This Privacy Policy explains what personal data ClawBack.capital collects, why, who we share it with, how long we keep it and the rights you have. It applies to every ClawBack.capital service: the website clawback.capital and its subdomains, our apps, and any API we provide.
1. Who we are
| Controller | Samurai Network Ltd, trading as ClawBack.capital, 98 South Bridge Road, Hull, England, HU9 1TL |
| Contact | privacy@clawback.capital |
ClawBack.capital is a trading name of Samurai Network Ltd, a private limited company registered in England and Wales, company number 15863898. Registered office: 98 South Bridge Road, Hull, England, HU9 1TL. In this policy, "we", "us" and "our" mean that company. We are the controller of the personal data described here under the UK GDPR and the Data Protection Act 2018.
2. What we collect
2.1 What you give us
- Your account: your name, email address, password (stored only as a secure one-way hash), your language and theme, and, if you choose to sign in with Google or Apple, the identifier and email address they give us.
- Two-step sign-in, if you set it up: the secret behind your authenticator app (stored encrypted), the public key of each passkey (your fingerprint, face or device PIN never leaves your device), and your recovery codes (stored only as one-way hashes).
- Your plan and payments: your plans, trials, invoices, payments and refunds. Card details go to our payment partners and never reach us. If you pay in crypto where we accept it: the transaction and the address it came from, which are public on the blockchain.
- What you send us: support tickets and their messages, and charts or text you submit for analysis where a service lets you.
- Your choices: the documents you accepted, when, and the IP address and browser you accepted them from; and your cookie choice.
2.2 What we collect automatically
- Sign-in and security records: when and how each session started and ended, and the IP address and browser it came from.
- Your country: taken from the information our network provider adds to each request, so we can show prices in your currency. We never ask for your precise location.
- Use of our services: the records we need to run them and to apply your plan's limits, such as the API calls counted against your plan.
- Server logs: the addresses requested, status codes, IP address and browser. Kept for 90 days to fix errors and detect abuse.
- Application logs: error messages from our systems. They may contain an account identifier, never a password.
2.3 What we receive from others
- Google or Apple, if you sign in with them: the identifier and email address they share with us.
- Stripe and Onelink, when you pay by card: the status of each payment and refund, your billing country and the tax applied.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Run your account, your plan and the services you use | Contract |
| Take payments, issue receipts and handle refunds | Contract; legal obligation (tax records) |
| Send the emails the service needs: sign-in codes, receipts and security notices | Contract |
| Answer support requests and complaints | Contract; legitimate interest |
| Record which documents you accepted, and your cookie choice | Legal obligation; legitimate interest (proving what was agreed) |
| Analyse charts and text with our AI analyst | Contract (analysis you ask for); legitimate interest (preparing Outlooks) |
| Keep the services secure and investigate errors and disputes | Legitimate interest (we must be able to reconstruct any day's activity to investigate errors and disputes) |
| Comply with the law, including tax-record rules and lawful requests from authorities | Legal obligation |
We do not sell your data, use it for advertising or profiling, or use it to train AI models. Amazon Bedrock, which runs our AI analysis, does not use the data we send it to train its models.
4. Where we store data
- Amazon Web Services in the United States (the us-east-1 region): our databases, file storage, email sending and AI models. Data is encrypted at rest.
- Cloudflare, our network provider: it handles each request on its way to us (DNS, encryption in transit, routing and protection).
- Your browser: the cookies described in our Cookie Policy.
Section 11 explains how we protect transfers to the United States.
5. Who we share it with
We share personal data only with the recipients below, and only as far as each one needs it:
| Recipient | What they receive | Why |
|---|---|---|
| Stripe and Onelink (Onelink is Stripe's reseller service for card payments) | your name, email, country, plan and payment details | to sell you a plan, charge your card, issue receipts and tax invoices, handle refunds and prevent fraud. Onelink acts as a separate controller for the payment and its own customer support. |
| Amazon Web Services (hosting, storage, email, and AI models through Amazon Bedrock) | all data described in this policy | hosting, sending email and running our AI analysis |
| Cloudflare | the data in each request: IP address, headers and the address asked for | routing and protecting traffic to our services |
| Google and Apple | only if you sign in with them | to confirm your identity |
| Adobe Fonts | your IP address and the page address, on every page | to deliver our typefaces (Adobe says it does not store your IP address) |
| TradingView | only after you accept third-party content | to show the free chart |
| Our live-streaming server | your account identifier while you watch | to deliver live sessions |
| Telegram | only if you write to our bot | to receive and answer your message |
| Blockchain data services | only for a crypto payment, where we accept one: the public transaction data | to confirm your payment |
We do not share your data with advertisers, data brokers or analytics companies that profile people.
If the law requires us to disclose data, for example under a court order, we will; where the law allows, we tell you first and disclose only what is required.
6. How long we keep it
| Data | Kept for |
|---|---|
| Your account | while your account exists; deleted or anonymised within 30 days after you delete it |
| Invoices, payments and refunds | 6 years after the end of the financial year they belong to (tax law) |
| The documents you accepted, and when | while your account exists, then 6 years |
| Support tickets | while your account exists; deleted within 30 days after you delete it |
| Sign-in and security records | 12 months after your last sign-in |
| Two-step sign-in data | until you remove it or delete your account |
| Server logs | 90 days |
| Application error logs | 30 days |
| Backups | 30 days |
When you delete your account, we delete or anonymise your personal data within 30 days, except where the law requires us to keep it longer (for example, tax records).
7. Your rights
You have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Erase your data, unless the law requires us to keep it.
- Restrict how we use your data in some circumstances.
- Object to how we use your data where we rely on legitimate interest.
- Data portability: receive your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time, where we rely on consent.
You can export your data or delete your account yourself in GENKAN › Account. For anything else, email privacy@clawback.capital. We reply within one month, or tell you if a complex request needs up to two more months.
Complaints. You can complain to us first: write to privacy@clawback.capital. We acknowledge a complaint within 30 days and tell you what we are doing about it. You can also complain to the UK data protection regulator (ico.org.uk).
8. Security
We protect your data with measures that fit its sensitivity:
- Encryption: every connection to our services is encrypted (TLS), and stored data is encrypted at rest.
- Passwords and codes: passwords and recovery codes are stored only as one-way hashes; card details never reach us.
- Access: only the people and systems that need data to run the service can reach it.
No security measure is perfect. If a data breach affects you, we will tell you and the regulator as the law requires — the regulator within 72 hours of becoming aware of it where the breach is likely to put your rights and freedoms at risk.
9. Cookies
We use cookies as described in our Cookie Policy.
10. Children's privacy
Our services are not directed to children under 18 and we do not knowingly collect data from children. If you believe we have collected data from a child, contact privacy@clawback.capital and we will delete it.
11. International transfers
We host the service with Amazon Web Services in the United States, so your data is transferred there whether you live in the UK or elsewhere. Some of our suppliers, such as Stripe and Google, also process data in the United States. We protect these transfers with the UK's data bridge with the United States for suppliers certified under it, or with the UK International Data Transfer Agreement or Addendum in our contracts with them. Ask us for a copy at privacy@clawback.capital.
12. Changes to this Privacy Policy
We may update this Privacy Policy. We tell you about a material change through our services or by email at least 30 days before it takes effect. The version shown with this policy changes whenever it does.
13. Contact
Samurai Network Ltd, trading as ClawBack.capital — 98 South Bridge Road, Hull, England, HU9 1TL. Email: privacy@clawback.capital.