1. Controller and Privacy Contact
The organization responsible for this Privacy Policy is CLEVOIR INC., 7900 Hurontario Street, Unit #507, Brampton, Ontario L6Y 0P6, Canada.
Privacy Officer: Asad Akbar. Email: info@getclevoir.com. Phone: +1 437 235 5895. Website: clevoir.games.
You may contact Clevoir at info@getclevoir.com to ask privacy questions, exercise privacy rights, request account deletion, request project deletion, opt out of optional AI training or product-improvement uses, make a parent or guardian inquiry, withdraw consent where applicable, or submit a privacy complaint.
2. Scope of This Privacy Policy
This Privacy Policy applies to Personal Information processed by Clevoir in connection with clevoir.games; Clevoir websites, web applications, dashboards, and platform interfaces; Clevoir accounts, authentication, and login systems; AI-powered game creation, generation, editing, and publishing features; prompts, uploaded assets, game projects, Generated Outputs, and project history; hosted games and game deployment features; AWS Amplify-based hosting and related AWS infrastructure; Stripe payment and subscription flows; Google OAuth and NextAuth-based authentication; Google Analytics and cookie-based measurement; AWS SES transactional emails; marketing emails and newsletters where you sign up to receive them; moderation, safety, abuse-prevention, and security reviews; account deletion, project deletion, and privacy requests; and parent and guardian inquiries involving minor users.
This Privacy Policy does not apply to third-party websites, platforms, AI models, payment services, analytics tools, scripts, APIs, game engines, asset providers, or integrations that Clevoir does not own or control, except where Clevoir uses those providers to deliver the Services and describes that processing in this Privacy Policy.
3. Definitions
Personal Information or Personal Data means information about an identified or identifiable individual, including information that can reasonably be linked to an individual, account, device, browser, household, online identifier, or other identifiable person.
Services means Clevoir's websites, platform, dashboards, accounts, AI tools, game creation features, hosted game pages, deployment features, moderation systems, payment flows, communications, and related services.
Account Holder means the individual who creates, owns, pays for, controls, or administers a Clevoir account. Where a parent or legal guardian creates, controls, authorizes, or permits use of an account by a minor, the parent or legal guardian is the Account Holder responsible for that account.
User means any person who accesses or uses the Services, including Account Holders, authorized users, parents, legal guardians, minors authorized by a parent or legal guardian, creators, collaborators, visitors, and individuals interacting with Clevoir-hosted games.
Minor means an individual who has not reached the age of majority or the age required to independently consent to the relevant processing under applicable law. Child means an individual under 13 years of age or another age threshold that triggers special child-privacy protections under applicable law.
Customer Content means prompts, instructions, uploaded files, images, audio, video, code, assets, sprites, textures, game projects, game logic, scripts, game descriptions, characters, stories, dialogue, mechanics, configuration files, published games, hosted game files, comments, chats, leaderboard content, ratings, likes, saved progress, metadata, Generated Outputs, and any other content submitted to, generated through, stored in, hosted by, or processed through the Services.
Generated Output means content generated, assisted, transformed, suggested, ranked, retrieved, modified, or produced through Clevoir's AI features, including game concepts, code, assets, images, text, levels, rules, characters, game logic, descriptions, recommendations, and related outputs.
Service Data means operational, technical, diagnostic, usage, analytics, security, billing, logging, and performance information generated through the use or operation of the Services. Hosted Game Data means data processed in connection with a game hosted, published, or deployed through Clevoir.
Sub-processor means a third-party service provider that processes Personal Information for Clevoir to help provide, host, secure, analyze, support, process payments for, or improve the Services. Processing means any operation performed on Personal Information.
4. Description of Clevoir's Services
Clevoir provides a platform that helps users create, generate, publish, deploy, host, and manage games and interactive experiences. Depending on the features available, the Services may allow Users to create game ideas, characters, worlds, mechanics, stories, dialogue, levels, scripts, and assets; use AI models to generate, revise, classify, moderate, rank, retrieve, or improve game-related content; upload, store, edit, manage, and publish game projects; generate code, configuration files, gameplay logic, and other project elements; publish games publicly or privately; host games on Clevoir's website; deploy games through AWS Amplify-based hosting and related AWS infrastructure; use wrapper-style hosting and deployment features; include creator-enabled game features; and use account, authentication, payment, analytics, moderation, and communication features.
Clevoir does not operate a standalone cross-game player-profile network and does not require players to create Clevoir player accounts merely to access Clevoir-hosted games. However, Clevoir may process technical data when someone visits or plays a hosted game, and may process Hosted Game Data when a creator enables game-specific features.
5. Relationship With Clevoir's Terms of Service
This Privacy Policy describes Clevoir's privacy practices. Clevoir's Terms of Service govern account eligibility, parent authorization, acceptable use, publishing rules, payment obligations, intellectual property, warranties, disclaimers, limitations of liability, dispute resolution, and other contractual matters.
Where a parent or legal guardian creates, controls, authorizes, or permits use of a Clevoir account by a minor, the parent or legal guardian is responsible for all activity conducted through that account, including prompts, projects, Generated Outputs, publications, hosted games, payments, communications, and compliance with Clevoir's Terms of Service.
