Cleo Privacy Policy

Effective date: October 26, 2026

Plain-language summary

• Cleo answers calls, texts, emails and WhatsApp, Messenger and Instagram messages for small businesses. To do that, it processes what those businesses' customers say and write.
• If you are a business that uses Cleo, we are responsible for your account data (your name, email, billing) and we process your customers' data on your behalf.
• If you are a customer of a business that uses Cleo (for example, you called a clinic that uses Cleo), that business decides what happens with your information. You can ask the business or us to delete it.
• We don't sell data. We don't use it for advertising. Our AI providers cannot train their models with it.
• We use established telephony, artificial intelligence, voice, payment and hosting providers, under contracts that protect the data. We explain what each type of provider does below.
• You can see, export, correct and delete your data. If you delete your account, everything is permanently deleted after 30 days, except billing, tax or legal records.

1. Who we are

1.1. This Privacy Policy explains how Ova Performance LLC, a Wyoming limited liability company, with its address at 30 N Gould St, Sheridan, WY 82801, United States, doing business as "Cleo" ("Cleo", "we", "us"), collects, uses, shares and protects personal information.

1.2. It applies to the cleodesk.com website, the web app, the Cleo iPhone app (on the App Store), the Cleo Mac app (downloaded from cleodesk.com), the public pages we host for each business, and the calls, messages and emails Cleo handles (together, the "Service").

1.3. Privacy contact: hello@cleodesk.com. Mailing address: Ova Performance LLC, 30 N Gould St, Sheridan, WY 82801, United States.

1.4. Cleo has no offices or legal representative in the European Union or the United Kingdom. The Service is designed for businesses in the United States and Latin America. If you are in the European Union or the United Kingdom, you can write to us directly at hello@cleodesk.com.

2. Two different roles: controller and processor

This matters for understanding your rights.

2.1. When Cleo is the controller. We decide why and how to use the data of:

• owners and members of business accounts (name, email, phone, sign-in, billing);
• people who visit our website or write to us; and
• Service usage and security data.

2.2. When Cleo is the processor (or "service provider"). When Cleo serves a business's customers (answers their call, replies to their message, books their appointment), it does so on behalf of that business. The business is the controller of that data. We process it only to provide the Service to the business, on its instructions and under our Data Processing Agreement.

2.3. If you are a customer of a business that uses Cleo, that business's privacy policy also applies to you. To exercise your rights, the usual step is to contact the business. You can also write to us and we will help or pass your request to the business (see section 11).

3. What information we collect

3.1. Business account information

• Name, email, phone and profile photo (if you sign in with Google or Apple, what that account shares).
• Password (stored only as a one-way hash that cannot be reversed) and two-step verification data.
• Business name, type, description, services, hours, prices, addresses and other information you configure so Cleo can answer.
• Information to register your numbers with carriers: the business's legal name, company type, tax ID (for example, EIN), address, website, contact person and how your customers agree to receive texts.
• Information to port a number: current provider, account number with that provider, account holder and the letter of authorization you sign.

3.2. Payment information

• Stripe processes payments. We receive and store only limited data: card brand, last 4 digits, expiration date, country, and the history of charges, invoices and refunds. We never see or store your full card number or its security code.

3.3. Information from conversations Cleo handles

Depending on what the business turns on, Cleo processes:

• Calls: the caller's number, date, duration, the call audio while it happens (to understand it and answer by voice), the transcript and a summary. Our voice provider keeps the audio and transcript of the calls Cleo answers, for the period in section 10. If the call is transferred to a person at the business, that part is recorded in two channels to transcribe it; the recording is deleted from the telephony provider as soon as it is transcribed and only the text is kept.
• Text messages (SMS): the number, content, date and delivery status, and STOP and HELP replies.
• Emails: sender, recipients, subject, date, text, HTML content, attachments and the identifiers of the email and its thread.
• WhatsApp, Messenger and Instagram: messages customers send the business (text, photos, voice notes, videos, files, story replies and reactions), the WhatsApp number or the identifier Meta assigns to that person, and delivery and read receipts.
• Facebook lead forms: the answers people submit in the business's own ad forms, if the business connects them.
• Outcome: name, contact details, appointment, request, address and notes that come out of the conversation.

