Privacy Policy
1. Who is responsible
UAB Isandra is the controller for ClaraClient website operations, business-account administration, billing records, support and service security. Company code: 306832302. Address: Seredžiaus g. 24, Burbiškių k., Seredžiaus sen., Jurbarko r. sav., LT-74419, Lithuania. Email info@isandra.lt for privacy requests. For a customer company’s visitor conversations and inquiries, that company generally determines the purposes and UAB Isandra processes data on its behalf under the DPA. Contact that company first about its inquiry records; we assist it as required.
2. Information and sources
We receive business names, registration details, representative names, work email addresses, account and authentication records, settings, document versions and acceptance timestamps from representatives and authorized staff. Visitors may provide chat text, contact details, HVAC project information, purchase timelines and contact preferences. Our infrastructure receives technical request metadata, including IP addresses, device/browser signals, security checks and usage or error records. Abuse-limiting identifiers may be stored as hashes. Billing and coupon records document entitlement and usage. Do not submit passwords, payment card numbers, government identification numbers, medical information or other unnecessary sensitive data into chat.
3. Purposes and legal grounds
We use account and company information to provide and administer the service, verify authority, communicate about service, document agreements and prevent misuse. For business representatives, our legitimate interests are administering business relationships, securing the platform and handling claims; contract performance applies when the individual is the contracting party. We retain required tax and accounting information to meet legal obligations. Optional marketing requires a separate choice, which you can withdraw by email without affecting service. A Privacy Policy acknowledgment records that you have read the notice; it is not blanket consent. The customer company establishes the lawful basis for its visitors’ inquiries and requested follow-up.
4. AI and recipients
Chat content and relevant company catalog information are sent to the configured AI provider to generate responses and classify inquiries. Authorized customer staff can review their company’s records. Infrastructure providers used by ClaraClient include Vercel for hosting, Supabase for database and authentication, Cloudflare for security/Turnstile, OpenAI for AI processing, and Resend for application email. Service and security personnel, professional advisers and authorities may receive information where needed and lawful. We do not sell personal information or share it for cross-context behavioral advertising. We do not use customer chat content to train our own general-purpose models. Provider processing and retention are subject to the applicable provider agreements; we do not promise zero provider retention.
5. Location and international processing
UAB Isandra is established in Lithuania. The configured production database is in the United States, and infrastructure providers may process data in other countries. Where the GDPR requires a transfer safeguard, an applicable adequacy decision, standard contractual clauses or another valid mechanism must govern the transfer. Ask info@isandra.lt for information on applicable safeguards and copies subject to necessary redactions. This notice does not claim EU-only hosting or certification under the EU-US Data Privacy Framework.
6. Retention and deletion
Account and inquiry records are retained while needed to provide the active service and handle documented customer instructions. After cancellation or a verified deletion request, we review records for deletion or return, retaining only information needed for legal obligations, security, fraud prevention or claims. Agreement and billing evidence may need to remain after account closure. Provider logs and backup copies follow the relevant provider retention cycles and may not disappear immediately; retained copies remain restricted. We do not promise automatic deletion after a fixed number of days. Contact us for an export, deletion, or a retention explanation; customer-controlled inquiries are handled with the customer company.
7. Cookies, storage and security
Authentication and requested chat features may use browser storage or session tokens. The current account interfaces hold short-lived access tokens in page memory; signing out or closing the page ends that local state. Cloudflare Turnstile processes browser and request signals to prevent abuse, and infrastructure may use necessary security cookies. The current ClaraClient site does not intentionally load advertising trackers or optional analytics. A customer’s own website may use additional technologies covered by its notice. We use HTTPS, access checks and tenant access controls. No system is completely secure and no guaranteed recovery or backup interval is represented here.
8. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction, or object to certain processing, withdraw optional consent, or appeal a denied request. Email info@isandra.lt with your relationship to the service and request; do not send identity documents unless we establish a secure, necessary verification process. Authorized agents may submit requests with appropriate authority. We verify requests, respond within applicable deadlines, explain lawful exceptions and do not unlawfully discriminate for exercising rights. California and other state rights apply when the relevant law covers the processing; this notice does not assert that every state statute applies to every account. Where applicable, you may complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or another competent authority.
9. Children, profiling and updates
The service is for businesses and is not directed to children under 18. Contact us if a child’s information has been submitted. AI may suggest an inquiry category or buying-intent level; it does not make binding decisions on employment, credit, housing, insurance or other similarly significant rights. Human staff make final business decisions. We publish a new dated notice for material changes and provide additional notice or obtain consent where required before applying a new purpose to previously collected data.