Privacy Policy

Effective Date: July 1, 2025 · Operator: Carter King

Clavis (“we,” “us,” or “our”) is a credit card wallet optimizer that helps users track card rewards, monitor perks and credits, and identify which card to use at a given merchant. This Privacy Policy describes what personal information we collect, how we use and protect it, and the rights you have with respect to your data.

By creating an account or using the Service, you acknowledge that you have read and agree to this Privacy Policy.

1. Information We Collect

a. Account Information — When you register, we collect your email address and a password. Passwords are hashed by Supabase before storage; we never have access to your plain-text password.

b. Card Information You Enter — You may manually enter details about your credit or debit cards, which may include:

• card name or nickname;
• last four digits of the card number;
• annual fee;
• rewards rates by purchase category; and
• current balance (optional).

We do not collect full card numbers, CVVs, PINs, or any banking login credentials. Clavis does not connect to your bank or card issuer and does not use Plaid or any open banking integration.

c. Purchase History You Log — You may manually log individual purchases, including the merchant name, category, amount, and estimated rewards earned. All purchase data is entered by you — we do not retrieve it from any financial institution.

d. Email Preferences — If you opt in to weekly email summaries, we retain your email address and send digests of your card perks and credits through Resend, our email delivery provider. You may unsubscribe at any time using the link included in every email.

e. Usage and Technical Data — Clavis is hosted on Vercel, which may automatically collect standard server log data such as IP address, browser type, device type, and pages visited. Supabase may similarly log database access events. This data is used solely for service operation, security monitoring, and performance analysis. We do not operate additional third-party analytics tools beyond what Vercel and Supabase collect by default.

f. Support Communications — If you contact us for support, we retain the content of your message and your email address in order to respond. Support requests may be directed to [email protected].

2. How We Use Your Information

We use the information you provide to:

• operate and maintain your Clavis account;
• calculate estimated rewards and generate card-use recommendations;
• send weekly perk and credit summaries if you have opted in;
• respond to support and account inquiries;
• detect and prevent fraudulent or abusive use of the Service; and
• improve and develop features of the Service.

We do not use your data for advertising purposes and we do not sell your personal information to third parties.

3. Third-Party Service Providers

We share data with the following service providers solely to operate the Service:

• Supabase — authentication and database storage. Supabase’s privacy policy is available at supabase.com/privacy.
• Resend — delivery of optional weekly email summaries. Resend’s privacy policy is available at resend.com/privacy.
• Vercel — web application hosting. Vercel may collect standard server log data as described above. Vercel’s privacy policy is available at vercel.com/legal/privacy-policy.

We do not share personal information with any other third parties except as required by law.

4. Cookies and Tracking Technologies

Clavis uses cookies and session tokens solely to maintain your authenticated login session and provide core application functionality. We do not use advertising cookies, tracking pixels, or cross-site behavioral tracking. Disabling cookies in your browser will prevent you from logging in to the Service.

5. Data Security

Data is stored and transmitted using industry-standard encryption provided by Supabase. Passwords are hashed prior to storage. We do not store full card numbers, CVVs, or banking credentials.

No method of electronic storage or transmission is completely secure. While we take reasonable precautions to protect your information, we cannot guarantee absolute security.

6. Data Retention and Deletion

We retain your account data for as long as your account remains active. If you request deletion of your account, we will permanently delete all associated personal data — including card information, purchase history, and email preferences — within thirty (30) days of your request. This deletion is irreversible.

To request account deletion, contact us at [email protected].

7. Your Rights

You have the right to:

• Access — request a copy of the personal information we hold about you;
• Correction — update inaccurate information in your account;
• Deletion — request permanent deletion of your account and all associated data;
• Opt-out — unsubscribe from marketing emails at any time; and
• Data portability — receive a copy of your data in a portable format upon request.

Residents of California, Virginia, Colorado, and certain other states may have additional rights under applicable state privacy laws, including the right to opt out of the sale of personal information (we do not sell personal information) and the right to non-discrimination for exercising privacy rights. To exercise any of the rights listed above, contact us at [email protected].

8. Children’s Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted personal information through the Service, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date above. For material changes, we will notify registered users by email. Your continued use of the Service following any update constitutes acceptance of the revised policy.

10. Contact

Questions or requests regarding this Privacy Policy may be directed to:

Carter King
New Hampshire, United States
[email protected]