Privacy Policy.

We collect only what we need to respond to you and to run our services.

• Information you give us. When you use the contact form, request a workshop, or join our field-notes list, we collect the details you submit: typically your name, email address, company, and the contents of your message.
• Diagnostic information. When you run CLRT Ascent, we collect the email address you sign in with, the responses you give during the diagnostic, and a record of your consent. If you buy a paid diagnostic, payment is handled by our payment processor, and we do not store your card details.
• Technical information. Our hosting keeps standard server logs, including IP address, for security and to keep the service running. We use only the essential cookies the site needs to work. We do not use third-party advertising or analytics trackers, and we do not build advertising profiles.

We use personal data for a small set of clearly-defined purposes.

• To respond and to serve. To answer your enquiry and provide what you ask for. Lawful basis: performance of a contract, or our legitimate interest in serving the people who contact us.
• To run the diagnostic. To operate CLRT Ascent and, where you buy one, to take payment. Lawful basis: contract, and your consent for the diagnostic itself.
• To send field notes. To send you our occasional field notes, where you have opted in. Lawful basis: consent, which you can withdraw at any time.
• To secure our systems. To keep the service safe and running. Lawful basis: legitimate interest.

CLRT Ascent is built the way we build everything: governed. During the diagnostic your figures stay masked until you give consent to unlock them, and that consent is recorded.

The numbers you see are computed in code from your inputs, never generated by a language model. The reasoning text around them is produced with the help of our AI provider, which processes your inputs only to produce that output for you.

We share personal data only with the service providers that help us run CLRT, and only for the purposes above. They act as our processors under contract.

• Vercel. Hosts our websites.
• Telegram. Notifies our team when you submit a form.
• Anthropic. Provides the AI reasoning behind the CLRT Ascent diagnostic.
• Stripe. Processes payments for paid diagnostics.

We do not sell, rent, or trade your personal data to anyone, and we do not use it for advertising. We do not capture a third party's data in order to contact them without a basis to do so.

CLRT operates from the UAE, and some of the providers above process data outside the UAE. Where personal data is transferred across borders, we rely on the safeguards those providers offer and take reasonable steps to keep it protected to the standard described here.

We keep personal data only as long as it serves the purpose it was collected for, or as long as applicable law requires. Enquiry and diagnostic records are kept while there is an active or prospective relationship and for a reasonable period after. When data is no longer needed, we delete it. You can ask us to delete your data sooner.

We hold personal data over encrypted connections, limit access to the people who need it, and design our own systems on the governed line: a human in control of anything irreversible, and a trail behind every action. No system is perfectly secure, but we build to the standard the work demands and review it as we grow.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Delete your data, or ask us to stop processing it.
• Withdraw a consent you have given, at any time.
• Object to, or ask us to restrict, certain processing.
• Receive a copy of the data you gave us, in a portable form.
• Complain to the UAE Data Office, or your local supervisory authority, if you believe we have handled your data wrongly.

We aim to align our handling of personal data with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for visitors in the EU and UK, with the GDPR.

CLRT is a business service. Our site and diagnostic are not directed at children under 18, and we do not knowingly collect their personal data.

We may update this policy as our services or the law change. When we do, we will revise the date above, and material changes will be made clear on this page.

For any question about this policy, or to exercise your rights, reach us at clrtstudio.com/contact and we will route your request to the right person. Where the law sets a deadline, we will respond within it, and within 30 days at the latest.