Privacy Policy

ClusterFunk is operated by Donald Butts. This policy describes what we collect, why, who processes it, and how to get it removed. We collect as little as the service needs to work, and we do not sell personal data to anyone, ever.

What we collect

• Email address — if you join the free list or create an account.
• Account details — name and email, held by our authentication provider.
• Subscription and billing records — plan, status and payment history, held by Stripe. We never see or store your full card number.
• Usage analytics — pages viewed and a small number of product events, such as clicking a subscribe button or submitting the email form.
• Content you type into AI features — questions asked of Ask ClusterFunk, and company names entered into Due Diligence.
• Watchlist selections — the topics you choose to follow, if you use that feature.

We do not collect special category data, we do not run advertising trackers, and we do not build profiles for advertisers.

Who processes it

We use a small number of third-party processors. Each receives only what it needs, and each has its own privacy policy governing its handling of that data.

• Clerk — account creation and sign-in.
• Stripe — payments, subscription status and the billing portal. Card details go directly to Stripe and never touch our servers.
• Resend — the free email list and transactional email.
• PostHog — product analytics.
• Google (Gemini API) — powers Ask ClusterFunk, Due Diligence and the watchlist digest. The text of your question is sent to Google to generate an answer.
• Netlify — hosting, which involves standard server logs including IP address.

AI features specifically

When you use Ask ClusterFunk or Due Diligence, what you type is sent to Google's Gemini API along with data from our research corpus, so a response can be generated. Do not enter confidential information, personal data about other people, or anything you would not want leaving your organisation. These features are for querying public research data, not for processing sensitive material.

Why we are allowed to hold it

• To perform our contract with you — running your account, delivering the service, taking payment.
• With your consent — the free email list, which you can withdraw at any time by unsubscribing.
• For our legitimate interests — keeping the service secure, understanding which pages are used, and preventing abuse, balanced against your privacy.
• To comply with law — retaining financial records for the period tax law requires.

How long we keep it

• Account data — while your account exists, then deleted on request.
• Email list — until you unsubscribe or ask for removal.
• Billing records — as long as tax and accounting law requires, typically seven years.
• Analytics — retained according to our PostHog project settings, and not used to identify you personally beyond a pseudonymous identifier.
• AI feature inputs — not retained by us as a permanent record beyond what is needed to serve your session and operate rate limiting.

Your rights

Depending on where you live, you may have the right to access the data we hold about you, correct it, have it deleted, object to processing, or receive a portable copy. Exercise any of these by emailing us from our contact page. We will respond within 30 days. You can unsubscribe from email at any time using the link in any message, without contacting us at all.

If you are in the EEA or UK and believe we have handled your data improperly, you may complain to your local supervisory authority. If you are in California, we do not sell or share personal information as those terms are defined under the CCPA, and we will not discriminate against you for exercising any privacy right.

Cookies

We use cookies that are necessary for the service to function: an authentication session cookie, and a signed access token that records whether your subscription is active. Analytics uses a pseudonymous identifier to count returning visitors. We do not run advertising or cross-site tracking cookies, which is why you are not seeing a consent banner asking you to accept any.

International transfers and security

Our processors are primarily United States based, so data may be processed there. We rely on the safeguards each provider offers for international transfers. Data is transmitted over HTTPS, access tokens are signed, and access to systems is limited to those who need it. No service can promise perfect security, and we do not.

Children

ClusterFunk is not directed at children and is not intended for anyone under 16. We do not knowingly collect their data. If you believe we have, contact us and we will delete it.

Changes

We may update this policy. The effective date above will change, and we will notify subscribers by email of any material change to how we handle personal data.