Privacy Policy

“CloneKit”, “we” and “us” mean the company that runs clonekit.ai. Questions about privacy go to francisco@clonekit.ai.

• Account information. When you sign up with email, Google or X, our sign-in provider Clerk gives us your name, email address and profile picture.
• Payment information. Stripe collects and holds your card details. We store only the card brand and its last 4 digits, plus your purchases, balance and top-up settings.
• Kit usage. When your agent uses our MCP server, we record the tool calls it makes and the steps of each kit run, so runs can resume and you can see your history.
• Kit content. If you are a creator, we store the kits you publish, including private kits.
• Basic logs. Like most websites, we keep server logs such as IP address, browser type, pages requested and errors, to keep the service secure and working.

If you sign in with Google, we receive only your name, email address and profile picture. We use them only to create and run your CloneKit account. We don't use Google user data for ads, we don't sell it, and we don't share it except with the service providers listed below that help us run your account.

• To run your account, sign you in and keep it secure.
• To serve kits to your agent and keep track of your runs.
• To take payments, keep your balance and pay creators.
• To find and stop fraud, abuse and malicious kits.
• To send you emails about your account, purchases and important changes.
• To understand, in aggregate, how CloneKit is used so we can improve it.

CloneKit doesn't run kits. Your own AI agent and tools do, under your accounts with those providers. What your agent does with your data is governed by your agreements with them, not this policy.

When your agent sends us answers during a run, we automatically remove secrets such as API keys and passwords before we store them.

Creators see aggregate numbers about their kits, such as how many people bought or ran them. They never see your private data, your answers or your account details.

To protect buyers, we scan kit content, including private kits, for malware and attacks. We use automated tools and AI model APIs for this. The providers of those APIs process the content only to give us the result.

We use a small set of service providers. Each gets only what it needs to do its job:

• Clerk for sign-in and accounts.
• Stripe for payments and card details.
• Neon for our Postgres database.
• Vercel for hosting.
• Google Workspace for email.
• AI model providers for automated security review of kits.

We may also share information when the law requires it, to protect people or CloneKit from harm, or as part of a merger or sale of the business, in which case this policy keeps applying.

• We don't sell or rent your personal data.
• We don't use ad trackers or share data with advertisers.

We keep account and usage data while your account is open. When you delete your account, we delete or anonymize your personal data, except records we must keep by law, such as payment and tax records.

You can see and update your account information in your account settings. You can ask us for a copy of your data, to correct it, or to delete it by emailing francisco@clonekit.ai. We reply within 30 days.

CloneKit operates from the United States, and our providers store data mainly in the United States.

CloneKit is not for children under 13, and we don't knowingly collect their data. If you think a child has signed up, tell us.

If we change this policy, we update the date at the top. If a change is significant, we tell you by email or on the site before it applies. See also our Terms of Service.