3.4. Connected account information

When a business connects Google, Microsoft or Meta, we receive the permissions (tokens) to use that account and the information described in sections 7 and 8. If the business connects its Gmail with an app password, we store that password encrypted.

3.5. Documents and files

Documents, catalogs, price lists or other files the business uploads so Cleo can learn, or to generate quotes and documents.

3.6. Technical and usage information

• IP address, approximate location derived from the IP (country or city), browser and device type, operating system, sign-in dates and times, and security logs.
• Push notification identifiers for your devices.
• Service usage: AI credits, minutes, messages, errors and performance.
• Error reports, which may include technical data about the page or app at the time of the error.

3.7. Cookies

We use cookies and similar technologies to sign you in, keep your session secure and remember your language. We also use Google Analytics to measure how many people visit cleodesk.com and the web app, and which pages they view. Google Analytics uses its own cookies and receives data such as your IP address, your browser and the pages you visit. We don't use it for advertising. You can block it in your browser settings or with Google's add-on at https://tools.google.com/dlpage/gaoptout. We don't use advertising cookies.

3.8. Sensitive information

We don't ask for sensitive information (health, racial origin, religion, biometric data, Social Security numbers, etc.). But people may mention it on their own during a call or message, especially at businesses such as clinics. In that case we process it only to handle that conversation on behalf of the business. We do not use callers' voices to identify them (no voiceprints).

4. Why we use information and our legal basis

What we don't do: we don't sell personal data, we don't "share" it for cross-context behavioral advertising, we don't build advertising profiles and we don't use data to decide anyone's credit, employment or eligibility.

5. Artificial intelligence and your data

5.1. How it works. To understand what a person says and reply, Cleo sends the conversation text (and, on calls, the audio) together with the business's information to AI and voice providers. They return the reply.

5.2. Providers don't train on your data. We use our AI and voice providers under business terms and with account settings that do not allow them to use the data to train their models.

5.3. How long providers keep data. Providers keep a copy for a limited time, to run their service and detect abuse:

• Artificial intelligence providers: keep logs of each request for up to 30 days to detect abuse, then delete them. If they detect possible abuse of their rules, they may keep that conversation for up to 2 years, or longer if the law requires.
• Voice provider: keeps the audio and transcript of the calls Cleo answers for up to 2 years.

None of them may use that data for anything other than providing their service to us.

5.4. Cleo's own models. Cleo may train its own AI models, which serve every business. It uses a business's data only if an owner turns on "Help improve Cleo's models" in Cleo Control. This option is off by default and the owner can turn it off at any time. While it is on:

• before a conversation is used, we remove personal data such as contact names, emails, phone numbers and card numbers;
• that data is stored encrypted and kept separate per business;
• only a limited number of Cleo staff can access it, and every access is logged;
• it is never shown to another business or anyone outside Cleo, and it is never sold;
• we record the date and the version of the text the owner agreed to; and
• if it is turned off, that business's data is left out of every training run after that.

Gmail and Google Calendar data are never used.

5.5. Learning for your business. A separate switch, also off at the start, lets Cleo learn from your team's corrections to answer better only for your business. That data is not shared with other businesses and is kept for the time the business chooses (between 7 and 365 days; 90 by default).

5.6. Email sorting. An AI model decides whether each incoming email is from a customer or is advertising or an automated notice, to sort it into "Inbox" or "Other emails". Moving an email by hand only saves a rule for that sender; it does not train any model.

5.7. Automated decisions. Cleo does not make automated decisions that have legal or similarly significant effects on people.

6. Who we share information with

6.1. Subprocessors (providers that process data for us). They receive only what they need for their part of the Service, under contracts with data protections. These are the types of providers we use. Businesses that use Cleo can ask for the list with each provider's name at hello@cleodesk.com; it is part of our Data Processing Agreement.

