Client Cleared Privacy Notice

Last updated: 14 July 2026

Client Cleared is operated by Daniel O'Donovan, a sole trader trading as Client Cleared
("Client Cleared", "we", "us"), established in Ireland. You can contact us about
anything in this notice at info@clientcleared.com.

This notice explains how we handle personal data on our marketing website
(clientcleared.com) and in the Client Cleared application (app.clientcleared.com).

1. The two roles we play

• For visitors to our website and for the professional firms who hold Client Cleared
  accounts, we are the data controller: we decide how and why the data is used,
  and this notice applies in full.
• For the clients of those firms (the people a firm onboards and screens through
  Client Cleared), the firm is the controller and we are its processor. We handle
  that data only on the firm's instructions, under our Data Processing Agreement. If
  you are being onboarded by your accountant or adviser through Client Cleared, they are
  responsible for your data and their privacy notice applies; contact them first,
  and we will assist them with any request you make.

2. What we collect and why

Website visitors. Our website sets no cookies and loads no third-party trackers,
analytics or fonts. The only personal data it collects is what you type into the
demo request form (name, firm, work email, phone if you choose, and firm size),
which is emailed to us so we can respond. Lawful basis: our legitimate interest in
responding to your enquiry.

Firm accounts. When a firm signs up we hold staff names, work email addresses,
roles, hashed passwords and two-factor authentication settings; subscription and
billing records; and security logs (actions taken in the app, with timestamps, IP
address and browser details). Lawful bases: performing our contract with the firm,
our legitimate interest in keeping the service secure, and legal obligations such
as tax and accounting record-keeping.

We do not use personal data for advertising, we do not sell it, and we do not make
automated decisions with legal effect about you.

3. Who we share data with

We use a small number of service providers to run Client Cleared:

• Railway (Netherlands): application hosting. Data is hosted in the EU.
• Cloudflare: website hosting and encrypted file storage.
• Stripe (United States): subscription billing. Transfers are covered by the
  European Commission's Standard Contractual Clauses.
• Resend: delivery of transactional email, including demo request messages.
• Anthropic (United States): where a firm chooses to use the optional AI-assisted
  beneficial-ownership drafting feature, the content of the relevant public company
  filing is sent to Anthropic for automated extraction. No other client data is
  included, and any result is a draft that a member of the firm must review and
  confirm before it is relied upon. Transfers are covered by the European
  Commission's Standard Contractual Clauses.
• On the instructions of firms, identity verification and sanctions screening
  providers process the data of the firms' clients; these are engaged as
  sub-processors under our Data Processing Agreement, which lists them and is
  available to every firm in the app.

We share data with nobody else, except where the law requires it.

4. How long we keep it

• Demo enquiries: up to 12 months after our last contact with you, then deleted.
• Firm account data: for the life of the account and up to 6 years afterwards where
  Irish tax and contract law requires it.
• Security logs: retained per the retention schedule in the app, and never for
  active accounts less than the period the firm's own compliance obligations demand.
• Data we process for firms is retained and erased per the firm's instructions and
  the Data Processing Agreement, including automated erasure at the end of the
  statutory AML retention period.

5. Security

Sensitive fields and uploaded documents are encrypted at rest, connections are
encrypted in transit, access is role-restricted and protected by two-factor
authentication, and every security-relevant action is logged. A fuller plain-English
description of our measures is available on request.

6. Your rights

You have the right to access, correct, delete and receive a copy of your personal
data, and to object to or restrict our processing of it. Write to
info@clientcleared.com and we will respond within one month. If you are unhappy with
our answer, you can complain to the Data Protection Commission (dataprotection.ie),
Ireland's supervisory authority, or the supervisory authority where you live.

7. Changes

We will post any changes to this notice here and update the date at the top. If a
change materially affects firms' rights, we will notify account holders by email.