For privacy-law purposes, rights held by individuals, minors, parents, guardians, or regulators under applicable law are not waived merely because an account is parent-controlled or because an Account Holder accepted Clevoir's Terms of Service.
6. Clevoir's Role Under Privacy Law
Clevoir may act as a controller, business, processor, service provider, contractor, or similar role depending on the context.
Clevoir generally acts as a controller when it determines the purposes and means of Processing, including account creation and administration, login and authentication, account security, payment, subscription, billing, invoice, and tax records, platform analytics, Google Analytics configuration and cookie management, AI routing, product improvement, optional training or evaluation uses, security, fraud prevention, abuse detection, moderation, hosted game operation, support and privacy communications, marketing communications where permitted, legal compliance, and operation of Clevoir's websites, platform, and infrastructure.
Clevoir may act as a processor, service provider, contractor, or similar role when it processes Customer Content or Personal Information on behalf of a school, enterprise, studio, organization, or other customer under a written agreement.
Schools, educational institutions, youth programs, camps, studios, enterprises, and organizations that want to use Clevoir for managed users, student programs, organization-controlled accounts, custom retention, data-processing terms, enterprise deployment, or child/minor programs must contact Clevoir at info@getclevoir.com before using the Services for that purpose.
7. Information Clevoir Collects
Clevoir may collect account and identity information, including name, email address, username, display name, password-related authentication credentials, account identifier, login method, Google OAuth account information, profile image, account settings, account preferences, account status, subscription status, communications preferences, parent or guardian contact information, authorization records, privacy-request history, deletion-request history, and support history.
Clevoir uses NextAuth-based authentication and may allow login through Google OAuth. When Google OAuth is used, Clevoir may receive information made available through that login flow, such as name, email address, profile image, Google account identifier, authentication tokens, and session metadata needed to authenticate the account.
Clevoir's Services are intended for users aged 13 and older, subject to applicable parent or legal guardian authorization requirements for minors. Where a parent or legal guardian creates, controls, authorizes, or permits use of an account by a minor, Clevoir may process parent or guardian information, authorization records, account activity, projects, prompts, Generated Outputs, hosted games, published content, analytics, technical information, and parent or guardian requests.
Clevoir does not permit independent account creation by children under 13. Parents and legal guardians must not allow children under 13 to independently use Clevoir's interactive account, AI prompt, publishing, chat, community, or game-creation features unless Clevoir has separately authorized a legally compliant child-use program in writing.
When you purchase a subscription, use a paid feature, or complete a payment, Clevoir may collect billing name, billing email, billing address, subscription plan, payment status, transaction history, invoice information, tax information, payment method metadata, usage or metering information, and payment fraud-prevention signals. Clevoir uses Stripe for payment processing and does not intentionally store full payment card numbers.
When you create, edit, save, publish, host, or deploy games through Clevoir, Clevoir may process prompts and instructions, project names, game titles, game descriptions, game ideas, genres, mechanics, themes, characters, stories, dialogue, scripts, worldbuilding, uploaded files, generated assets, code, configuration files, game logic, project metadata, build files, deployment files, hosting settings, version history, moderation history, comments, collaboration activity, public game pages, private previews, Generated Outputs, third-party API or script configurations, and any content entered into or generated through a game feature that a creator enables.
Users must not include real names, addresses, phone numbers, school names, precise locations, government identifiers, payment credentials, health information, private keys, passwords, confidential third-party information, or other identifying or sensitive information in prompts, game content, public descriptions, comments, uploads, or hosted games unless they have the legal right and required consent to do so.
Clevoir's AI features may process prompts, system instructions, project context, selected files and assets, uploaded assets, embeddings or vector representations, retrieval results, ranking data, model-routing metadata, Generated Outputs, model responses, user feedback, safety and moderation classifications, abuse-detection signals, latency data, error data, performance logs, model-provider request and response metadata, and usage metrics associated with AI features.
Clevoir hosts games on its site and may provide hosting or wrapper-style deployment options using AWS infrastructure, including AWS Amplify and related AWS services. When a game is hosted, published, or deployed through Clevoir, Clevoir may process hosted game files, build files, deployment logs, project configuration, URLs, routing metadata, domain or subdomain settings, access logs, security logs, performance logs, error logs, CloudWatch logs, S3 storage objects, Lambda execution data, SQS queue data, DynamoDB records, EC2-related operational data, and technical metadata needed to serve the hosted game.
When a person visits Clevoir's website or loads a Clevoir-hosted game, Clevoir may automatically process limited technical information, including IP address, approximate location inferred from IP address, browser type, browser version, device type, operating system, referring page, page URL, timestamps, session information, error logs, security logs, performance data, basic usage events, cookie identifiers, similar technology identifiers, and analytics information.
Clevoir uses Google Analytics and related analytics technologies to understand how users interact with Clevoir's websites, Services, and hosted pages. If you contact Clevoir or sign up for updates, Clevoir may collect communications, support, marketing, newsletter, consent, engagement, and unsubscribe information.
