Privacy Policy

01Who we are

The data controller of your personal information is:

• The Clueless AIGENCY, S.L.
• Tax ID (CIF): B56701212
• Registered address: Calle Jericó 2, Local, 08035 Barcelona, Spain
• Contact: support@theclueless.ai

For any matter related to your personal data, you can write to us at the email above with the subject line “Privacy”.

02What we collect

Data you give us directly

• Account data — your name and email address when you sign up.
• Payment data — billing details processed by Stripe. We never see or store your full card number; we only receive a token and basic invoice metadata (last four digits, country, billing name). Accounts billed through Fanvue pay on Fanvue instead (see below).
• User input — the photos, videos, prompts and reference materials you upload to train avatars or generate content.
• Outputs — the images, videos and audio our models generate from your input.
• Communications — emails, support tickets and messages you send us.

Data we collect automatically

• Usage data — pages visited, features used, generations triggered, errors encountered.
• Device & technical data — IP address, browser type, operating system, language, approximate location (city-level, derived from IP).
• Cookies & similar technologies — see our Cookie Policy for the full list.

Data from Fanvue (only if you use Fanvue with the Suite)

When you sign in with Fanvue, connect your Fanvue account from Account → Connections, or open the Suite inside Fanvue, Fanvue shares with us, with your permission:

• Fanvue profile — your Fanvue user ID, handle, display name, the email address on your Fanvue account (if Fanvue provides it) and whether it is a creator account. We use it to create or sign you into your Suite account and to show which Fanvue account is connected.
• Fanvue access tokens — the keys Fanvue issues so we can act for you within the permissions you approved. We store them encrypted (AES-256-GCM) and delete them when you disconnect Fanvue.
• Content you send to Fanvue — when you choose “Send to Fanvue”, we upload that image or video to your Fanvue media library. We do not publish posts on your behalf or read your other Fanvue content.
• Fanvue billing records — for accounts billed through Fanvue: the status of your subscription to our app and the payments, refunds and disputes Fanvue reports to us (invoice number, amount, status and dates), which we use to add or remove credits. Fanvue takes the payment; we never receive your card details.

03How & why we use your data

04Legal basis under GDPR

We rely on Article 6(1) of the GDPR for each processing activity:

• Performance of a contract (Art. 6(1)(b)) — to deliver the services you signed up for.
• Consent (Art. 6(1)(a)) — for non-essential cookies, advertising measurement with Meta and marketing communications. You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate interest (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve the product through aggregated analytics. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other applicable law.

05Your content & AI model training

This is our hard commitment: The Clueless does not use your input or your generated content to train, fine-tune or improve any artificial intelligence model — neither our own nor any of our providers'.

Specifically:

• The photos, videos and reference materials you upload are used only to produce the output you request.
• The outputs you generate belong to you and are used only to deliver them back to you and store them in your account.
• We have configured all our AI processors (see §06) under data processing agreements that prohibit training on your content, including for “abuse monitoring” retention periods where applicable.
• Aggregated, anonymised metrics (e.g. “average generation time”) may be used to monitor performance — these contain no personal data and cannot be reverse-engineered to your content.

06Who we share your data with

We rely on a small number of carefully selected service providers (“data processors”) to operate the platform. They process your data on our instructions, under written agreements that meet GDPR Art. 28 requirements:

Our inference providers route each request to the company that makes the selected model (for example ByteDance, Google, Kuaishou, MiniMax, Alibaba, OpenAI or Black Forest Labs). Those companies only receive what the request needs — your prompt and the images, video or audio you attach to it.

Fanvue. If you use the Suite with Fanvue, Fanvue is an independent controller of the data you hold with it, under its own privacy policy. We send Fanvue only what you ask us to (the renders you choose to send), and for accounts billed through Fanvue, Fanvue processes the payments.

Meta (advertising measurement). Only if you accept marketing cookies, we share information about your visit with Meta Platforms Ireland Ltd. so we can measure and improve our Facebook and Instagram ads. We send it from your browser, through the Meta Pixel, and from our servers, through Meta's Conversions API. It includes the pages you visit and when you sign up, start a checkout or make a payment (with the plan or credit pack and the amount paid); your email address and account ID, pseudonymised with a SHA-256 hash before they are sent; your IP address and browser details; and the identifiers of Meta's cookies (_fbp, _fbc). Meta uses this to match these actions with Meta accounts and with the ads that were shown. We never send anything you create or upload. For collecting and sending this data, we and Meta are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum; what Meta does with it afterwards is governed by Meta's privacy policy. If you withdraw consent in the cookie preferences, or your browser sends a Global Privacy Control signal, we stop sending it.

