Privacy Policy

1. Who's collecting your data

William Herbert (sole trader, Australia), trading as Clutch. This policy explains what we collect, why, who we share it with, and your rights under Australian Privacy Law and the EU GDPR (where applicable).

Contact: hello@studywithclutch.com.

2. What we collect

Account data

• Email address (for sign-in and service emails)
• Name and university (optional, for personalisation)
• Authentication tokens from Supabase Auth

Content you create

• Subjects, assignments, deadlines, notes, flashcards, planner tasks
• Writing samples you upload to train the writing-style profile
• Drafts and other AI-generated output

Billing data

• Stripe customer ID, subscription status (we don't see your card number — Stripe handles that)

Technical data

• IP address (used for fraud prevention at signup, then discarded)
• Basic browser and device info from server logs
• Feature usage counts (to enforce plan limits)

3. How we use it

• To run the service (signing you in, generating drafts in your voice, billing)
• To enforce plan limits and prevent abuse
• To send you transactional emails (sign-in links, billing receipts)
• To respond to support requests
• To comply with legal obligations

We do not sell your data, ever.

4. Who we share it with (data processors)

We use these providers to run Clutch. Each has its own privacy policy and DPA:

• Anthropic — processes your input + writing samples to generate AI output. Anthropic does not train models on your data per their commercial terms.
• Supabase — hosts our database and authentication. Your data is stored in Supabase's AU-region infrastructure where possible.
• Vercel — hosts the Clutch web application.
• Stripe — processes payments. Card data is handled directly by Stripe; we never see it.
• Cloudflare — provides bot protection (Turnstile) at signup.
• Resend / Supabase Auth Email — sends transactional emails.

5. AI processing — what Anthropic sees

When you generate a draft, notes, flashcards, or a study plan, your prompt is sent to Anthropic's Claude API along with the relevant context (e.g. your writing samples for drafts, your notes for explanations). Anthropic processes this to generate the response and does not retain it for model training.

Anthropic's privacy policy: anthropic.com/legal/privacy

6. How long we keep your data

• Account + content: while your account is active, plus 30 days after deletion to allow recovery.
• Billing records: 7 years (Australian tax law requirement).
• Server logs: 30 days, then deleted.
• IP address at signup: discarded after fraud check completes.

7. Your rights

You can:

• Access the data we hold about you — email us
• Correct inaccurate data — most is editable in your settings, otherwise email us
• Export your content (notes, decks, planner) — email us for a JSON export
• Delete your account and all associated data — email us
• Object to processing for direct marketing — though we don't do this anyway
• Lodge a complaint with the OAIC (Australia) or your local DPA (EU/UK)

We respond to data requests within 30 days.

8. International transfers

Some of our processors (Anthropic, Stripe, Cloudflare, Vercel) are based in the US. By using Clutch you consent to your data being processed there under their respective standard contractual clauses and privacy frameworks.

9. Security

We use Supabase's row-level security to ensure your data is only accessible by you. All data is encrypted in transit (TLS) and at rest (Supabase's AES-256). We don't store passwords — sign-in is via magic link or Google OAuth.

If we discover a data breach affecting your account, we'll notify you within 72 hours per GDPR / Australian Privacy Act requirements.

10. Children

Clutch is intended for university students aged 16 and over. We don't knowingly collect data from anyone under 16. If we discover we have, we'll delete it.

11. Changes to this policy

We may update this policy. We'll email you for material changes. The "Last updated" date at the top of this page always reflects the current version.