Privacy policy

1. Who we are and our role

For the accounts of people who use Clutched, our website and our own billing, Clutched is the controller of your personal data.

Businesses use Clutched to send proposals, contracts and invoices to their clients. For the data a business puts into Clutched, including its clients’ details, that business is the controller and we act as its processor under our data processing agreement. If you received a proposal, contract or invoice through Clutched, the business that sent it decides how your data is used; please contact them first. Section 4 explains what is recorded.

2. What we collect about Clutched users

• Account details: your name, email address, job title and password (stored only as a secure hash by our sign-in provider). If you sign in with another account provider or your company’s single sign-on, we receive your name and email from them.
• Security data: two-factor authentication settings, and an audit log of sign-ins and security-relevant changes with the time, IP address and browser used.
• Business details and content: your company name, address, registration and tax numbers, logo, brand, packages, prices, and the proposals, contracts, invoices, templates and files you create or upload.
• Billing: your plan, number of users and subscription status. Payments are handled by our payment processor; we never see or store your full card details.
• Usage: counts we need to apply plan limits (such as documents sent and AI requests each month) and technical logs kept by our hosting providers.
• Messages you send us, such as support emails.

3. How we use it and our lawful bases

• To provide Clutched (create your account, store your work, send your documents, process your subscription): performance of our contract with you.
• To keep Clutched secure (sign-in protection, audit logs, preventing abuse): our legitimate interest in protecting our users and service.
• To support you and tell you about changes to the service or these terms: performance of contract and legitimate interests.
• To keep financial records as tax and accounting law requires: legal obligation.

We don’t sell personal data, show advertising, or use your content to train AI models.

4. Clients who receive documents through Clutched

When a business sends you a proposal, contract or invoice, Clutched records, on that business’s behalf:

• the name, email address and other details the business entered;
• when the document was opened, and how long was spent on each page, grouped by a random identifier held in your browser tab (no cookies are used for this);
• options you choose, comments you leave, and any signature: your typed or drawn signature, name, email, the time, your IP address and browser, and a fingerprint of the exact document signed, which together form the signing record;
• whether an invoice has been paid. Card and bank payments are made directly to the business’s own payment provider account; we don’t receive your payment details.

5. AI features

When you use AI writing, design or the assistant, the information needed for that request (for example your company details, the client’s details and the proposal text) is sent to our AI model provider. Under its commercial terms this content is not used to train its models. If you give us a website address, we read that site’s public pages to research the business and its brand.

6. Who we share data with

We use these service providers, each bound by a contract to protect the data and use it only to provide their service to us:

• cloud hosting and database providers, which store your data in the UK;
• an email delivery provider, to send invitations, documents, reminders and receipts;
• an AI model provider, when you use AI features;
• a payment processor, for Clutched subscriptions.

If you connect other services, such as payment, accounting or CRM software, we send them the data needed for that connection on your instructions, under your own account with them. We may also disclose data if the law requires it, to protect our rights or users, or to a buyer if our business is sold, in which case this policy continues to apply.

7. International transfers

Your workspace data is stored in London. Where a provider processes data outside the UK, such as in the US, we rely on safeguards recognised by UK law: the UK–US data bridge where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

8. How long we keep data

• Account and workspace data: for as long as your account or workspace exists. When a workspace is deleted, its data and files are deleted from our live systems straight away.
• Backups: kept for 7 days, after which deleted data is gone for good.
• Hosting logs: kept by our hosting providers for a limited period, then deleted automatically. The audit log is kept for as long as the workspace exists.
• Billing records: kept for as long as tax law requires (in the UK, six years).

9. Your rights

You can ask to access, correct, delete or receive a copy of your personal data, and to object to or restrict how we use it. Most of this you can do yourself: edit your details in Settings, download your workspace’s data under Settings → Data, and delete your account or workspace there too. For anything else, contact us through the app. We’ll respond within one month.

If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.

10. Cookies

Clutched uses only the cookies needed to keep you signed in. There are no advertising or analytics cookies. See our cookie policy.

11. Security

We protect data with encryption, strict access controls and audit logging. Read more on our security page.

12. Children

Clutched is a business service and isn’t intended for anyone under 18.

13. Changes to this policy

If we make significant changes, we’ll tell account owners by email or in the app before they take effect. The date at the top shows when it last changed.