Privacy Policy

Last updated: 10 June 2026

This Privacy Policy explains how fortea (CVR 34445605), Vestergade 15A, 5000 Odense C ("we", "us") processes personal data when you use Cladis (the "Service"). We are the data controller for the account and usage data described below. For files you upload that contain other people's personal data, see "Files you upload" — for those, you are the controller and we act as your processor.

1. Data we process

Account data

Your email address and a securely hashed password. We never store your password in plain text.

Files you upload

Files you submit are processed only to compute similarity results. They are kept for 90 days after the analysis completes, so you can review match evidence, and are permanently deleted after that or as soon as you delete the analysis — whichever comes first. Uploads never attached to an analysis are automatically deleted within 30 days. We do not use your files to train any model. If your files contain personal data about third parties (for example student submissions), you are the data controller for that data and we process it on your behalf, under these terms, solely to provide the Service. We recommend you anonymize filenames and remove identifying metadata before uploading.

Job and usage data

Metadata about your analysis jobs (such as file counts, timing, and the computed results), API keys (stored only as a secure hash), and limited technical logs (including IP address) used to operate and secure the Service.

Billing data

Payments are handled by our Merchant of Record, Paddle.com Market Limited ("Paddle"). We do not receive or store your full card details. Paddle shares limited data with us such as your email, country, and subscription status to manage your plan.

2. Why we process it, and our legal basis

• To provide the Service and your account — performance of our contract with you (GDPR Art. 6(1)(b)).
• To bill you and manage subscriptions — performance of contract and compliance with legal obligations (Art. 6(1)(b),(c)).
• To secure, maintain, and improve the Service and prevent abuse — our legitimate interests (Art. 6(1)(f)).
• Where required, on the basis of your consent (Art. 6(1)(a)).

3. Sub-processors

We use a small number of service providers ("sub-processors") that process data on our behalf to run the Service. This is the complete current list:

• Paddle.com Market Limited (Paddle, United Kingdom) — payments, billing, and subscription management, as our Merchant of Record. Receives your email, country, and payment details.
• Railway (United States company) — application hosting, database, and job queue. Processes account data, job metadata, and results. Hosted in the EU (Amsterdam, Netherlands).
• Cloudflare, Inc. (United States company) — object storage for the files you upload, and cookieless visitor analytics on our public pages. Files are held in EU-jurisdiction storage.

Google Sign-In. If you choose to sign in with Google, Google verifies your identity. Google acts as an independent controller for that authentication — not as our sub-processor — and its own privacy terms apply. Google is not involved if you sign in with an email and password.

No third-party AI or model provider. The files you upload are analyzed entirely on our own infrastructure. Cladis is training-free: your files are never sent to an external AI or model service, and are never used to train anything.

We will update this list before engaging a new sub-processor and notify account holders of material changes, so that you have an opportunity to object.

Where your data is stored

Your account data, analysis results, and the files you upload are stored and processed in the European Union. The application and database run in Amsterdam, Netherlands, and uploaded files are held in storage configured to keep data within the EU. Paddle processes billing data in the United Kingdom, which the European Commission has recognised as providing an adequate level of protection.

Railway and Cloudflare are United States companies operating EU infrastructure on our behalf. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses as a safeguard.

4. Retention

• Uploaded files: deleted 90 days after the analysis completes, or immediately when you delete the analysis. Uploads never attached to an analysis are deleted within 30 days.
• Analyses and their results (including filenames): deleted 12 months after they are created, or immediately when you delete them.
• Account data: kept until you delete your account, which you can do yourself at any time.
• Billing records: kept as required by accounting law — the Danish Bookkeeping Act requires five years. These contain billing data only, never the files you upload.

5. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability and to withdraw consent. To exercise these rights, contact contact@cladis.io. You also have the right to lodge a complaint with Datatilsynet (the Danish Data Protection Agency), datatilsynet.dk.

6. Security

We protect data in transit with encryption, store passwords and API keys only as secure hashes, and permanently delete uploaded files when you delete a job. No method of transmission or storage is completely secure, but we take reasonable measures appropriate to the risk.

7. Cookies

We use only the cookies and local storage necessary to keep you signed in and to operate checkout (via Paddle). We do not use advertising or third-party tracking cookies. Our public pages use Cloudflare Web Analytics, which measures page views without cookies and without building a profile of you across sites.

8. Children

The Service is intended for educators, professionals, and organizations, not for use directly by children. If you analyze work produced by minors, anonymize it and ensure you have a lawful basis to process it.

9. Changes

We may update this Policy; the "Last updated" date reflects the latest version. See also our Terms of Service.

10. Contact

Privacy questions or requests: contact@cladis.io.