Clevoir is not designed to process highly sensitive Personal Information. Users must not submit social insurance numbers, social security numbers, passport numbers, driver's licence numbers, government identification numbers, full payment card numbers, bank account credentials, health information, biometric identifiers, genetic information, criminal history, precise geolocation, private keys, passwords, secrets, sensitive information about children, or information protected by sector-specific privacy laws unless expressly authorized in writing and all legal requirements are satisfied.
8. How Clevoir Uses Information
Clevoir uses Personal Information and related data to provide and operate the Services, create and manage accounts, authenticate users, maintain sessions, provide dashboards, save projects, process prompts, generate game content, provide AI features, host games, deploy projects, maintain project history, enable publishing, review and moderate content, process payments, send account and service notices, provide support, maintain records, and operate Clevoir's infrastructure.
Clevoir uses Customer Content, AI interaction data, and Service Data to generate, revise, transform, rank, retrieve, or suggest game content; process prompts and project context; produce Generated Outputs; route requests to appropriate AI providers; evaluate AI feature performance; detect unsafe or prohibited content; prevent abuse; debug failures; improve reliability, safety, and latency; support asset retrieval and semantic search; and maintain continuity in project workflows.
Unless you opt out as described in this Privacy Policy, and subject to applicable law, Clevoir may use Customer Content, prompts, Generated Outputs, Service Data, AI interaction data, usage data, technical logs, error data, moderation data, feedback, and related information to improve Clevoir's Services, including prompt workflows, model routing, game-generation workflows, retrieval, ranking, recommendation systems, output quality, debugging, safety systems, moderation systems, internal models, tools, evaluation systems, new features, aggregated or de-identified datasets, and Clevoir-operated systems.
Optional training and product-improvement use is enabled by default for eligible accounts and eligible content. Where applicable law requires separate consent for a particular training, analytics, or improvement purpose, Clevoir will seek consent before applying that purpose. You may opt out by emailing info@getclevoir.com.
Clevoir uses Hosted Game Data and Customer Content to serve hosted games, maintain hosting infrastructure, publish and unpublish games, process build and deployment events, detect malware, abuse, spam, prohibited content, or unlawful activity, review games before publication and after substantive edits, investigate reports, enforce policies, remove or restrict violating games, and protect users, minors, players, third parties, Clevoir, and the public.
Clevoir uses billing, transaction, and subscription information to process payments through Stripe, manage subscriptions, issue invoices and receipts, prevent payment fraud, calculate taxes, maintain accounting records, manage plan access, and enforce payment-related terms.
Clevoir uses information to secure accounts, detect unauthorized access, prevent account takeover, detect fraud, spam, scraping, malware, phishing, or abuse, enforce usage limits and rate limits, investigate policy violations, prevent misuse of AI features, maintain logs, respond to security incidents, protect minors and users, and protect Clevoir's infrastructure and legal rights.
Clevoir uses information to respond to inquiries, process privacy requests, process parent and guardian requests, send account notices, security alerts, payment and billing notices, legal and policy notices, service updates, marketing emails where permitted, and manage unsubscribe requests.
Clevoir also uses information to comply with law, respond to lawful requests, maintain tax and accounting records, enforce agreements, resolve disputes, protect rights, property, and safety, conduct audits and compliance reviews, support business transactions, and preserve records where legally required.
9. Legal Bases for Processing
Where applicable law requires a legal basis for Processing, Clevoir relies on one or more of the following legal bases: performance of a contract, consent, legitimate interests, legal obligations, and vital interests or safety.
Performance of a contract applies when Clevoir processes Personal Information to provide the Services, create and manage accounts, authenticate users, process subscriptions, host games, provide AI features, maintain projects, process payments, send service communications, and perform obligations under Clevoir's Terms of Service.
Consent applies for certain cookies, analytics where required, marketing communications, optional processing where required by law, parent-authorized minor use, and other Processing where consent is required. Consent may be withdrawn where applicable.
Legitimate interests include security, fraud prevention, abuse detection, moderation, service improvement, analytics, AI system improvement, support, business operations, and protection of Clevoir's rights, provided those interests are not overridden by applicable privacy rights.
Legal obligations include tax, accounting, corporate, privacy, consumer protection, child protection, sanctions, export-control, regulatory, court, law-enforcement, and other obligations. In limited circumstances, Clevoir may process Personal Information to protect life, health, or safety.
10. AI Providers and AI Data Handling
Clevoir currently uses DeepSeek directly to provide text-based AI features. Clevoir may add or replace AI model providers only when those providers are made available in the Services or reflected in updated provider disclosures.
Clevoir may send prompts, project context, uploaded assets, Customer Content, Generated Outputs, metadata, and related information to these providers to generate, transform, moderate, classify, evaluate, or return AI-assisted outputs.
Clevoir accesses these AI providers directly and does not currently use a general AI model aggregator as the primary method of routing AI requests. Clevoir may add, remove, replace, or change AI providers in the future. Where a material change to provider categories or processing practices materially affects privacy risks, Clevoir will provide advance notice where reasonably practicable and legally required.
Clevoir will use commercially reasonable efforts to select and configure AI providers in a manner designed to protect Customer Content and Personal Information. Clevoir will not knowingly authorize third-party AI providers to use Customer Content to train their general-purpose foundation models where Clevoir has contractual or technical controls available to prevent that use.
