Privacy Policy

Clearmarks is operated by Sheva L. Y. Group LTD (registered number 515900322), Maoritsio Vitale 9, Tel Aviv 6965104, Israel. This policy explains what data we handle on behalf of the businesses that use our service, and what we do not do with it.

1. Who this covers

Two different groups, and the distinction matters:

• Our customers — businesses that use Clearmarks. We are the data controller for their account information.
• Our customers' data — the advertising, payment and accounting records they connect. For this, we act as a data processor: our customer decides what is connected and why, and we process it only on their instructions.

2. What we collect

Account information

• Name, work email address, and the company they belong to.
• Sign-in records: the time, IP address and browser of each sign-in request, kept so an unexpected sign-in is answerable after the fact.

We do not store passwords. Sign-in uses a single-use link sent by email, and only a cryptographic hash of that link is ever stored.

Business data our customers connect

We request read-only permissions wherever a provider offers them. Clearmarks never initiates a payment, never stores card details, and never moves money.

What we do not collect

• Payment card numbers or bank credentials.
• The personal details of our customers' own end customers, beyond aggregate figures.
• Any data from a source the customer has not explicitly connected.

3. Why we process it

For one purpose: to produce reporting and recommendations for the business that connected the data. Specifically, to combine advertising cost with actual revenue and product cost, so the business can see contribution margin per campaign rather than platform-reported return alone.

Our lawful basis is performance of our contract with the customer, and our legitimate interest in operating and securing the service.

4. What we never do

• We do not sell data. Not to advertisers, data brokers, or anyone else.
• We do not share one customer's data with another, or combine data across customers for any purpose, including benchmarking.
• We do not use customer data to train AI models. Where an AI model analyses a customer's figures, it does so within that customer's session; the data is not retained by us or by our model providers for training.
• We act only on what a person has approved, inside limits they set. Any change to advertising spend, published content or records is prepared by the system and carried out only on the approval of an authorised person at the customer: either that person approving the specific change, or a standing approval they have chosen to grant for one specific action, inside a spending limit and a daily count they set. An approval can be withdrawn at any time.

5. How it is stored and protected

• Separated per customer. Each customer's business data is held in its own database, not in a shared table filtered by an account column.
• Credentials are encrypted individually. Every connected account's access token is encrypted with a key unique to that customer, which is itself protected by a platform master key. A token cannot be decrypted in the context of a different customer or a different integration.
• Encrypted in transit (TLS) and at rest.
• Access is by membership. A person can read a company's data only if they hold an explicit membership record for it, checked on every request.
• Actions are logged. Every change is recorded with who made it and when.

6. Who else is involved

We use a small number of processors, each for a specific function:

We do not add a processor that receives customer business data without updating this page.

7. How long we keep it

• While the account is active, for as long as needed to produce reporting.
• On disconnection of a source, that source's credentials are destroyed immediately and no further data is read from it.
• On account closure, business data is deleted within 30 days, and the customer's encryption key is destroyed — which renders any remaining encrypted copy unreadable.
• Audit records are retained longer where required for legal or accounting obligations.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete, or export your data, to object to or restrict processing, and to withdraw consent. To exercise any of these, write to hello@clearmarks.co.

If you are an end customer of a business that uses Clearmarks, that business is the controller of your data — contact them first, and we will support them in responding.

You also have the right to complain to your local data protection authority.

9. International transfers

We are established in Israel, and data is processed there and in other countries where our providers operate, including the United States.

Israel is recognised by the European Commission as providing an adequate level of data protection, so personal data may be transferred from the European Economic Area to us on that basis. Where data moves onward to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Children

Clearmarks is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.

11. Changes

If we change this policy materially, we will notify affected customers by email before the change takes effect. The date at the top always reflects the current version.

12. Contact

Sheva L. Y. Group LTD
Maoritsio Vitale 9, Tel Aviv 6965104, Israel
hello@clearmarks.co