Clawrk.

Privacy Policy

Effective September 13, 2026

Fancydino LLC operates Clawrk. This policy covers the website, application, support, and related communication. It applies to account holders, teammates, visitors, and people whose business contact or invoice information a business or practice supplies. Our Terms of Service describe the service agreement. Send privacy questions and requests to support@clawrk.com.

1. Our role and your business or practice's role

We determine how to process information needed for our own account administration, billing, website operations, security, and support. A business using its own workspace determines why it supplies company and customer records and who can access them. A bookkeeping practice does the same for records it manages on behalf of client businesses. We process those records to provide the requested service. If a business or practice supplied your information, contact it about corrections or its authority to use the information. We can help identify the request path without disclosing another party's records.

A business owner may invite a bookkeeper into the business workspace. That invitation grants the chosen workspace role; it does not move the business into the bookkeeper's practice. Practice roles cover all client companies in that practice.

2. Information and its sources

  • Accounts and teams: names, email addresses, password hashes, verification and recovery records, authenticator settings, roles, invitations, sessions, and acceptance of terms. These come from you, workspace administrators, and use of the service.
  • Business records: business, practice, and client details, customer contacts, invoice numbers and descriptions, dates, currencies, balances, payments, credits, payment links, promises, disputes, notes, and uploaded documents. These come from authorized users, CSV imports, and connected accounting providers.
  • Communication: drafts, approvals, recipients, subjects and bodies, incoming replies and routing information, delivery events, and opt-out or suppression records. These come from workspace users, recipients, and our email provider. Unexpected senders may be held for workspace review.
  • Billing: customer and subscription identifiers, plans, capacity, billing status, invoices, and payment or tax calculation results. Stripe collects payment details and billing information through its hosted forms. Clawrk does not store full card numbers or card security codes.
  • Technical and support records: request and security logs, IP addresses, browser or device information included in requests, provider request identifiers, operational usage counts, audit events, and information you send support.

Provide only relevant business records. Do not send passwords, full card details, government identity documents, or medical records in attachments or support messages. We do not need your QuickBooks password; access uses authorization you grant through Intuit.

3. How information is used

We authenticate users, manage workspace access, import and reconcile authorized records, prepare reminders, deliver approved messages, route replies, apply opt-outs, record promises, generate reports and exports, manage billing, and provide support. We also investigate failures, prevent abuse, secure the service, maintain audit history, and meet legal obligations.

Where a legal basis is required, these purposes rely on performing our agreement, legitimate interests in operating and securing the service, complying with law, or consent where needed. For customer-supplied records, the business or practice is responsible for lawful instructions and required notices. We do not sell personal information, share it for cross-context behavioral advertising, or use invoice data to target advertisements.

4. Service providers

  • Amazon Web Services: application hosting, databases, private document storage, backups, security controls, and operational logs in the United States.
  • Resend: account mail, approved reminders, incoming replies, delivery events, and suppression handling. It receives the message content and addresses needed for these functions.
  • Stripe: subscription checkout, payment methods, invoices, and the customer portal. Stripe also processes information for its own payment, fraud prevention, and legal responsibilities under its privacy policy.
  • Intuit: authorized QuickBooks connections, accounting records, and change notifications. Intuit handles its services under its own terms and privacy policy. Disconnecting Clawrk does not delete records held by Intuit.
  • Google Maps: when address suggestions are enabled, the address text you type is sent to Google to suggest matching addresses and fill the address you select. You can enter an address manually. Google's Privacy Policy applies to its service.
  • Google Workspace: our support and operational mailboxes, including the information you send to support.

If optional reply assistance is enabled, OpenAI receives the selected reply and relevant invoice context to suggest an interpretation. Suggestions require human review and do not authorize payments or outgoing messages. This feature is disabled unless configured and enabled; creating an account or connecting QuickBooks does not enable it.

We limit provider disclosures to their service functions. Providers may use their own service providers and process information in other countries. Contact support about processing arrangements or a data processing agreement. A provider connection does not authorize us to publish your accounting records.