Third-party AI providers operate their own systems and may process data in jurisdictions outside Canada. Their processing may be subject to their own terms, privacy policies, data-processing terms, retention controls, and technical limitations.
AI-generated outputs may be inaccurate, incomplete, unsafe, offensive, biased, infringing, or unsuitable for a particular use. Users are responsible for reviewing, testing, and validating Generated Outputs before publishing, relying on, commercializing, or distributing them.
11. AI Training, Product Improvement, and Opt-Out
Clevoir's default position is that optional training and product-improvement use is enabled unless the Account Holder opts out, subject to applicable law.
Unless you opt out, and subject to applicable law, Clevoir may use prompts, project context, Generated Outputs, uploaded assets, game metadata, edit history, moderation data, feedback, usage data, Service Data, technical logs, model-response metadata, retrieval and ranking data, error data, de-identified data, aggregated data, and pseudonymized data to improve Clevoir's Services and AI-related systems.
This use may support internal evaluation, retrieval improvement, ranking improvement, prompt improvement, safety improvement, moderation improvement, debugging, product development, quality measurement, and training or fine-tuning Clevoir-operated systems.
Clevoir does not sell Customer Content, prompts, or Personal Information. Clevoir does not knowingly sell or share children's Personal Information for targeted advertising or cross-context behavioural advertising.
You may opt out of optional training and product-improvement use by emailing info@getclevoir.com. Your request should include the account email, whether the request applies to the entire account or a specific project, the project name or URL if project-specific, and whether you also want account deletion, project deletion, or only training and improvement opt-out. Clevoir may verify your identity before processing the request.
After Clevoir verifies and processes an opt-out request, Clevoir will stop using future Customer Content from the relevant account or project for optional training or model-improvement purposes. Clevoir may continue to process information as necessary to provide the Services, maintain security, prevent abuse, comply with law, resolve disputes, and maintain required records. Clevoir may retain de-identified, aggregated, or statistical information where it no longer identifies an individual.
Clevoir may not be able to remove data from models, evaluations, aggregate analytics, statistical analyses, or system improvements already completed before the opt-out where reversal is not technically or commercially feasible. Backups may retain information for a limited period before deletion in the ordinary course.
Project deletion and training opt-out are separate. To explicitly request that Clevoir stop using a specific project for optional training or product-improvement purposes, the Account Holder must email info@getclevoir.com and identify the relevant account and project.
Clevoir does not knowingly use Personal Information of children under 13 for optional AI training or targeted advertising. Parents and guardians should not permit minors to submit identifying information in prompts, projects, uploads, public game descriptions, chats, comments, or other content.
12. Children, Minors, Parents, and Guardians
Clevoir is designed to support parent-authorized use by minors aged 13 and older. Independent account creation by children under 13 is not permitted. Individuals aged 13 to 17 may use Clevoir only with parent or legal guardian authorization and supervision, and only where permitted by applicable law.
Parents and legal guardians may create, control, authorize, and permit use of accounts. Where a parent or legal guardian creates, controls, authorizes, or permits use of an account by a minor, the parent or legal guardian is responsible for that account's activity, including prompts, projects, publications, hosted games, payments, communications, and compliance with Clevoir's Terms of Service.
A parent or legal guardian who accepts Clevoir's Terms of Service and Privacy Policy authorizes Clevoir to process account activity, Customer Content, prompts, Generated Outputs, hosted games, analytics, technical data, and related information associated with that account as described in this Privacy Policy.
This authorization does not permit minors to submit sensitive information, identifying information, third-party Personal Information, unlawful content, or content that violates Clevoir's policies. Parents and legal guardians are responsible for supervising minors' use of Clevoir.
If Clevoir learns that it has collected Personal Information from a child under 13 without legally valid consent or authorization, Clevoir will take reasonable steps to delete or de-identify that information, restrict the account, or obtain appropriate consent where legally permitted. Parents or legal guardians who believe Clevoir has collected Personal Information from a child under 13 may contact info@getclevoir.com or call +1 437 235 5895.
Where Quebec privacy law applies, Personal Information concerning a minor under 14 may not be collected from the minor without consent from the person having parental authority or the tutor, unless the collection is clearly for the minor's benefit. Clevoir's parent-controlled and parent-authorized account structure is intended to ensure that a parent or legal guardian is responsible for authorizing use by minors.
Where EU, UK, or Swiss data protection law applies, minors below the applicable digital-consent age may use Clevoir only with authorization from the holder of parental responsibility where required.
Parents and legal guardians may contact Clevoir to review information associated with a minor's authorized use, request correction, request deletion, withdraw authorization where applicable, request account closure, request project deletion, request that Clevoir stop using a project or account for optional AI training or product-improvement purposes, or ask questions about a minor's use of the Services. Clevoir may verify the requester's identity and authority before responding.
Clevoir does not knowingly sell children's Personal Information, knowingly share children's Personal Information for targeted advertising or cross-context behavioural advertising, or currently use Google Ads, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Reddit Pixel, or other third-party advertising pixels.