6.2. Services the business chooses to connect. When a business connects Google (Calendar, Gmail, sign-in), Microsoft (Outlook) or Meta (WhatsApp, Messenger, Instagram, lead ads), data flows between Cleo and that service because the business asked for it. Those services have their own privacy policies.

6.3. Carriers and Meta. To register numbers and accounts, we send the business's information to phone carriers (through our telephony provider and the official messaging campaign registry) and to Meta.

6.4. Within the business. People the business invites to its account see that business's conversations. Each business's data is kept separate from every other business.

6.5. For legal reasons. We may disclose information if the law requires it, under a valid court order, to protect the rights, safety or property of Cleo, our customers or others, or to investigate fraud or abuse. Where the law allows, we will notify the affected business before responding to an authority's request about its data.

6.6. Change of ownership. If Cleo merges, is sold or reorganizes, information may pass to the new owner, who must honor this policy or tell you about changes.

6.7. Cleo staff. No one at Cleo reads a business's conversations unless the business asks us for help with a specific problem, we need to investigate abuse or security, or the law requires it. Staff access is limited and logged. Our internal operations panel can only be opened by authorized staff, from authorized devices, after an access check with a code sent by email and a passkey or a code from an authenticator app.

If we add or change a provider that processes data about businesses' customers, we update this list and give businesses 30 days' notice, as our Data Processing Agreement says.

7. Google user data

7.1. Cleo uses Google data only for the features the business turns on: Sign in with Google, Google Calendar and Gmail. Each one is optional and connected separately. Google has reviewed and verified Cleo's access to Gmail (send only) and Google Calendar.

7.2. Permissions we request:

• openid, email and profile: name, email and photo, only to create your account and sign in.
• https://www.googleapis.com/auth/calendar.freebusy: free and busy times, so Cleo only offers appointments when you are free.
• https://www.googleapis.com/auth/calendar.events: your calendar events, to show your upcoming events and create the event for each appointment. Cleo does not delete calendars or change how they are shared.
• https://www.googleapis.com/auth/gmail.send: send replies to your customers from your Gmail, in the same thread.

Cleo requests no other Google API permissions and no restricted Gmail permissions.

7.3. Reading Gmail with an app password. To read the emails your customers send you, you create a Google app password and paste it into Cleo. Cleo uses it only to read new emails in your inbox over Google's secure IMAP connection, mark as read the ones it has handled, and read your sent replies in those threads to keep conversations together. It never deletes, moves or changes your emails, never changes your settings and never sees your regular Google password. You can revoke it at https://myaccount.google.com/apppasswords.

7.4. Limited Use. Cleo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We apply the same rules to emails Cleo reads with the app password.

7.5. No AI training. We never use Gmail or Google Calendar data to train, improve or fine-tune AI models, Cleo's or anyone else's. To sort an email or write its reply, the sender, subject and text are sent to our AI providers only for that task.

7.6. No sale or advertising. We don't sell Google data, don't use it for advertising, don't build profiles with it and don't use it to decide anyone's credit or eligibility.

7.7. Who receives Google data. To sort an email or write its reply, the sender, subject and text are sent to our artificial intelligence providers, which only return the result and cannot train on it. The data is stored with our database provider and our hosting provider, both under data protection agreements. No one else receives Google data. No one at Cleo reads it unless you ask us for help with a specific problem, we need to investigate abuse or security, or the law requires it.

7.8. How it is stored and protected. Google access tokens and the app password are stored encrypted and used only by Cleo's servers. All data travels over encrypted connections (HTTPS and TLS, including IMAP). The emails and events Cleo processes are stored with the rest of the business's data, kept separate from every other business, and seen only by the people in that business's account. Staff access is limited and logged.