5. Access and other disclosures

Authorized members access workspace information according to their roles. Approved reminders disclose their content to the chosen recipient and email systems involved in delivery. We may access records for authorized support, to resolve failures, or to investigate misuse. Business and practice workspaces are not publicly searchable.

We may disclose information when required by law, to protect people and the service from fraud or security threats, or to establish or defend legal rights. A business acquisition or reorganization may involve a transfer subject to appropriate protections and notice where required. We may use aggregate operational statistics that do not identify people or reveal a business or practice's accounting records.

6. Cookies and messages

Essential cookies and similar storage support sign-in, security, and interface preferences. Clawrk does not place advertising trackers in the application. Disabling essential cookies may prevent sign-in. Provider pages may use their own cookies under their policies. We do not sell or share information for advertising, including for users who express an opt-out through Global Privacy Control.

Our public website uses Google Analytics and analytics cookies to understand page visits, site searches, scrolling, link clicks, downloads, form and video interactions, referral sources, and browser or device information. We do not use this integration in the signed-in application, send invoice records or contact-form field values to Google Analytics, or enable advertising features. Page-view URLs exclude query strings and fragments. We keep analytics off when your browser sends Global Privacy Control or Do Not Track. Learn how Google uses information from sites that use its services.

Verification, recovery, invitation, billing, and security messages support your account. Customer reminders concern invoices managed by a business or bookkeeping practice. The reminder preference link stops further reminders from that workspace to your address. It does not erase the invoice, resolve a dispute, or prevent essential account and security messages.

7. Retention, exports, and deletion

Open workspaces retain business records, including any archived practice clients, for review and export. Ending a trial or canceling a subscription does not automatically delete a workspace. Disconnecting an integration stops future access but leaves imported records until they are otherwise deleted.

The owner can export data and close the workspace in Settings > Access & data. Closure immediately revokes workspace sessions, stops follow-up, cancels the subscription, and schedules deletion from active storage after 30 days. Export first. Memberships and records in other workspaces remain separate. Backup copies and older document versions normally expire within a further 35 days.

Production operational logs normally have a 30-day retention period. Security, unresolved delivery issues, support, billing, and legal records may be retained longer where needed for their purpose or required by law. Retained information is restricted to those purposes. Payment and accounting providers may independently retain their own records. Account verification links expire after 24 hours and password reset links after 30 minutes.

8. Security and international processing

Safeguards include encrypted transport and production storage, protected integration credentials, workspace access controls, audit history, and optional authenticator-based multi-factor authentication. No service can guarantee absolute security. Protect your account and report suspected unauthorized access. We will provide legally required security-incident notices.

Production infrastructure is in the United States. Information from other countries may be processed outside the country where it was collected, where protections can differ. When applicable law requires a specific transfer mechanism or processing agreement, those arrangements must be established; website use alone is not a substitute. Contact support about your requirements before providing affected records.

9. Choices and privacy requests

Manage profiles, sessions, authenticators, team access, integrations, and workspace exports in the application. Depending on applicable law, you may have rights to access or obtain a copy of information, correct it, request deletion, object to or restrict processing, withdraw consent, or complain to a regulator. California residents may have additional rights about sensitive information and authorized-agent requests where the law applies. We do not discriminate for exercising applicable privacy rights.

Send requests or an appeal of our response to support@clawrk.com with enough context to locate the information. We may verify identity, business or practice authority, or an agent's permission. We will explain applicable exceptions or reasons we cannot fulfill a request. Do not email passwords or full identity documents. Requests about customer-supplied records may require the supplying business or practice's instructions; we will assist as appropriate. Withdrawing consent does not undo earlier lawful processing.

10. Children and policy updates

Clawrk is a business service for adults. We do not knowingly collect account information from children under 18. Contact support if you believe a child supplied personal information.

We update this policy when practices change and identify its effective date above. We will provide notice of material changes and obtain consent where required. Contact Fancydino LLC at support@clawrk.com for privacy questions, requests, or information about processing arrangements.