Clevoir uses analytics, including Google Analytics, to operate, secure, measure, and improve the Services. Where Clevoir knows or reasonably determines that an account is used by a minor, Clevoir will use analytics for security, performance, reliability, aggregate measurement, debugging, and service improvement, and not for targeted advertising to children.
Minors must not include real names, addresses, school names, phone numbers, precise location, personal photos, private contact details, or other identifying information in prompts, projects, uploads, public game pages, chats, comments, game descriptions, or published content. Clevoir may remove, restrict, moderate, or disable content that appears to disclose Personal Information about minors or create safety risks.
13. Hosted Games, Player Features, and Creator Responsibilities
Clevoir hosts games and may allow creators to publish games publicly or privately. Clevoir does not operate a general cross-game player-profile network and does not require players to create Clevoir player accounts merely to play hosted games.
Games may include features that process information, including leaderboards, chat, comments, saved progress, ratings, likes, player login, gameplay analytics, usernames, display names, forms, external APIs, third-party scripts, links to third-party websites, game-specific identifiers, and gameplay events.
If a creator enables these features, the creator or Account Holder is responsible for providing appropriate notices, obtaining legally required consents, avoiding unlawful collection of Personal Information, and complying with child privacy, consumer privacy, advertising, electronic communications, and platform rules.
Creators must not use Clevoir-hosted games to unlawfully collect Personal Information from players or children. Clevoir may review games before publication and after substantive edits or changes. Clevoir may remove, restrict, suspend, or disable games, scripts, features, or accounts that violate Clevoir's policies, create legal risk, create child-safety risk, or threaten the security or integrity of the Services.
14. Third-Party Scripts, APIs, Links, and Integrations
Clevoir may allow creators to embed, call, link to, or integrate with third-party scripts, APIs, analytics, services, assets, game engines, websites, forms, tools, or platforms.
When a creator uses a third-party service, that third party may collect or process information under its own privacy policy and terms. Clevoir does not control third-party data practices.
Creators are responsible for ensuring that third-party scripts, APIs, and integrations used in their games comply with applicable law, do not unlawfully collect player data, do not target children unlawfully, do not include unauthorized tracking or advertising technologies, and do not compromise security.
Clevoir may block, remove, restrict, or review third-party scripts, integrations, or hosted games that Clevoir determines may be unsafe, unlawful, abusive, misleading, or inconsistent with Clevoir's policies.
15. Sub-processors, Service Providers, and Technology Providers
Clevoir uses third-party service providers and Sub-processors to provide, host, secure, analyze, support, process payments for, and improve the Services.
Clevoir's key providers include Amazon Web Services, including AWS Amplify, S3, Lambda, SQS, DynamoDB, EC2, CloudWatch, and AWS SES, for hosting, deployment, storage, compute, queues, databases, logging, monitoring, transactional email, infrastructure, diagnostics, and security operations.
Clevoir uses Stripe for payment processing, subscriptions, invoices, billing records, tax information, and payment fraud prevention; Google Analytics for website and product analytics, usage measurement, aggregate reporting, and performance insights; Google OAuth for authentication and account login; DeepSeek for text-based AI model processing and AI-generated functionality; and NextAuth as an authentication framework used to support account login and session management.
NextAuth is used as an authentication framework and is not necessarily a separate hosted Sub-processor unless an external provider is used to host or operate it.
Clevoir may add, replace, or remove service providers, AI providers, infrastructure providers, analytics providers, or Sub-processors from time to time. Clevoir will provide notice of material changes through this Privacy Policy, in-product notice, email, or another legally permitted method. Service providers are required to process information for the purposes of providing services to Clevoir, subject to appropriate confidentiality, security, and data-processing obligations.
16. When Clevoir Discloses Information
Clevoir may disclose Personal Information to service providers and Sub-processors that help operate, host, secure, analyze, support, process payments for, or improve the Services.
Clevoir may disclose prompts, project context, Customer Content, uploaded assets, Generated Outputs, and related metadata to AI providers to provide AI-powered features.
Clevoir discloses billing and transaction information to Stripe to process payments, subscriptions, invoices, taxes, and fraud-prevention checks.
If you use Google OAuth, Clevoir and Google exchange information necessary for authentication, identity confirmation, session management, and account access.
Where an account is controlled by a parent, legal guardian, organization, school, or administrator, Clevoir may disclose information associated with that account to the Account Holder or authorized administrator, including account activity, projects, prompts, Generated Outputs, hosted games, usage, billing, deletion requests, support requests, and policy-violation information.
If an Account Holder publishes a game or makes content public, that content may be visible to the public or to anyone with access to the relevant link. Public content may include game title, game description, creator display name, hosted game URL, game assets, generated content, player-facing content, and game-specific features if enabled.
Clevoir may disclose information where Clevoir believes in good faith that disclosure is necessary to comply with law, respond to lawful process, enforce policies, investigate fraud, abuse, harassment, threats, malware, spam, or security incidents, protect children, minors, users, players, third parties, Clevoir, or the public, protect rights, property, security, or safety, prevent harm, defend against legal claims, or comply with tax, accounting, corporate, sanctions, export-control, or regulatory obligations.
