This Brand Privacy Policy (this "Policy") explains how Tokko Labs, Inc. (d/b/a Clero, "Clero," "we," "us," or "our"), a Delaware corporation registered to do business in the State of Washington, collects, uses, shares, and protects personal information relating to Brand users of the Clero platform (the "Platform"). Clero is an AI-agent-operated, cross-border creator-marketing platform; this Policy describes the data practices attached to our agentic campaign workflow for Brands.

1. Scope of This Policy

This Policy covers personal information we process about Brand account owners, administrators, employees, and other authorized users of a Brand account, and about prospective Brand contacts we reach through business outreach. Personal information of Creators and Makers is covered by the Creator Privacy Policy and Maker Privacy Policy. Where we process personal data contained in materials a Brand uploads solely to execute that Brand's Campaigns, we act as a service provider or processor for the Brand; for all other purposes described in this Policy — account administration, security, service improvement, marketing, and legal compliance — we act as the controller.

2. Controller and Contact

Controller: Tokko Labs, Inc. (d/b/a Clero), 300 Deschutes Way SW, STE 208, MC-CSC1, Tumwater, WA 98501, United States.
Privacy contact: support@clero.com (general privacy questions and rights requests); admin@clero.com (legal notices and escalations).
EU/UK representative: not yet appointed; this Policy will be updated when one is designated.

3. Personal Information We Collect

Identity and contact data — name, business email, mobile phone number (verified by a one-time SMS code at sign-up, as described in Section 20), job title, company name and address, your brand's social-media handles when you request paid-partnership labeling, and, where required for verification, business registration or tax identifiers.
Account and authentication data — credentials (stored as hashes), session identifiers, sign-in provider identifiers and profile details (Google; Kakao — account ID, email, nickname, and, if you consent in Kakao, phone number), your Brand Level, the third-party applications you authorize and the scopes you grant them, and security logs.
Campaign data — product information and images you upload or link, product-page URLs you paste and the page content, screenshots, and product images our systems extract from them, target markets, budgets, briefs, creator selections, offer and negotiation history, paid-partnership and boost settings, shipment tracking numbers, messages with Creators, content approvals and rejection reasons, and secondary-usage elections.
AI chat data — the prompts, messages, and files you submit to Platform chat, the Agent responses, a short AI-curated memory summary of your stated preferences and past Campaigns, and Token usage and balance records.
Reviews — the ratings, selected attributes, and comments you write about Creators and that Creators write about you.
Payment data — billing details, transaction history, and payment status. Card details are collected and processed by Stripe; we do not receive or store full card numbers.
Usage and device data — IP address, browser and device type, pages viewed, feature events, approximate location derived from IP, and referral source.
Communications — support requests, emails, and feedback.
Inferred data — matching scores, product-category predictions, and fraud- and risk-related signals generated by our systems.

Voice conversations

If you use voice chat and allow microphone access, your browser sends microphone audio to OpenAI while the call is active to generate spoken responses and carry out your requests. Clero does not record raw audio. You can mute the microphone or end the call at any time. Voice uses the same tasks and tools as text chat; important actions require your review and approval on the cards in the chat. Voice responses are AI-generated.

4. Sources of Personal Information

We collect personal information (a) directly from you when you register, chat with Agents, create Campaigns, or contact support; (b) automatically from your devices through cookies and similar technologies; (c) from our payment processor, Stripe (payment status and verification signals); (d) from identity-verification and anti-fraud vendors; (e) from publicly available business sources (such as company websites and professional networks) used by our marketing systems to identify and contact prospective Brand customers; (f) from identity providers you choose to sign in with (Google, Kakao), within the permissions you grant them; and (g) from web pages you direct our Agents to analyze.

5. Purposes and Legal Bases

Where GDPR, UK GDPR, or similar laws apply, we process personal information on these legal bases:

Purpose	Legal basis
Provide the Platform, run Campaigns, and perform our contract with you	Contract (GDPR Art. 6(1)(b))
Process payments, Token purchases, and invoices	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Prevent fraud and abuse, secure the Platform, enforce our terms	Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))
Operate, evaluate, and improve the Platform and Agents, using de-identified or aggregated data where feasible	Legitimate interests (Art. 6(1)(f))
Business-to-business marketing and outreach	Legitimate interests (Art. 6(1)(f)); consent where required (Art. 6(1)(a))
Comply with law and respond to legal process	Legal obligation (Art. 6(1)(c))

