MyClawBots Privacy Policy

We collect information you provide directly when you create an account, set up projects, or contact us. This includes your name, email address, and any API keys or integration credentials you configure.

We also collect usage data automatically, including pages visited, features used, project activity, and technical information such as browser type, IP address, and device identifiers.

When you use the MyClawBots plugin through ChatGPT, Codex, or another MCP client, we receive the inputs that client sends for a requested action, such as an account identifier, post text, search query, comment, or media URL. The connector does not retrieve or reconstruct your full conversation history. Content you choose to include in a tool request is processed to carry out that request.

We store connection records including the app you authorized, approved permissions, selected accounts, consent and last-use times, and the IP address and browser information recorded when you authorize access. We use these records to enforce permissions, display connected apps, and investigate misuse. Publishing records can contain account names, post text, media URLs, platform post identifiers, status, and errors.

We use your information to provide, maintain, and improve our services, including provisioning agent spaces, managing integrations, and delivering chat functionality.

We may also use your information to communicate with you about service updates, security alerts, and promotional content (with your consent where required).

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

We use access controls, HTTPS for public service connections, and encryption for stored social integration credentials. Connector access is authenticated and checked against the permissions and account restrictions you approved. Social platform credentials are used server-side and are not included in social tool responses.

Agent runtimes run in separate cloud environments. Account, connection, and activity records are held in the platform's shared database with access restricted by user and authorization. No method of storage or transmission can be guaranteed completely secure.

Each agent space is a fully isolated environment. Your conversations, configuration, and connected integrations are private to your project.

We do not use your project data, conversations, or prompts to train any AI models.

Removing an agent runtime does not by itself delete your MyClawBots account, shared connection records, activity logs, or content already delivered to a third-party service. See the retention and deletion sections below.

Our service integrates with third-party providers (e.g., OpenAI, Anthropic, GitHub, Meta/Facebook, Instagram) based on your configuration. Your interactions with these services are governed by their respective privacy policies.

We only share the minimum information necessary with third-party services to deliver the functionality you request.

For the social connector, recipients include the connected client provider (for example, OpenAI for ChatGPT or Codex), the social platform involved in your request (Meta for Facebook, Instagram and Threads, LinkedIn, Google/YouTube, TikTok, X, or Pinterest), and infrastructure providers that host and operate MyClawBots. Requested account details, posts, comments, public search results, and analytics are returned to the client so it can respond to you. Text and media you publish are sent to the selected social platform and made available to the audience determined by that platform and your publishing settings.

Each client and social platform handles the information it receives under its own terms and privacy policy. Revoking MyClawBots access does not remove information already received or published by those services. We do not use connector inputs or results to train AI models, sell them, or use them for advertising or unrelated profiling.

MyClawBots supports connected Facebook Pages, Instagram, Threads, LinkedIn profiles and LinkedIn company Pages, YouTube, TikTok, X, and Pinterest accounts. Depending on the platform and permissions, we process profile and account names and identifiers, authorization tokens, posts and captions, images and videos, comments and replies, mentions, and engagement or account metrics. Public Facebook Page and Threads searches also process the search terms and public information returned by those platforms.

Data We Collect From Meta: When you authorize the connection, we receive and store: (a) your Facebook User ID and profile name; (b) a list of Facebook Pages you manage, including Page names and IDs; (c) Page access tokens (encrypted at rest) for publishing on your behalf; (d) linked Instagram Business account IDs and usernames; and (e) a long-lived user token (encrypted at rest) for re-enumerating your Pages if needed.

Data We Collect From LinkedIn: For a personal LinkedIn connection we receive and store your LinkedIn member ID, name and profile photo, and an access token (encrypted at rest) for publishing posts you request as you. For a LinkedIn company Page connection we receive and store your LinkedIn member ID, the IDs, names and logos of the company Pages you administer, and access and, where LinkedIn issues one, refresh tokens (encrypted at rest). We use Page data only to publish posts you request as that Page, read that Page's recent posts, and delete its posts on your request; we do not read your LinkedIn connections, messages, or other members' data, and we do not use LinkedIn data for advertising or profiling.