We do not sell your personal data, and apart from Meta, as described above (only with your consent), we do not share it with advertisers or data brokers. We may disclose data to public authorities only when legally required (e.g. court order).

07International transfers

Some of the processors listed in §06 are located outside the European Economic Area, mainly in the United States. Whenever we transfer personal data outside the EEA, we rely on one of the safeguards permitted by Chapter V of the GDPR:

• EU–US Data Privacy Framework certification, where the provider has self-certified.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Additional technical measures (encryption in transit and at rest, access controls).

Meta may transfer the advertising-measurement data described in §06 to Meta Platforms, Inc. in the United States, under the EU–US Data Privacy Framework.

You can request a copy of the relevant safeguards by writing to support@theclueless.ai.

08How long we keep your data

09How we protect your data

We apply technical and organisational measures appropriate to the risk:

• TLS 1.2+ encryption for all data in transit.
• Encryption at rest for stored content and backups.
• Role-based access controls and the principle of least privilege.
• Regular vulnerability testing and dependency monitoring.
• Vetted, GDPR-compliant sub-processors.

If a personal data breach affecting your rights occurs, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours and inform you without undue delay where required by Art. 34 GDPR.

10Your rights

Under the GDPR you have the following rights:

• Access Get a copy of the personal data we hold about you.
• Rectification Correct inaccurate or incomplete data.
• Erasure Have your data deleted (“right to be forgotten”).
• Restriction Limit how we process your data.
• Portability Receive your data in a machine-readable format and transfer it to another provider.
• Objection Object to processing based on legitimate interest, including profiling.
• Withdraw consent Where processing is based on consent, withdraw it at any time.
• Automated decisions Not be subject to decisions based solely on automated processing that produce legal effects.

To exercise any of these rights, email support@theclueless.ai with the subject “Privacy Rights”. We will respond within one month and may extend that period by two further months for complex requests, notifying you of the reason.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your rights have been infringed.

10·bRegional rights

European Economic Area & UK

If you are in the EEA or the UK, the GDPR / UK GDPR rights described in §10 apply in full. Our lead supervisory authority is the Spanish Data Protection Agency (AEPD); UK residents can also contact the Information Commissioner's Office (ICO).

California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, the sources, the business purpose and the third parties we share it with.
• Access the specific pieces of personal information we have about you.
• Delete your personal information, subject to limited exceptions.
• Correct inaccurate personal information.
• Limit the use of sensitive personal information to what is necessary to provide the Service.
• Opt out of “sale” or “sharing” of personal information. We do not sell personal information as defined by the CCPA. If you accept marketing cookies, what we send Meta (§06), which includes identifiers such as your hashed email and your IP address, may count as “sharing” for cross-context behavioural advertising; you opt out by choosing “Essential only” or turning Marketing off in the cookie preferences, and we honour Global Privacy Control signals the same way.
• Non-discrimination — we will not deny service or charge different prices for exercising these rights.

To exercise your California rights, email support@theclueless.ai with “California Privacy Rights” in the subject line. Authorised agents may submit requests on your behalf with proof of authorisation.

Brazil (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (Law 13.709/2018) substantially equivalent to those in §10, including access, correction, anonymisation, portability, deletion and information about shared parties. You may also contact the Brazilian National Data Protection Authority (ANPD).

Other jurisdictions

If you are located in Canada (PIPEDA), Australia (Privacy Act 1988), Switzerland (FADP), or another jurisdiction with comparable privacy law, equivalent rights apply. Contact us with the relevant local right and we will respond accordingly.

How to exercise any regional right

One channel for everyone: support@theclueless.ai. We will verify your identity, respond within the timeframes set by your local law (typically 30–45 days), and never charge you for exercising these rights — except in the case of manifestly unfounded or excessive requests.

11Minors

The service is intended for users aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it without delay. Parents or guardians who believe their child has provided us with personal data should contact us immediately.

12Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the services, or applicable law. The “Last updated” date at the top reflects the most recent revision. For material changes, we will give you reasonable advance notice by email or through the platform before they take effect.

13Contact

If you have any questions, complaints or requests regarding this Privacy Policy or how we handle your data, please contact us:

• The Clueless AIGENCY, S.L.
• Calle Jericó 2, Local, 08035 Barcelona, Spain
• Email: support@theclueless.ai