Clevoir may disclose or transfer information in connection with a merger, acquisition, financing, investment, corporate reorganization, bankruptcy, sale of assets, due diligence process, or similar business transaction. The recipient will be required to protect Personal Information in a manner consistent with this Privacy Policy or as otherwise required by law.
18. Marketing Communications
Clevoir may send marketing emails, newsletters, product announcements, updates, and promotional communications if you sign up, consent, or where otherwise permitted by law.
You may unsubscribe from marketing emails using the unsubscribe link in the email or by contacting info@getclevoir.com.
Even if you unsubscribe from marketing, Clevoir may still send transactional, administrative, security, legal, billing, service, account, parent-authorization, and policy-related communications.
19. Retention of Information
Clevoir retains Personal Information only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law, security needs, fraud prevention, legal claims, tax obligations, accounting obligations, audit requirements, backup processes, or contractual obligations.
Account information is retained while the account is active and for up to 30 days after verified account deletion, subject to backups, legal holds, fraud prevention, and required records.
Deleted account data is deleted, de-identified, or isolated from active systems within 30 days after verified deletion request, subject to exceptions in this Privacy Policy.
Customer Content and active projects are retained while needed to provide the Services or until deleted by the Account Holder. Self-deleted projects are removed or disabled from active user access promptly and deleted, de-identified, or isolated from active systems within 30 days, subject to backups and legal holds.
Hosted game files are retained while the game is hosted, published, or needed to provide deployment services, and deleted or isolated within 30 days after verified removal or account deletion, subject to backups and legal holds.
Prompt history and Generated Outputs are retained as part of account and project history unless deleted through project deletion, account deletion, or verified request.
Optional AI training and improvement source data is used by default unless opted out. After opt-out, future source data from the relevant account or project will not be used for optional training or model-improvement purposes.
Technical logs and CloudWatch/infrastructure logs are generally retained for up to 90 days unless needed for security, reliability, debugging, fraud prevention, abuse investigation, or legal compliance. Security logs are generally retained for up to 12 months unless needed longer for security, fraud prevention, abuse investigations, legal claims, or compliance.
Backups are retained for up to 90 days before deletion or overwrite in the ordinary course. Billing, invoice, tax, and transaction records are retained for 7 years or longer where required by law. Stripe payment records are retained by Stripe according to Stripe's own obligations.
Parent authorization and minor-use records are retained while the account is active and for up to 7 years after account closure where necessary to demonstrate authorization, resolve disputes, comply with law, or protect safety. Support emails and privacy requests are retained for up to 3 years after resolution unless needed longer. Marketing records are retained until unsubscribe or deletion request, except suppression records may be retained. Moderation and safety records are retained for up to 3 years, or longer where necessary. De-identified, aggregated, or anonymous data may be retained indefinitely.
20. Account Deletion, Project Deletion, and Data Deletion
Users may request account deletion and full data deletion by emailing info@getclevoir.com.
Project deletion may be available through self-serve product controls. However, deleting a project through product controls does not automatically guarantee that Clevoir has stopped using that project for optional AI training or improvement purposes. To explicitly request that Clevoir stop using a project for optional training or improvement purposes, the Account Holder must email info@getclevoir.com.
A deletion request should include account email, project name or URL where applicable, whether the request is for account deletion, project deletion, training opt-out, or all of these, and parent or guardian authority if the request concerns a minor's use.
Clevoir may verify identity before acting on a deletion request. Certain information may be retained where necessary for security, fraud prevention, legal compliance, tax, accounting, payment records, dispute resolution, legal holds, backups, or protection of rights and safety.
21. Data Export
Clevoir does not currently provide a general self-serve data export feature.
Users may contact info@getclevoir.com to request access to Personal Information or a copy of information where required by applicable law. Clevoir will respond in accordance with applicable legal requirements and may provide information in a reasonable format.
22. Security
Clevoir uses reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, loss, misuse, disclosure, alteration, and destruction.
Depending on the feature and infrastructure, safeguards may include encryption in transit, encryption at rest where supported by the relevant system, access controls, least-privilege access, authentication controls, administrative access restrictions, logging and monitoring, AWS infrastructure controls, CloudWatch monitoring, vulnerability management, backups and recovery procedures, secure development practices, moderation and abuse detection, rate limiting, confidentiality obligations, vendor review, and incident response procedures.
Clevoir does not currently claim SOC 2, ISO 27001, or similar certification unless Clevoir separately publishes such certification.
No system is completely secure. Clevoir cannot guarantee absolute security. Users are responsible for maintaining secure passwords, protecting account access, supervising minors, reviewing third-party scripts before publication, managing project permissions, and promptly notifying Clevoir of suspected unauthorized access.
23. Confidentiality Incidents and Breach Notification
If Clevoir becomes aware of a security incident or confidentiality incident involving Personal Information, Clevoir will take reasonable steps to investigate, contain, assess, remediate, and document the incident.
Where required by law or contract, Clevoir will notify affected individuals, Account Holders, parents, legal guardians, regulators, or other parties.
If you believe your account, project, hosted game, payment information, authentication credentials, deployment, or parent-authorized minor use has been compromised, contact info@getclevoir.com immediately.
