Last updated: June 2026
We collect information you provide directly to us, including your name, email address, and payment information when you create an account or subscribe to our services. If you sign up or log in with Google, we receive your name, email address, and profile image from your Google account. When you deploy an instance, we collect the configuration you supply for that instance, including your project name, chosen agents and companies, and any third-party API keys or credentials needed to run them (for example, your Anthropic/Claude Code authorization). If you participate in our referral program, we collect the email addresses of people you refer and track referral status, credits, and payouts associated with your account. We automatically collect certain technical information when you use our services, including IP addresses, browser type, operating system, referring URLs, and usage data (such as pages visited and features used).
We use the information we collect to: • Provide, maintain, and improve our services, including provisioning and operating your dedicated instance • Process transactions, subscriptions, and referral payouts • Send administrative messages, provisioning status updates, and support responses • Monitor and analyze usage patterns to improve user experience • Detect and prevent fraudulent transactions, abuse, and other illegal activities • Provide account support, which may require our support team to temporarily access your dashboard on your behalf
We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy. We share information with trusted service providers who help us operate the platform, each bound by confidentiality and data-processing obligations, including: • Our payment processor, for billing and referral payouts • Our authentication and database provider, including Google OAuth when you choose to sign in that way • Cloud infrastructure providers that host your dedicated server instance • DNS and edge/SSL providers for your instance's subdomain • Transactional email delivery (for provisioning notifications, receipts, and account emails) • The AI model provider you authorize when connecting Claude Code or supplying your own API key — we do not access the content of those conversations beyond what is needed to operate the connection We do not publicly disclose the specific infrastructure vendors we use; this information is available on request for security or diligence purposes. We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of NumaClaw, our users, or others.
We implement industry-standard security measures to protect your personal information. All sensitive data — including third-party API keys, SSH credentials, and admin passwords associated with your instance — is encrypted at rest using AES-256-GCM encryption and is only decrypted server-side at the moment it is needed (e.g. to provision or manage your server). Passwords are hashed using bcrypt. Data is transmitted over HTTPS/TLS. Access to your instance's terminal and infrastructure controls is restricted to your authenticated session and, where necessary for support, to authorized NumaClaw staff.
We retain your personal information for as long as your account is active or as needed to provide services. If you cancel a subscription, the associated instance and its data are retained until the end of the current billing period, after which the server is deprovisioned and its data deleted. Account-level data is retained for 30 days after account cancellation to allow reactivation, after which it is deleted, except where longer retention is required for legal, tax, or fraud-prevention purposes.
Depending on your location, you may have the right to: • Access the personal data we hold about you • Request correction of inaccurate data • Request deletion of your data (subject to legal obligations) • Export your data in a portable format • Object to or restrict certain processing • Withdraw consent for optional analytics cookies at any time To exercise these rights, contact us at privacy@numaclaw.com. We will respond within the timeframe required by applicable law (e.g. GDPR or CCPA).
We use essential session cookies (set by our authentication provider) to keep you signed in. These cannot be disabled without breaking login. Where enabled, we also use privacy-conscious analytics tools (Google Analytics and Microsoft Clarity) to understand aggregate usage of our marketing site and dashboard. These are optional, load only when configured, and do not sell your data. You can block them using your browser's cookie or tracking-protection settings; doing so does not affect your ability to log in or use the platform.
Our infrastructure and service providers may process and store data in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect data transferred internationally.
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at privacy@numaclaw.com and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Your continued use after changes constitutes acceptance.
If you have questions about this Privacy Policy, contact us at privacy@numaclaw.com.