase, for accounts, database, and file storage.
• OpenRouter, our AI provider, which routes what you send to whichever model is in use at the time — to build your bot, and to run your work agent.
• Infrastructure hosts — Contabo, AWS and similar virtual-machine providers — which supply the temporary computers your bots are tested on and your work agent runs its tasks on.
• Paddle, our payment provider, for checkout, subscriptions and invoices.
• Resend, which delivers the emails we send you.
• Speech providers, where you dictate a message or an agent speaks, to turn speech into text and text into speech.
• Network and hosting providers that deliver the site.
• Legal authorities, where the law requires it.
• A successor, if the business or its assets are transferred.

8. Keys for connected services

When you connect a third-party service to your bot by pasting an API key, we store that key so your bot can use it, and inject it into your bot at runtime. It is never sent to the AI model and never displayed back in the chat. You can remove a connected key at any time.

9. International transfers

Some of the providers above operate outside your country, and some outside the European Economic Area — including the AI and speech providers your prompts, tasks and voice recordings are sent to. Where data crosses borders we rely on lawful transfer safeguards such as standard contractual clauses. If you would rather your content were not processed abroad, do not send it to the AI or use voice features, as processing abroad is how the service works.

10. Your rights

You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict how we use it, or stop a particular use altogether. Where we rely on consent you can withdraw it at any time. We do not make decisions about you by automated means that produce legal or similarly significant effects.

You can do much of this yourself: delete a project, a task or its recording from the app, or close your account, which removes your projects and what the agent remembered about you. Otherwise email [email protected]and we will respond within one month. We may need to confirm who you are first, and some records — billing, tax, fraud prevention — we are required or entitled to keep.

If you think we have got it wrong, you can complain to your data protection regulator: in Botswana the Information and Data Protection Commission, and in the EEA or UK your national supervisory authority.

11. How long we keep it

We keep your projects, their build logs, the files your tasks produced and their screen recordings while your account is active, and delete them on request. Deleting a project or a task removes its files and recording with it. The computer a task runs on is temporary and is destroyed when the task ends, along with anything you signed into on it. Closing your account removes your projects and what the agent remembered about you. Credit and billing records are kept as long as we need them for accounting and tax, and we may keep security and abuse records for as long as needed to protect the service.

12. Keeping the service safe

We record how the service is used — sign-ins, credit usage, tasks and builds, and technical signals such as IP address — so we can keep it running, meter it accurately, and detect abuse such as fraud, resource abuse or attempts to get more free credit than intended. We may review activity or content where we reasonably need to in order to operate the service, investigate abuse, fix a fault, or respond to a legal request. We are not obliged to explain how we detect abuse, since that would help people evade it.

If a security incident affects your personal information, we will act to contain it and will tell you and any relevant regulator where the law requires, without undue delay.

13. Security

We encrypt data in transit, restrict access to it, keep our application tables off the public data API, and never send your secrets to the AI model. No system is perfectly secure, so we cannot promise absolute protection, but we work to keep your data safe.

14. Cookies

Necessary cookiessign you in and keep you signed in: a session cookie and a refresh cookie once you sign in, plus two short-lived ones that confirm a sign-in started in the same browser that finished it — one during e-mail confirmation, one during Google sign-in. They are all necessary for the service to work, and nothing is set until you begin signing up or signing in.

Advertising cookies.We use Google Ads to measure our advertising, and its tag can set cookies on our site. These stay off by default: the tag loads with consent denied, so nothing is stored or shared with Google for advertising until you accept in the cookie banner. Reject it and they stay off. You can change your mind later by clearing this site's cookies and stored data in your browser, which brings the banner back. We do not sell tracking data.

15. Children

Cleonhill is not directed at people under 18. If we learn we have collected data from a child, we delete it.

16. Changes to this policy

If we make a material change we will post the new version here and update the date above. Continued use after a change means you accept it.

17. Photography and attribution

The business photographs on our site are provided by their photographers through Unsplash and used under the Unsplash License.

18. Contact

Questions about this policy or your data can go to [email protected].