Privacy Policy

01Who we are

The data controller of your personal information is:

• The Clueless AIGENCY, S.L.
• Tax ID (CIF): B56701212
• Registered address: Calle Jericó 2, Local, 08035 Barcelona, Spain
• Contact: stuff@theclueless.ai

For any matter related to your personal data, you can write to us at the email above with the subject line “Privacy”.

02What we collect

Data you give us directly

• Account data — your name and email address when you sign up.
• Payment data — billing details processed by Stripe. We never see or store your full card number; we only receive a token and basic invoice metadata (last four digits, country, billing name).
• User input — the photos, videos, prompts and reference materials you upload to train avatars or generate content.
• Outputs — the images, videos and audio our models generate from your input.
• Communications — emails, support tickets and messages you send us.

Data we collect automatically

• Usage data — pages visited, features used, generations triggered, errors encountered.
• Device & technical data — IP address, browser type, operating system, language, approximate location (city-level, derived from IP).
• Cookies & similar technologies — see our Cookie Policy for the full list.

03How & why we use your data

04Legal basis under GDPR

We rely on Article 6(1) of the GDPR for each processing activity:

• Performance of a contract (Art. 6(1)(b)) — to deliver the services you signed up for.
• Consent (Art. 6(1)(a)) — for non-essential cookies and marketing communications. You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate interest (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve the product through aggregated analytics. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other applicable law.

05Your content & AI model training

This is our hard commitment: The Clueless does not use your input or your generated content to train, fine-tune or improve any artificial intelligence model — neither our own nor any of our providers'.

Specifically:

• The photos, videos and reference materials you upload are used only to produce the output you request.
• The outputs you generate belong to you and are used only to deliver them back to you and store them in your account.
• We have configured all our AI processors (see §06) under data processing agreements that prohibit training on your content, including for “abuse monitoring” retention periods where applicable.
• Aggregated, anonymised metrics (e.g. “average generation time”) may be used to monitor performance — these contain no personal data and cannot be reverse-engineered to your content.

06Who we share your data with

We rely on a small number of carefully selected service providers (“data processors”) to operate the platform. They process your data on our instructions, under written agreements that meet GDPR Art. 28 requirements:

We do not sell your personal data, and we do not share it with advertisers or data brokers. We may disclose data to public authorities only when legally required (e.g. court order).

07International transfers

Some of the processors listed in §06 are located outside the European Economic Area, mainly in the United States. Whenever we transfer personal data outside the EEA, we rely on one of the safeguards permitted by Chapter V of the GDPR:

• EU–US Data Privacy Framework certification, where the provider has self-certified.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Additional technical measures (encryption in transit and at rest, access controls).

You can request a copy of the relevant safeguards by writing to stuff@theclueless.ai.

08How long we keep your data

09How we protect your data

We apply technical and organisational measures appropriate to the risk:

• TLS 1.2+ encryption for all data in transit.
• Encryption at rest for stored content and backups.
• Role-based access controls and the principle of least privilege.
• Regular vulnerability testing and dependency monitoring.
• Vetted, GDPR-compliant sub-processors.

If a personal data breach affecting your rights occurs, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours and inform you without undue delay where required by Art. 34 GDPR.

10Your rights

Under the GDPR you have the following rights:

• Access Get a copy of the personal data we hold about you.
• Rectification Correct inaccurate or incomplete data.
• Erasure Have your data deleted (“right to be forgotten”).
• Restriction Limit how we process your data.
• Portability Receive your data in a machine-readable format and transfer it to another provider.
• Objection Object to processing based on legitimate interest, including profiling.
• Withdraw consent Where processing is based on consent, withdraw it at any time.
• Automated decisions Not be subject to decisions based solely on automated processing that produce legal effects.

To exercise any of these rights, email stuff@theclueless.ai with the subject “Privacy Rights”. We will respond within one month and may extend that period by two further months for complex requests, notifying you of the reason.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your rights have been infringed.

10·bRegional rights

European Economic Area & UK

If you are in the EEA or the UK, the GDPR / UK GDPR rights described in §10 apply in full. Our lead supervisory authority is the Spanish Data Protection Agency (AEPD); UK residents can also contact the Information Commissioner's Office (ICO).

California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, the sources, the business purpose and the third parties we share it with.
• Access the specific pieces of personal information we have about you.
• Delete your personal information, subject to limited exceptions.
• Correct inaccurate personal information.
• Limit the use of sensitive personal information to what is necessary to provide the Service.
• Opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as defined by the CCPA, and we have not done so in the previous 12 months.
• Non-discrimination — we will not deny service or charge different prices for exercising these rights.

To exercise your California rights, email stuff@theclueless.ai with “California Privacy Rights” in the subject line. Authorised agents may submit requests on your behalf with proof of authorisation.

Brazil (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (Law 13.709/2018) substantially equivalent to those in §10, including access, correction, anonymisation, portability, deletion and information about shared parties. You may also contact the Brazilian National Data Protection Authority (ANPD).

Other jurisdictions

If you are located in Canada (PIPEDA), Australia (Privacy Act 1988), Switzerland (FADP), or another jurisdiction with comparable privacy law, equivalent rights apply. Contact us with the relevant local right and we will respond accordingly.

How to exercise any regional right

One channel for everyone: stuff@theclueless.ai. We will verify your identity, respond within the timeframes set by your local law (typically 30–45 days), and never charge you for exercising these rights — except in the case of manifestly unfounded or excessive requests.

11Minors

The service is intended for users aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it without delay. Parents or guardians who believe their child has provided us with personal data should contact us immediately.

12Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the services, or applicable law. The “Last updated” date at the top reflects the most recent revision. For material changes, we will give you reasonable advance notice by email or through the platform before they take effect.

13Contact

If you have any questions, complaints or requests regarding this Privacy Policy or how we handle your data, please contact us:

• The Clueless AIGENCY, S.L.
• Calle Jericó 2, Local, 08035 Barcelona, Spain
• Email: stuff@theclueless.ai