Privacy Policy

At CleverKeeper (the "Service," "we," "us," or "our"), owned and operated by Lion Rock Technology Limited, we are committed to protecting the privacy of our users (workspace administrators and members) and their clients. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you access or use our platform, websites (including cleverkeeper.com and associated subdomains), and any integrated services.

This Policy also helps our users understand their role as Data Controllers and our role as a Data Processor regarding the personal data of their respective clients.

We collect information directly from you, automatically through your use of the Service, and from third-party integrations.

1.1 Information Provided Directly by You

• Account and Workspace Details: When you register a workspace, we collect your name, business name, professional role (e.g., tutor, freelancer), email address, phone number, and password.
• Client Records and Booking Data: You input client details, contact information, booking schedules, notes, and session attendance records.
• Financial and Billing Details: Stripe securely handles subscription billing. If you connect your Stripe account to process client payments, we store secure identifiers, payment statuses, and transaction amounts.
• Receipts and Expenses: Photo uploads of physical receipts are parsed via AI OCR technology to extract merchant names, categories, and amounts.

1.2 Information Collected Automatically

We track application performance, logins, settings selections, and UI interactions through secure analytics tools, including PostHog, to continuously refine application speed and user experience.

1.3 Meta / WhatsApp Integration

If you integrate WhatsApp, we store tokens and status updates to transmit, log, and verify delivery of session reminders.

We process your data for the following specific purposes:

• To Provide the Service: Enabling CleverKeeper dashboards, calendars, and secure workspace databases isolated from other tenants.
• To Automate Notifications: Sending automated session reminders to your clients via WhatsApp on your behalf.
• To Process Payments & Invoices: Integrating with Stripe HK to process cards, invoice templates, and track transaction success rates.
• To Perform OCR Extraction: Transmitting receipt images to our OCR model to extract merchant receipt metadata.
• To Improve the Service: Gathering anonymous interface usage events to eliminate bugs and speed up dashboard loading.

We do not sell, rent, or trade your personal data or your clients' personal data. We only share information with trusted subprocessors required to fulfill core services:

• Stripe: Secure billing infrastructure and credit card processing.
• Meta Platforms (WhatsApp): Direct transmission of reminder messages.
• PostHog: Capture of client-side events for performance monitoring.
• Database & Cloud Hosts: Highly secure, isolated server infrastructure.

CleverKeeper is designed around deep multi-tenant logical database isolation:

• Isolation: Workspace rows are tagged with unique identifiers. Cross-workspace querying is strictly blocked.
• Encryption: Secure socket layers protect data in transit (HTTPS/WSS) and encryption protects persistent database volumes.
• Credentials: Account credentials are encrypted with state-of-the-art password hashing.

If you operate a workspace and manage client directories on CleverKeeper, you act as the Data Controller under data privacy law, deciding which records to keep and which reminder alerts to trigger.

CleverKeeper serves as the Data Processor, performing services strictly under your direction. You are responsible for acquiring all necessary client consents before storing their personal phone numbers or emails and before scheduling automated reminders.

Pursuant to the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and related APAC frameworks, you have the right to request access to your records, edit inaccurate fields, request account deletion, and export your database in CSV format.

Data is retained for as long as your workspace subscription remains active. Workspace deletion requests result in complete removal of all clients, expense receipts, and bookings within our production databases after a grace period.

Please address all queries to support@cleverkeeper.com.

To secure reliability and global access, CleverKeeper handles database replication and server orchestration across regional secure cloud datacenters. We ensure all transferred packages align with regulatory safeguards mandated by the PDPO.

CleverKeeper offers optional integrations that you can connect with your Google account. We only access Google user data after you sign in with Google and approve the requested permissions, and only to provide the feature you turned on.

8.1 YouTube API Services

CleverKeeper uses YouTube API Services to let workspace administrators publish YouTube Shorts to their own channel. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy.

• What we access: your channel ID, channel name, and channel thumbnail (YouTube read-only permission), and the ability to upload videos (YouTube upload permission).
• How we use it: we show your connected channel in CleverKeeper and upload only the Shorts you create, review, and approve (immediately or at the time you schedule). We do not read, modify, or delete any other videos on your channel.
• What we store: your channel ID, name, and thumbnail; an encrypted OAuth refresh token; and the videos, titles, descriptions, and tags you prepare in CleverKeeper, together with the ID of each published video.

8.2 Google Calendar

If you connect Google Calendar, we read and write calendar events only to keep your CleverKeeper bookings in sync with your calendar.

8.3 Storage, Sharing & Limited Use

• OAuth tokens are encrypted at rest and are never shown to other users or returned to your browser.
• We do not sell Google user data, use it for advertising, or share it with third parties, except to send your content to Google so it can be published or synced at your request.
• CleverKeeper's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8.4 Revoking Access & Deleting Data

You can disconnect YouTube or Google Calendar at any time in CleverKeeper; we then immediately delete the stored tokens and channel details. You can also revoke CleverKeeper's access from your Google security settings. To delete the videos and other data you stored in CleverKeeper, delete them in the app or contact support@cleverkeeper.com.