Privacy Policy

Last updated: 27 August 2026

Clearmarks is operated by Sheva L. Y. Group LTD (registered number 515900322), Maoritsio Vitale 9, Tel Aviv 6965104, Israel. This policy explains what data we handle on behalf of the businesses that use our service, and what we do not do with it.

In short. We read a business's advertising, payment and accounting data so that business can see whether its marketing is profitable. We read it; we do not sell it, share it, or use it to train AI models. Each customer's data is stored separately and encrypted, and we delete it when they leave.

1. Who this covers

Two different groups, and the distinction matters:

Our customers — businesses that use Clearmarks. We are the data controller for their account information.
Our customers' data — the advertising, payment and accounting records they connect. For this, we act as a data processor: our customer decides what is connected and why, and we process it only on their instructions.

2. What we collect

Account information

Name, work email address, and the company they belong to.
Sign-in records: the time, IP address and browser of each sign-in request, kept so an unexpected sign-in is answerable after the fact.

We do not store passwords. Sign-in uses a single-use link sent by email, and only a cryptographic hash of that link is ever stored.

Business data our customers connect

Source	What we read	Access
Advertising platforms (Meta, Google Ads)	Campaign names, spend, impressions, clicks, conversions	Read-only
Payments (Stripe)	Charges, refunds, balance transactions	Read-only
Accounting (QuickBooks, Xero)	Revenue, cost of goods, expense categories	Read-only

We request read-only permissions wherever a provider offers them. Clearmarks never initiates a payment, never stores card details, and never moves money.

What we do not collect

Payment card numbers or bank credentials.
The personal details of our customers' own end customers, beyond aggregate figures.
Any data from a source the customer has not explicitly connected.

3. Why we process it

For one purpose: to produce reporting and recommendations for the business that connected the data. Specifically, to combine advertising cost with actual revenue and product cost, so the business can see contribution margin per campaign rather than platform-reported return alone.

Our lawful basis is performance of our contract with the customer, and our legitimate interest in operating and securing the service.

4. What we never do

We do not sell data. Not to advertisers, data brokers, or anyone else.
We do not share one customer's data with another, or combine data across customers for any purpose, including benchmarking.
We do not use customer data to train AI models. Where an AI model analyses a customer's figures, it does so within that customer's session; the data is not retained by us or by our model providers for training.
We do not take actions without a person approving them. Any change to advertising spend, published content or records is prepared by the system and executed only after an authorised person at the customer explicitly approves it.

5. How it is stored and protected

Separated per customer. Each customer's business data is held in its own database, not in a shared table filtered by an account column.
Credentials are encrypted individually. Every connected account's access token is encrypted with a key unique to that customer, which is itself protected by a platform master key. A token cannot be decrypted in the context of a different customer or a different integration.
Encrypted in transit (TLS) and at rest.
Access is by membership. A person can read a company's data only if they hold an explicit membership record for it, checked on every request.
Actions are logged. Every change is recorded with who made it and when.

6. Who else is involved

We use a small number of processors, each for a specific function:

Provider	Purpose
Anthropic	AI analysis of the customer's figures. Data is not used for model training.
Cloud hosting and database provider	Running the service and storing data
Email delivery provider	Sign-in links and daily reports

We do not add a processor that receives customer business data without updating this page.

7. How long we keep it

While the account is active, for as long as needed to produce reporting.
On disconnection of a source, that source's credentials are destroyed immediately and no further data is read from it.
On account closure, business data is deleted within 30 days, and the customer's encryption key is destroyed — which renders any remaining encrypted copy unreadable.
Audit records are retained longer where required for legal or accounting obligations.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete, or export your data, to object to or restrict processing, and to withdraw consent. To exercise any of these, write to hello@clearmarks.co.

If you are an end customer of a business that uses Clearmarks, that business is the controller of your data — contact them first, and we will support them in responding.

You also have the right to complain to your local data protection authority.

9. International transfers

We are established in Israel, and data is processed there and in other countries where our providers operate, including the United States.

Israel is recognised by the European Commission as providing an adequate level of data protection, so personal data may be transferred from the European Economic Area to us on that basis. Where data moves onward to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Children

Clearmarks is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.

11. Changes

If we change this policy materially, we will notify affected customers by email before the change takes effect. The date at the top always reflects the current version.

12. Contact

Sheva L. Y. Group LTD
Maoritsio Vitale 9, Tel Aviv 6965104, Israel
hello@clearmarks.co