24. International Processing and Transfers
Clevoir is based in Ontario, Canada, and provides Services globally. Personal Information may be processed in Canada, the United States, China, and other countries where Clevoir, AWS, Stripe, Google, DeepSeek, or other service providers operate.
These countries may have privacy laws different from the laws in your jurisdiction.
Where required, Clevoir uses appropriate safeguards for international transfers, which may include contractual safeguards, data-processing terms, standard contractual clauses, UK transfer addenda, vendor due diligence, security measures, transfer assessments, privacy impact assessments, and written agreements with service providers.
For Quebec users, Clevoir will take steps designed to satisfy applicable Quebec requirements before communicating Personal Information outside Quebec, including assessing relevant privacy factors and using appropriate written agreements where required.
25. Privacy Rights
Depending on your location and the context of Processing, you may have rights to access Personal Information, confirm whether Clevoir processes Personal Information, correct inaccurate Personal Information, delete Personal Information, withdraw consent where Processing is based on consent, object to certain Processing, restrict certain Processing, request portability where required by law, opt out of sale, sharing, or targeted advertising where applicable, limit certain uses of sensitive Personal Information where applicable, appeal a denied privacy request where applicable, and lodge a complaint with a privacy regulator or supervisory authority.
To exercise rights, email info@getclevoir.com. Clevoir may verify your identity before responding. If the request concerns a parent-controlled account, minor use, organization account, school account, or hosted game created by another Account Holder, Clevoir may request additional information to verify authority.
Clevoir will respond within the time required by applicable law, may extend the response period where permitted by law, and will notify you if an extension applies. Clevoir will not discriminate against you for exercising privacy rights.
26. Canadian Privacy Notice
Clevoir is an Ontario corporation and is accountable for Personal Information under its control.
Canadian users may contact Clevoir's Privacy Officer to request access to Personal Information, correction of Personal Information, deletion where applicable, withdrawal of consent where applicable, or information about Clevoir's privacy practices.
Privacy Officer: Asad Akbar. Email: info@getclevoir.com. Phone: +1 437 235 5895. Mailing Address: 7900 Hurontario Street, Unit #507, Brampton, Ontario L6Y 0P6, Canada.
Clevoir uses reasonable safeguards appropriate to the sensitivity of Personal Information and limits collection, use, disclosure, and retention to what is reasonably necessary for identified purposes, subject to this Privacy Policy.
27. Quebec Privacy Notice
Where Quebec privacy law applies, Clevoir will maintain a person responsible for the protection of Personal Information; publish contact information for that person; collect only Personal Information necessary for identified purposes; provide privacy information in clear language; obtain valid consent where required; address privacy rights such as access, rectification, withdrawal of consent, portability, and de-indexation where applicable; maintain confidentiality incident records where required; assess certain transfers of Personal Information outside Quebec where required; use written agreements with service providers where required; and address special consent requirements for minors under 14.
The person responsible for the protection of Personal Information is Asad Akbar, Privacy Officer, CLEVOIR INC. Email: info@getclevoir.com. Phone: +1 437 235 5895.
28. EEA, UK, and Swiss Privacy Notice
Where the GDPR, UK GDPR, or Swiss data protection law applies, Clevoir provides the following additional information. Controller: CLEVOIR INC. Address: 7900 Hurontario Street, Unit #507, Brampton, Ontario L6Y 0P6, Canada. Contact: info@getclevoir.com. Privacy Officer: Asad Akbar.
Clevoir processes Personal Information for the purposes and legal bases described in this Privacy Policy.
Clevoir does not engage in solely automated decision-making that produces legal or similarly significant effects on individuals. AI features may generate content, recommendations, moderation signals, safety signals, or outputs, but users are responsible for reviewing and validating Generated Outputs, and Clevoir may provide review processes where required by law.
EEA, UK, and Swiss users may have rights to access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority.
Clevoir may transfer Personal Information outside the EEA, UK, or Switzerland using legally recognized mechanisms, including standard contractual clauses, UK transfer addenda, adequacy decisions where applicable, transfer assessments, contractual safeguards, and technical and organizational measures. Clevoir's privacy contact for EEA, UK, and Swiss matters is info@getclevoir.com.
29. United States State Privacy Notice
This section supplements the rest of this Privacy Policy for residents of U.S. states with applicable consumer privacy laws.
Clevoir may collect identifiers such as name, email, username, account ID, IP address, and OAuth identifier for account creation, authentication, support, security, and payments.
Clevoir may collect commercial information such as subscription plan, invoices, payment status, and transaction history for billing, subscriptions, tax, and accounting.
Clevoir may collect internet or network activity such as logs, device data, browser data, pages visited, feature usage, and hosted game access for security, analytics, service operation, and product improvement.
Clevoir may collect approximate geolocation inferred from IP address for security, analytics, localization, and fraud prevention.
Clevoir may collect user-generated content such as prompts, projects, games, uploads, comments, chat content, and game assets for game creation, hosting, AI features, and moderation.
Clevoir may collect audio, visual, or similar content such as uploaded images, videos, audio, sprites, and assets for game creation, hosting, and AI features.
Clevoir may collect inferences such as feature preferences, usage patterns, and product-interest signals for personalization, analytics, and product improvement.
