Privacy Notice
Version 2026-10 · last updated 19 October 2026.
This notice explains how Rob Gardiner Limited, trading as Clavarius ("Clavarius", "we"), a company registered in England and Wales (company number 15356974, registered office 12 The Ridge, Bussage, Stroud, England, GL6 8HD), handles personal data. We're registered with the UK Information Commissioner's Office (registration number ZB787276). Questions: hello@clavarius.io.
Two different roles
1. When we're the controller — for our own customers' account and billing contacts (the people who sign up, admins, and anyone who contacts us). This notice covers that data in full.
2. When we're a processor — for the staff, visitors and delivery details our customers record in their Clavarius workspace. The customer organisation is the controller for that data and decides how it's used; we only process it on their instructions under our Data Processing Agreement. If you signed in at one of our customers' sites, please contact that organisation about your data. We'll pass on any request we receive to them.
Data we collect as controller
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, organisation name, workspace address | Create and run your account | Contract |
| Password (stored only as a secure one-way hash) | Let you sign in | Contract |
| Billing details (handled by Stripe; we see card brand and last four digits, not the full number) | Take payment | Contract |
| Terms version you accepted, when, and from which IP address | Record of agreement | Legitimate interests |
| Login attempts (email, IP address, time) and security logs | Protect accounts from attack | Legitimate interests |
| Emails we send you (recipient, subject, delivery status) | Account and service messages | Contract / legitimate interests |
| Messages you send us | Support | Legitimate interests |
| Website visitors (clavarius.io), only if you accept analytics cookies: pages viewed, device and browser type, approximate location, a random identifier (Google Analytics) | Understand how our website is used | Consent |
We don't use your data for advertising, and we don't sell it.
How long we keep it
- Account data: while your account is open, then deleted 30 days after you close it (backups roll off within a further 35 days).
- Billing records: as long as tax law requires (normally 6 years).
- Login-attempt records: 30 days. Email logs: 12 months.
- Website analytics (Google Analytics): 14 months.
Who we share it with (sub-processors)
| Provider | What for | Location |
|---|---|---|
| Hostinger | Server hosting (application and database) | United Kingdom |
| Cloudflare | DNS; storage of encrypted backups (R2) | EU (Western Europe); DNS is global |
| Mailgun (Sinch) | Sending emails (EU region) | EU |
| Stripe | Payments | UK/EU, with transfers under Stripe's safeguards |
| Google (Google Analytics) | Website analytics, only with your consent; never used inside the Clavarius app | EU/US, under the UK–US data bridge |
Where data leaves the UK, we rely on UK adequacy regulations or appropriate safeguards (such as the International Data Transfer Addendum).
Security
All traffic is encrypted (HTTPS). Each customer's data is kept separate from every other customer's at the database level. Passwords are stored only as strong one-way hashes. Logins are rate-limited. The server accepts administrative access by key only and sits behind a firewall. Nightly backups are encrypted before leaving the server. We monitor the service continuously.
Cookies
The Clavarius app uses only essential cookies, to keep you signed in and protect forms. Our website (clavarius.io) also uses Google Analytics cookies, but only if you accept them. We use no advertising cookies. See our Cookie Notice.
Your rights
You can ask to access, correct, delete, restrict or object to our use of your personal data, and to receive it in a portable format. Email hello@clavarius.io. We'll respond within one month. You can also complain to the ICO (ico.org.uk), though we'd appreciate the chance to help first.
Changes
We'll update this notice when our practices change and show the date of the latest version here.