Privacy Policy

1. Who we are

ClevSec ("we", "us") is an independent cybersecurity tools studio operated from Poland. Our website is clevsec.one. Contact: [email protected].

2. What data we collect

We collect minimal data:

Newsletter subscribers: Email address only, submitted voluntarily through our signup form.

Purchases: Handled entirely by LemonSqueezy (our Merchant of Record). We do not store your payment details. LemonSqueezy processes your name, email, and payment information under their own privacy policy.

Analytics: We use Cloudflare Analytics, which does not use cookies and does not track individual users. It collects aggregate data only (page views, country, browser type).

ClevSec Pro license checks: If you enter a ClevSec Pro license key in one of our tools, your browser sends the key directly to LemonSqueezy to confirm it is valid. The key is not sent to us and we do not store it. Your tool answers and results never leave your browser.

MCP server for AI assistants: If you connect an AI assistant to our MCP server, the assistant sends the facts a tool needs (for example a sector, a headcount or how long an incident lasted). The tools do not ask for personal data, and you should not include any. We compute the answer and do not store your request; our own logs record only which tool was called. Cloudflare processes the connecting IP address to deliver the service and to limit abuse, and keeps short-lived technical request logs under its own policy.

ClevSec Pro in AI assistants: If you connect the Pro address, you sign in once with your ClevSec Pro licence key. We check it with LemonSqueezy and store it with your access grant, encrypted so that only your assistant's access token can unlock it, so that we can re-check your subscription when Pro tools are used. We do not store your name or email for this. The grant expires when it has not been used for 30 days.

3. How we use your data

Newsletter email addresses are used solely to send you compliance insights and product updates. We do not sell, rent, or share your email address with third parties.

4. Legal basis (GDPR)

We process your email address based on your consent (Article 6(1)(a) GDPR), which you provide when subscribing to our newsletter. You can withdraw consent at any time by unsubscribing.

Checking a ClevSec Pro license key, and keeping it with an AI assistant's access grant, is necessary to provide the subscription you purchased (Article 6(1)(b) GDPR).

Processing connection data such as IP addresses to run the MCP server securely and limit abuse is based on our legitimate interest in offering a reliable free service (Article 6(1)(f) GDPR).

5. Data processors

LemonSqueezy — Payment processing, product delivery, and ClevSec Pro license key checks (Merchant of Record). Their privacy policy.

Cloudflare — Hosting, DNS, analytics, and running the MCP server. Their privacy policy.

FormSubmit — Newsletter form processing. Their privacy policy.

6. Cookies

This website does not use cookies. We do not use any tracking cookies, advertising cookies, or analytics cookies.

If you unlock ClevSec Pro, a single "Pro active" flag is saved in your browser's session storage so Pro features stay unlocked while you use the site. It contains no personal data, is never sent to us, and is deleted when you close the browser tab.

7. Your rights

Under GDPR, you have the right to access, rectify, erase, restrict processing of, and port your data. You also have the right to object to processing and to withdraw consent. To exercise these rights, contact [email protected].

8. Data retention

Newsletter email addresses are retained until you unsubscribe. Purchase records are retained by LemonSqueezy per their retention policy and our tax obligations (5 years for financial records under Polish law). Access grants for ClevSec Pro in AI assistants, with the encrypted licence key, are deleted after 30 days without use.

9. Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date.