7.9. Retention, deletion and removing access. The emails and appointments Cleo processes are kept while the account is active, so you can see your conversations. Disconnect Gmail or Calendar in Connectors at any time: Cleo stops using the access and deletes its tokens and the app password. You can also remove access at https://myaccount.google.com/permissions and revoke the app password at https://myaccount.google.com/apppasswords. To delete Google data already stored, delete your account in settings or email hello@cleodesk.com: we delete it within 30 days. If you delete your account, everything is permanently deleted after 30 days.

8. Meta data (WhatsApp, Messenger and Instagram)

8.1. What we receive. When a business connects its WhatsApp Business number, Facebook Page or Instagram professional account, Cleo receives, through Meta's APIs or through the integration provider in section 8.5, only what reaches that business: its customers' messages, the WhatsApp number or Meta identifier of the sender, delivery and read receipts, the name and identifier of the connected Page, account or number and, if the business connects them, the answers to its lead ad forms. Cleo does not read the business's posts, followers or ads, or any personal Facebook or Instagram profile.

8.2. Permissions we request: pages_show_list, pages_read_engagement, pages_manage_metadata, pages_messaging, instagram_basic, instagram_manage_messages, whatsapp_business_management, whatsapp_business_messaging, business_management, leads_retrieval and pages_manage_ads, each only for the feature explained in our current privacy page. Cleo requests no other Meta permissions.

8.3. Use. Only to show messages in the business's Cleo inbox, write and send the replies of its receptionist or team, and save leads and appointments. Meta data is never sold, never used for advertising or profiling, and shared only with the section 6 providers that run the Service.

8.4. How to ask for Meta data to be deleted. There are three ways:

1. From Facebook: open Settings & privacy > Settings > Business integrations, find Cleo and choose Remove. Meta notifies Cleo right away; Cleo disconnects every WhatsApp, Messenger and Instagram connection you granted and deletes its tokens. Meta shows you a confirmation code, and you can see the status of your request at https://cleodesk.com/en/data-deletion.
2. From Cleo: in Connectors, choose Disconnect on WhatsApp, Messenger or Instagram. Cleo stops using the access and deletes its tokens immediately.
3. By email: write to hello@cleodesk.com with what you want deleted (for example your number or Instagram username). We delete it within 30 days and confirm by email.

Full instructions: https://cleodesk.com/en/data-deletion

When you remove Cleo from Facebook or disconnect a channel, Cleo stops receiving messages and deletes the access permissions. Messages already stored in the business's inbox are deleted when the business deletes them or its account, or when you ask by email as described in option 3.

8.5. Integration provider while Meta reviews our app. While Meta reviews Cleo's own app, some Messenger, Instagram and WhatsApp connections work through an integration provider that already has an app approved by Meta. In that case, the business authorizes that app on Meta's screen, and messages pass through that provider before reaching Cleo. The provider only uses the messages to deliver and send them. It keeps its own copy, which Cleo deletes after 7 days without activity in the conversation; the main copy stays in Cleo. Once Meta approves our app, new connections will go directly to Meta.

9. Text messages: special commitments

9.1. Phone number data and consent to receive text messages are not sold or shared with third parties or affiliates for marketing or promotional purposes. They are shared only with the providers that deliver the messages (our telephony provider and the carriers).

9.2. Anyone who replies STOP stops receiving texts. Anyone who replies HELP receives help information. Message and data rates may apply.

10. How long we keep information

11. Your rights and how to use them

11.1. Rights. Depending on where you live, you may have the right to:

• know what data we hold about you and get a copy (access);
• correct inaccurate data (rectification);
• delete your data (erasure);
• receive your data in a format usable by another service (portability);
• object to or restrict certain uses;
• withdraw consent where it is the basis for the use;
• not be discriminated against for exercising your rights; and
• complain to a data protection authority.

11.2. If you have a business account. From settings you can export your data, correct your information, turn off model training, disconnect accounts and delete the account. For anything else, email hello@cleodesk.com.

11.3. If you are a customer of a business that uses Cleo. Contact the business first. You can also email hello@cleodesk.com with your number, email or username and the business's name. Because the business is the controller of that data, we may pass your request to it or handle it on its instructions, and we will let you know.