Clevoir may process sensitive Personal Information only if submitted or necessary for limited purposes such as security, compliance, or user-directed processing. Clevoir may process minor-related information such as parent authorization records, parent-controlled account activity, and minor-authorized use for parent-authorized use, safety, and compliance.
Clevoir does not sell Personal Information, does not currently share Personal Information for cross-context behavioural advertising, and does not knowingly sell or share Personal Information of children for targeted advertising. Clevoir will honor legally recognized opt-out preference signals, including Global Privacy Control, where required by applicable law.
Depending on your state, you may have rights to know, access, correct, delete, obtain a copy, opt out of sale, opt out of sharing, opt out of targeted advertising, limit certain sensitive-data uses, and appeal a denied request. To exercise rights, email info@getclevoir.com.
30. No Sale of Personal Information
Clevoir does not sell Personal Information.
Clevoir does not sell Customer Content.
Clevoir does not sell prompts.
Clevoir does not knowingly sell or share children's Personal Information for targeted advertising or cross-context behavioural advertising.
If Clevoir's practices materially change, Clevoir will update this Privacy Policy and provide legally required notice and choices.
31. De-identified, Aggregated, and Anonymous Data
Clevoir may create de-identified, aggregated, or anonymous data from Personal Information, Customer Content, Service Data, usage data, AI interaction data, Hosted Game Data, and analytics data.
Clevoir may use and disclose de-identified, aggregated, or anonymous data for lawful purposes, including analytics, benchmarking, product improvement, AI evaluation, safety improvement, abuse prevention, research, reporting, business operations, and performance measurement.
Clevoir will not attempt to re-identify de-identified data except as permitted by law, such as to test whether de-identification safeguards are effective.
32. Accuracy
Clevoir takes reasonable steps to keep Personal Information accurate, complete, and up to date where necessary for the purposes for which it is processed.
Users and Account Holders are responsible for keeping account information accurate and current. To request correction, email info@getclevoir.com.
33. Legal Holds
Clevoir may preserve information where necessary to comply with law, respond to legal process, enforce agreements, resolve disputes, investigate abuse, prevent fraud, protect children, minors, users, or players, preserve evidence, defend against claims, or comply with tax, accounting, audit, or regulatory obligations.
A legal hold may delay deletion until the legal hold is lifted.
34. Third-Party Websites and Services
The Services may contain links to third-party websites, services, APIs, models, scripts, payment processors, analytics providers, authentication providers, hosting providers, or other third-party tools.
Third-party services are governed by their own privacy policies and terms. Clevoir is not responsible for third-party privacy, security, availability, accuracy, content, or data practices, except where Clevoir is legally responsible for its own selection and use of service providers.
Users should review third-party policies before connecting, embedding, publishing, or using third-party services.
35. Schools, Enterprises, Studios, and Organizations
Clevoir may be used by individuals and parent-authorized accounts under Clevoir's standard Terms of Service.
Schools, educational institutions, camps, youth programs, enterprises, studios, and organizations that want to use Clevoir for managed users, student groups, organization-controlled accounts, enterprise deployment, custom retention, data-processing terms, or child/minor programs must contact info@getclevoir.com before using the Services for that purpose.
Clevoir may require a written agreement before enabling organization-managed, school-managed, enterprise, student, or youth-program use.
36. Languages
Clevoir may make this Privacy Policy available in multiple languages, including English and French.
If a translated version differs from the English version, the English version will control to the extent permitted by applicable law. Where mandatory language laws require a different result, Clevoir will comply with those mandatory requirements.
37. Changes to This Privacy Policy
Clevoir may update this Privacy Policy from time to time to reflect changes in the Services, technology, providers, legal requirements, business practices, or privacy practices.
When Clevoir updates this Privacy Policy, Clevoir will update the Last Updated date.
For material changes that materially reduce privacy rights or materially expand Clevoir's Processing purposes, Clevoir will provide advance notice where reasonably practicable and legally required, such as by email, in-product notice, website notice, or another legally permitted method.
Where applicable law requires consent for a new Processing purpose, Clevoir will seek consent before applying that purpose.
Some changes may take effect sooner where necessary for legal compliance, security, fraud prevention, provider changes, new features, service availability, or protection of users.
Your continued use of the Services after an updated Privacy Policy becomes effective means you acknowledge the updated Privacy Policy, except where applicable law requires additional consent.
38. Interpretation
This Privacy Policy is intended to be interpreted under the laws of Ontario and the federal laws of Canada applicable therein, subject to any mandatory privacy, consumer protection, child protection, or data protection rights that apply in your jurisdiction.
Dispute-resolution, venue, limitation-of-liability, payment, intellectual-property, and contractual terms are addressed in Clevoir's Terms of Service, not this Privacy Policy.
39. Contact Clevoir
For privacy questions, access requests, correction requests, deletion requests, training opt-out requests, parent or guardian inquiries, complaints, or other privacy matters, contact CLEVOIR INC., 7900 Hurontario Street, Unit #507, Brampton, Ontario L6Y 0P6, Canada.
Privacy Officer: Asad Akbar. Email: info@getclevoir.com. Phone: +1 437 235 5895. Website: clevoir.games.