6. AI Agents and Automated Decision-Making

The Platform is operated by AI Agents that analyze products you submit, generate campaign briefs, recommend and rank Creators, review Content against briefs, support Live Post verification, and answer support queries. Automated outputs are probabilistic and may contain errors; material decisions about Campaigns (including brief approval, offer terms, and content approval) remain under your control, and you may request human review of any automated decision that materially affects your account by emailing support@clero.com. Creator matching and ranking use deterministic rules and vector-similarity scores (text embeddings) and do not involve generative AI. Conversational, product-analysis, and content-review features are powered by large-language and vision models from third-party AI model providers acting as our service providers under contractual confidentiality and use restrictions; these providers are located in the United States and, for video analysis, outside the United States (including in the People's Republic of China), as described in Section 10. We use these providers' business and API offerings, whose terms restrict the use of customer inputs to train their generally available models, and we do not permit them to use your identifiable data for such training. Campaign text and messages may be machine-translated at your or a Creator's request through a cloud translation service. Live-post verification and payout release are performed by Clero personnel with automated assistance.

7. How We Use Personal Information

We use personal information to (a) create and administer accounts; (b) analyze products and generate Campaign briefs; (c) match, rank, and present Creators; (d) manage Offers, Engagements, payments, refunds, and payouts; (e) meter AI usage and administer Token limits and purchases; (f) review Content and verify Live Posts; (g) provide customer support; (h) monitor, detect, and prevent fraud, abuse, and security incidents; (i) analyze and improve the Platform and Agents; (j) send transactional messages and, subject to applicable law and your choices, marketing communications; (k) verify your phone number, secure and recover your account, and detect duplicate or fraudulent accounts; (l) provide machine translation and display reviews; and (m) comply with legal obligations and enforce our agreements.

With Creators — the Campaign and Brand information needed to evaluate, negotiate, and perform an Engagement (such as brand name, brief, offer terms, paid-partnership handle, shipment tracking status, and messages you send), together with your average rating and the reviews Creators have written about you. We do not share your phone number or payment details with Creators.
With Authorized Applications — third-party applications you authorize through the Platform's OAuth consent screen receive the account data within the scopes you approve, under their own privacy practices; you can revoke access at any time in account settings.
With our contractors (Makers) — vetted independent contractors bound by confidentiality who assist with content review and quality assurance may see Campaign information and Content.
With service providers — vendors that host and operate the Platform on our behalf, as described in Section 9.
With professional advisors — lawyers, accountants, auditors, and insurers under confidentiality obligations.
With authorities — when required by law, subpoena, court order, or to protect rights, safety, or the integrity of the Platform.
In corporate transactions — in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to continued protection of personal information.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

9. Service Providers and Sub-processors

Our principal categories of service providers are cloud infrastructure, hosting, SMS and email delivery, machine translation, and text embeddings (Amazon Web Services); payment processing and payouts (Stripe); AI model providers used to power the Agents; shipment tracking (AfterShip); web analytics (Google Analytics); hosting of embedded content on our announcement and service-status pages (Notion); internal alerting and collaboration tools that receive limited operational notifications about Campaign and Offer status; and customer-support tooling. Social-platform APIs (Meta/Instagram, TikTok) are used to operate Creator-side features and to check paid-partnership handles, and identity providers (Google, Kakao) are used for sign-in. All service providers are bound by contracts limiting their processing to our instructions. A current list of material sub-processors is available on request at support@clero.com.

10. International Data Transfers

We are based in the United States, and our own systems store personal information in the United States; personal information is also processed in other countries where our service providers operate. In particular, the AI model provider we currently use for video analysis is located outside the United States, including in the People's Republic of China; we send that provider only the media needed for the requested analysis, under contractual restrictions. Where personal information is transferred from the EEA, UK, or Switzerland, we rely on applicable safeguards, including the European Commission's Standard Contractual Clauses, the UK Addendum or IDTA, and the Swiss Addendum, together with supplementary technical and organizational measures. Copies of applicable transfer mechanisms are available on request at support@clero.com.

11. Data Retention

Category	Typical retention
Account and identity data	Life of the account, then up to 24 months
Verified phone number	Life of the account; SMS delivery logs up to 3 months
Campaign, Offer, and Engagement records	7 years after completion (contract, tax, and audit)
Reviews	Life of the reviewed account
Financial and tax records	7 years
AI chat logs and Token usage records	Life of the account, then up to 24 months
AI memory summary	Life of the account; reset on request
Support communications	24 months
Usage and telemetry data	13 months
Internal analytics snapshots	While needed for business reporting, in restricted-access storage
Marketing contacts	Until opt-out or 24 months of inactivity
Voice transcript fragments for troubleshooting	Expire after 7 days and are automatically deleted. Saved conversation messages and action records follow the applicable retention periods in this Policy.