11.4. Verification. To protect your data, we may ask you to confirm your identity (for example, by replying from the email or number related to the data) before handling the request.

11.5. Timing. We respond within 30 days (GDPR) or 45 days (California), and may extend that where the law allows, with notice to you.

11.6. Authorized agents. You may have someone else make the request for you, with signed permission.

12. California residents' rights (CCPA/CPRA)

12.1. Categories collected in the last 12 months: identifiers (name, email, phone, IP); account and billing information; commercial information (plans, purchases); internet activity information (Service usage); audio and electronic information (calls and their transcripts); professional information (business data); and inferences drawn from that information to provide the Service. Sources, purposes and recipients are described in sections 3, 4 and 6.

12.2. Sensitive personal information. We collect account login credentials and, in calls or messages, there may be sensitive content people choose to say. We use it only for purposes the law allows (providing the Service and keeping it secure), not to infer characteristics about people.

12.3. No sale or sharing. We do not sell personal information or "share" it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not sell information of people under 16.

12.4. Service provider. For data about businesses' customers, Cleo acts as the business's "service provider" under California law.

12.5. How to use your rights: email hello@cleodesk.com or write to Ova Performance LLC, 30 N Gould St, Sheridan, WY 82801. If you have an account, you can also export or delete your data from settings.

12.6. California law applies to companies above certain sizes. Even if we may not be required to yet, we honor these rights for everyone.

13. People in the European Union, United Kingdom and Switzerland (GDPR)

13.1. The legal bases are in section 4. You have the rights in section 11 and may complain to the data protection authority in your country.

13.2. International transfers. Cleo and most of its providers are in the United States. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use valid mechanisms, such as the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses.

13.3. AI notice. Under the European Union AI Act, people must be told when they are interacting with an AI system. Cleo allows, and recommends, that the greeting says so from the start.

14. People in Honduras and Latin America

14.1. We respect the rights the laws of your country give you over your personal data, including the right to access, correct and request deletion of your data, and the constitutional right of habeas data where it exists.

14.2. Several countries in the region have their own data protection laws, such as Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, Colombia's Law 1581 of 2012 or Brazil's General Data Protection Law (LGPD). If the law of your country gives you more rights than this policy, we honor those rights. To use them, write to hello@cleodesk.com.

14.3. By using the Service, you understand that your data is processed in the United States and in the countries where our providers operate.

15. How we protect information

• Everything travels encrypted (HTTPS and TLS, including the IMAP connection).
• Connected account credentials, app passwords and two-step verification secrets are stored encrypted.
• Passwords are stored only as one-way hashes.
• Each business's data is isolated from other businesses.
• Staff access is limited, need-based and logged.
• We use rate limits and abuse protections.
• Transfer recordings are deleted as soon as they are transcribed.
• Before training our own models, we remove personal data.

No system is 100% secure. If an incident affects your personal data, we will investigate and notify affected businesses, individuals and authorities where the law requires it (for example, the GDPR requires notifying the authority within 72 hours).

16. Children

The Service is for businesses and is not directed to children under 13 (or 16 in some countries). We do not knowingly collect children's data for our own purposes. If a minor calls or messages a business that uses Cleo, their data is processed on behalf of that business. If you believe we hold a child's data we shouldn't, contact us and we will delete it.

17. Emails from Cleo

We send you service emails (billing, security, important notices) while you have an account; these can't be turned off because they are necessary. You can unsubscribe from promotional emails at any time with the link in each email.

18. "Do Not Track" signals and Global Privacy Control

We don't use advertising cookies or track people across sites. We honor the Global Privacy Control signal as a request not to sell or share, although we don't do either.

19. Changes to this policy

If we change how we collect or use data, we update this page and the date above, and email account owners before a material change takes effect. We will never use Google user data in a new way without asking for your consent first.

20. Contact

• Privacy and requests: hello@cleodesk.com
• Data deletion: https://cleodesk.com/en/data-deletion
• Mailing address: Ova Performance LLC, 30 N Gould St, Sheridan, WY 82801, United States