Privacy Policy
Effective date: the date this page is first published at clandesco.ai/privacy.
Clandesco, Inc., a Delaware company (“Clandesco,” “we”) provides Decksterous, Marqable, Agentsia, clandesco-hq, and this website (together, the “Services”). This policy describes the information we use when you visit or use the Services.
Contact us at [email protected] for privacy questions or requests, or by mail at:
Clandesco, Inc.
1388 Haight St, Unit #468
San Francisco, CA 94117
United States
What we collect and why
We receive account identity and profile information needed to sign you in and operate your account. We store content you create or provide — presentations, documents, projects, tasks, agent messages, calendar events, and mail you ask us to send — so the relevant service can display, edit, synchronize, or deliver it. We also process service and security records, such as usage, errors, and access logs, to operate, protect, and troubleshoot the Services. Billing information is processed by Stripe, our payment provider, when you have a paid plan.
Some features send the content you choose to an AI provider to produce a requested output. The provider used depends on the feature; see “AI providers” below. Do not put sensitive information into prompts unless you are comfortable with that processing. If you connect your own API key for an AI provider (bring-your-own-key), your use of that provider is governed by your own agreement with it, not this policy.
AI providers
| Provider | Used by | Their stated retention | Used to train their general models? |
|---|---|---|---|
| Anthropic | All Services | Deleted within 30 days | No, not without permission |
| OpenAI | Decksterous, Agentsia, clandesco-hq | Up to 30 days for abuse monitoring; some account features retained until you delete them | No, not by default |
| Google Gemini (paid tier) | Decksterous, Agentsia, clandesco-hq | Logged by Google for a limited period | No |
| OpenRouter | Decksterous, Agentsia, clandesco-hq | Depends on the model’s underlying provider | OpenRouter itself does not train on it; we route requests through providers that do not train on your data |
| fal (image generation) | Decksterous | Request data kept 90 days by default; generated files kept at least 7 days | No, under fal’s no-train terms |
We also use Unsplash and Pexels for stock-photo search in Decksterous and clandesco-hq — only your search terms are sent, never your document content.
We do not sell personal information or Google user data, use it for advertising, or use it (or any customer content) to create, train, or improve general-purpose AI models.
Other service providers
We use these providers to run the Services: Clerk (sign-in), Stripe (payments), DigitalOcean (hosting), Backblaze (backups), Cloudflare (network and security), Sentry (error monitoring, configured not to receive your document content or personal data), Vercel (hosting this website), and Fastmail (company email).
Google connections
If you connect Google, Google sign-in supplies basic account identity (name, email address, and Google account identifier). clandesco-hq holds the connection and asks separately for a capability when you turn it on. It stores Google access and refresh tokens encrypted, checks the requested capability, refreshes access when needed, and records use. A product receives a short-lived access token for the enabled capability; it does not receive the refresh token.
Files and Docs/Slides. Marqable currently offers “Open in Google Docs”: after you authorize the drive.file permission and click the action, it sends the current document to Google Drive as a new native Google Doc and opens it there. Its access token stays in browser memory during that flow. We plan a shared Drive picker for Marqable and Decksterous that will let you choose individual Google files for import and export, so we only ever access a file you chose or that this app created, for that document or presentation workflow. That picker and two-way Google file sync are planned, not yet available. We do not request permission to browse your whole Drive.
Calendar. If you enable Calendar in Agentsia, we read your calendar list to show choices, and sync events on the calendar(s) you select, including event title, description, start and end time, and identifiers needed to keep the copies linked. When Calendar is first enabled, Agentsia currently selects your primary calendar by default; you can change the selection in settings. The sync can read, create, update, and delete events on the selected calendar. Imported events are stored as private events in Agentsia.
Gmail sending. If you enable Email — send in Agentsia, we use gmail.send to send messages you compose yourself or agent-drafted messages that you approve through the approval flow. The message, recipients, subject, body, and attachments are sent to Google for delivery. We do not use this permission to read your Gmail inbox; Gmail-inbox reading is not a feature we offer.
Google connection features may be unavailable until production setup and verification are complete. We will update this policy and the in-product consent notices before enabling any materially different Google data use.
Storage, sharing, and security
We store the account and service content needed for your work. Google connection tokens in clandesco-hq are encrypted at rest; access to a capability is checked before a token is issued. We use HTTPS for network traffic. We may send information to service providers that help us authenticate users, host or deliver the Services, process payments or email, or generate the AI output you request (see “AI providers” and “Other service providers” above). We transfer Google user data to another party only with your consent to provide or improve a visible user-facing feature, for necessary security purposes, or as required by law, subject to Google’s rules. Human access to Google user data is limited to your affirmative agreement for specific data, necessary security investigation, legal compliance, or properly aggregated internal operations. We do not sell personal or Google user data, use it for advertising, or use Google user data to create, train, or improve general AI models.
Google Limited Use statement: Clandesco’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data and developer policy.
Your controls, deletion, and retention
You can turn off a Google capability or disconnect the Google connection in the integration settings. Disconnecting revokes the connection at Google where possible, clears locally stored Google tokens, and stops future access. In Agentsia, disconnecting Calendar stops sync and removes sync links, but imported private events remain until you use the “Remove imported events” control or request deletion. Disconnecting does not delete files or messages already created in your Google account. You can also revoke Clandesco in your Google Account’s third-party connection settings.
Account deletion during the friends test. During the current friends test, there is no self-serve “delete my account” button for Agentsia, Decksterous, clandesco-hq, or Marqable. To delete your account and its data from any of these products, email [email protected] and we will handle it by hand within 30 days. Self-serve account deletion for Agentsia, Decksterous, clandesco-hq, and Marqable is planned before any of these products is released to the public.
To request access to, correction of, or deletion of your Clandesco account data at any time, email [email protected].
How long we keep things:
| Data | Kept |
|---|---|
| Account and work content | While your account is open |
| After a deletion request or closing an account | Removed from live systems within 30 days |
| Backups | Expire within 90 days, so deleted data is fully gone by then |
| Google tokens | Removed at once on disconnect |
| Security and service logs | 90 days |
| Billing and tax records | As long as the law requires |
We aim to act on access, correction, and deletion requests within 30 days. We will not keep Google-derived data longer than Google’s applicable rules allow.
Public sharing, children, and changes
Content you deliberately publish or share by link may be visible to people with that link. Check the sharing setting before placing sensitive information in a deck, document, or other shared item.
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this policy as the Services change. For material changes to Google data use, we will update the policy and obtain any required new consent before the new use begins. Contact: [email protected].