We retain data longer where required by law, legal hold, or an ongoing dispute, and we may retain de-identified or aggregated data without time limit.

12. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, to withdraw consent, and to complain to a supervisory authority. To exercise rights, email support@clero.com from the address associated with your account or use in-product settings; we will verify your request and respond within the timeframe required by applicable law. You can also trigger a tracked account-deletion request in account settings, as described in Section 18.

13. California Privacy Notice (CCPA/CPRA)

For California residents: we collect the categories of personal information described in Section 3 for the purposes in Section 7, and we disclose them to the recipients described in Sections 8 and 9. We do not sell personal information and have not done so in the preceding 12 months, and we do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes requiring a right to limit. California residents may exercise the rights to know, access, correct, and delete, and the right to non-discrimination, by emailing support@clero.com; authorized agents may submit verifiable requests on your behalf.

14. Other US State Privacy Notices

Residents of other US states with comprehensive privacy laws (including Washington, Colorado, Connecticut, Virginia, Texas, and Oregon) may have similar rights of access, correction, deletion, portability, and opt-out, and may appeal a refusal by replying to our decision or emailing admin@clero.com. We do not process personal information for targeted advertising or profiling that produces legal or similarly significant effects without the controls described in this Policy. We do not collect consumer health data within the meaning of the Washington My Health My Data Act.

15. Children's Privacy

The Platform is a business service, is not directed to children, and may not be used by anyone under eighteen (18). We do not knowingly collect personal information from children under thirteen (13) as defined by COPPA; if we learn we have done so, we will delete it promptly. Contact support@clero.com regarding any suspected child data.

16. Cookies and Similar Technologies

We use strictly necessary cookies (authentication, security, load balancing), functional cookies (preferences, locale, cookie choices), and analytics cookies (Google Analytics) to understand product usage. Where consent is required, we obtain it through our cookie controls, and you can adjust preferences at any time in your browser or through the Platform's cookie settings. Pages that embed third-party content (for example, our announcement and service-status pages hosted on Notion) may set that provider's cookies under its own policy. We do not use third-party advertising cookies.

17. Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, least-privilege access controls, multi-factor authentication for privileged access, logging and monitoring, secure development practices, and vendor due diligence. No security program is perfect; you are responsible for protecting your account credentials and for the security of your own systems.

18. Data Deletion Requests

You can delete your account and request deletion of associated personal information from account settings or by emailing support@clero.com. Deletion requests are tracked: you receive a reference code and email notifications, and anyone can check the progress of a request on our public status page at clero.com/data-deletion. We aim to complete deletion within thirty (30) days, subject to data we must retain under Section 11 (for example, tax and transaction records) and to backups that roll off on a fixed schedule.

19. Data Breach Notification

If a personal-data breach is likely to result in a risk to individuals, we will notify the competent supervisory authority without undue delay — where feasible within seventy-two (72) hours where the GDPR applies — and will notify affected individuals and regulators as required by applicable US state and other breach-notification laws.

Brand accounts require a verified mobile phone number. When you register (or when we later ask you to verify), you enter a number in a supported country and we send a one-time verification code by SMS through our cloud messaging provider; standard carrier message and data rates may apply. We store your number in encrypted form, associate one verified number with each account, and keep limited delivery logs (including the destination number) for a short period for security and troubleshooting. We use your number to verify your identity, secure and recover your account, detect duplicate or fraudulent accounts, and contact you about your account. We do not send marketing text messages, and we do not share your number with Creators. Where you opt in, we may also use your number to deliver service notifications through messaging services such as KakaoTalk when those features are available. If you sign in with Google or Kakao, we receive the identifiers and profile details you allow the provider to share (for Kakao: account ID, email, nickname, and, with your consent, phone number) and link them to your Clero account; the provider's own privacy policy governs its processing.

21. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced by email or through the Platform at least fourteen (14) days before they take effect, and the version and effective date at the top of this Policy will be updated. This Policy is drafted in English; translations are provided for convenience only, and the English version controls if there is any conflict.

22. Contact

Privacy questions and rights requests: support@clero.com
Legal notices and escalations: admin@clero.com
Address: Tokko Labs, Inc. (d/b/a Clero), 300 Deschutes Way SW, STE 208, MC-CSC1, Tumwater, WA 98501, United States