Privacy Policy.

Information We Collect

Basalt Labs ("we," "us," or "our") operates the Cleo personal assistant service ("Service"). This Privacy Policy describes how we collect, use, and protect your information when you use the Service.

Registration Data

When you create an account, we collect:

• Full name and preferred name
• Phone number (verified via SMS one-time password)
• Email address (optional)
• City and timezone
• Birthday
• Language preference

Google Account Data (if connected)

When you choose to connect your Google account via OAuth 2.0, you grant Cleo access to:

• Google Calendar: Full read and write access to manage events and check availability. Scope: calendar
• Gmail: Read, search, send, and reply access via the gmail.modify scope. Cleo does not delete emails.
• OAuth tokens: Google refresh tokens are stored securely server-side to maintain your connection.

We do not request access to Google Drive, Google Photos, Google Contacts, or any other Google services.

Voice and Conversation Data

• Voice input processed in real-time by ElevenLabs for speech-to-text and text-to-speech
• Conversation transcripts associated with your sessions

User-Saved Knowledge

• Facts, preferences, and personal information you explicitly ask Cleo to remember, stored in your personal knowledge base

How We Use Your Information

We use the information we collect solely to provide, maintain, and improve the Service:

• Service delivery: To fulfill your requests, including placing outbound phone calls, managing calendar events, drafting and sending emails, and remembering information you ask Cleo to retain.
• Authentication: To verify your identity via SMS one-time passcode and manage your account session.
• Personalization: To greet you by name, respect your timezone, and communicate in your preferred language.
• Notifications: To send you SMS updates when Cleo completes tasks on your behalf, such as confirming a booked appointment.
• Service improvement: To analyze aggregate, anonymized usage patterns to improve functionality and reliability.

We do not use your personal information for advertising, profiling, or any purpose unrelated to providing the Service.

Google API Services User Data Policy

Cleo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request access to Google Calendar and Gmail scopes that are necessary for Cleo to function as described.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read your Google data unless (a) we have your explicit consent, (b) it is necessary for security purposes, (c) it is required to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and de-identified.
• We do not transfer Google user data to third parties except as necessary to provide or improve the Service, to comply with applicable laws, or as part of a merger, acquisition, or asset sale with prior notice to users.

Third-Party Services

To deliver the Service, we rely on the following third-party providers. Your data is shared with these services only to the extent necessary for Cleo to function:

ElevenLabs

Provides voice synthesis and conversational AI processing. Your voice interactions are transmitted to ElevenLabs for real-time speech-to-text and text-to-speech conversion. ElevenLabs processes this data in accordance with their Privacy Policy.

Anthropic (Claude)

Provides large language model reasoning capabilities that power Cleo's ability to understand requests and formulate responses. Conversation content is processed by Anthropic's Claude model through ElevenLabs' agent infrastructure. Anthropic's data handling is governed by their Privacy Policy.

Telnyx

Provides telephony infrastructure for outbound calls and SMS messaging. Your phone number and call-related data are shared with Telnyx solely for the purpose of placing calls and delivering SMS notifications. Telnyx processes this data in accordance with their Privacy Policy.

Google

When you connect your Google account, we use Google's OAuth 2.0 protocol to obtain a refresh token, which is stored securely and used to access your Calendar and Gmail on your behalf. We access only the scopes you explicitly authorize. Your Google data is used solely to fulfill your requests and is not shared with any other party.

Supabase

Provides database infrastructure. Your account data, authentication tokens, and knowledge base entries are stored in a PostgreSQL database hosted by Supabase with row-level security policies and encryption at rest.

Vercel

Provides web hosting and serverless function execution. All API requests are processed through Vercel's serverless infrastructure. Vercel processes request data in accordance with their Privacy Policy.

Each third-party service is governed by its own privacy policy. We encourage you to review their respective policies.

Data Storage & Security

Your data is stored in a Supabase-hosted PostgreSQL database with Row Level Security (RLS) policies enforced. All database access is performed server-side through authenticated serverless functions using a service role key. The browser client never communicates with the database directly.

We implement the following security measures:

• All data in transit is encrypted via TLS/HTTPS
• Google OAuth refresh tokens are stored server-side and never exposed to the client
• Access tokens are refreshed on each request and are not cached in memory or on disk
• Phone number verification via one-time passwords ensures account authenticity
• API endpoints are protected with authentication checks

While we take reasonable measures to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

Data Retention & Deletion

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you request deletion of your account.
• Knowledge base entries: Retained until you ask Cleo to forget them or until you request account deletion.
• Google OAuth tokens: Retained until you disconnect your Google account or request account deletion. You may also revoke access at any time through your Google Account permissions.
• Conversation transcripts: Retained as part of your session history and deleted upon account deletion.

You may request deletion of your account and all associated data at any time by contacting us at contact@basaltlabs.app. Upon receiving a verified deletion request, we will delete your user profile, knowledge base entries, OAuth tokens, and conversation data. Deletion will be completed within 30 days. Some data may be retained in infrastructure backups for a limited period, after which it will be permanently purged.

Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you are under 18, please do not use the Service or provide any personal information. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a minor has provided us with personal data, please contact us at contact@basaltlabs.app.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Effective" date at the top of this page and, where appropriate, notify you via the Service or email.

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: contact@basaltlabs.app
• Entity: Basalt Labs