Data We Collect From Pinterest: When you connect Pinterest we receive and store your Pinterest user ID, username, business name (if you have one), account type, the profile photo shown at connection time, which Pinterest environment the connection was made in, and access and refresh tokens (encrypted at rest). We keep a record of each Pin you publish through MyClawBots: the text you wrote, the image URL, and the Pin ID in our publishing log (the same one used for other platforms), and the board and Pin link in the record of that publish request. Beyond that record, your boards, Pins, and Pinterest analytics are read live from Pinterest each time you ask for them and are not saved to our database; the list of your boards is held briefly in server memory (up to about an hour) to avoid repeat requests. We use Pinterest data only to publish Pins you request, read your own Pins, boards and statistics, and delete your Pins on your request. We never use Pinterest data to train or improve AI or machine-learning models, and we do not sell or share it or use it for advertising or profiling. While MyClawBots has Pinterest Trial access, Pins you publish are created in Pinterest's test environment and are visible only to you.

Data We Access From Google: When you connect Google Workspace you can grant MyClawBots permission to send email on your behalf (gmail.send), create and edit your calendar events (calendar), create and edit Google Docs and Sheets (documents, spreadsheets), read your contacts (contacts.readonly), and use only the Drive files the app creates or you open with it (drive.file). When you connect YouTube you can grant permission to upload videos to your channel (youtube.upload) and read your channel and uploads (youtube.readonly). We cannot read your Gmail inbox. Your AI agent uses this access only to carry out actions you request in chat, and your Google access and refresh tokens are stored encrypted at rest.

Google Limited Use: MyClawBots' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized or foundational AI or machine-learning models; we do not sell it; we do not use it for advertising; and humans do not read it unless you ask us to for support, it is needed for security or to comply with law, or it is aggregated and anonymized for internal operations.

Data We Access From Microsoft: When you connect Outlook (Microsoft 365, Outlook.com or Hotmail) you grant MyClawBots permission to read your mailbox, create and edit drafts, and send email on your behalf (Mail.ReadWrite, Mail.Send), to read your basic profile and email address (User.Read, openid, email), and to keep that access until you disconnect (offline_access). We store your email address and a refresh token, encrypted at rest; your assistant receives only short-lived access tokens, and only when it acts on your request. Your assistant fetches email from Microsoft when it needs it; we do not copy your mailbox into our database. Anything your assistant quotes or summarises in a conversation is kept with that conversation's history. We do not use Microsoft user data to develop, improve or train generalized or foundational AI or machine-learning models, we do not sell it, and we do not use it for advertising. You can disconnect at any time in Settings → Connectors, and revoke access from your Microsoft account at https://account.live.com/consent/Manage (personal accounts) or https://myapps.microsoft.com (work or school accounts).

Email Sent Through Connected Accounts: When you connect Gmail or Outlook, your assistant sends email from your own account only at your direction, one message at a time. MyClawBots has no bulk-email, mail-merge or campaign feature, and does not provide, sell or supply leads, contact lists or email addresses. You may not use MyClawBots to send unsolicited commercial email, bulk email, or email to purchased, rented or scraped contact lists. You may only email people you have an existing relationship with or who have asked to be contacted, and you must honour every request to stop. Every email your assistant sends through Gmail includes an unsubscribe link and standard List-Unsubscribe headers, so the recipient can opt out in one step without replying. When a recipient unsubscribes, MyClawBots records their email address and the date, and blocks any further email from your account to that address, from any of your assistants or connected Gmail accounts. Recipients can also reply to the sender at any time.

How We Use This Data: We use your Facebook and Instagram data to publish supported content, retrieve posts and engagement metrics, read account insights, read and moderate comments, reply to comments, and delete supported content as requested. A connected Facebook account can also authorize public Page searches and comparisons. These actions are subject to the platform's permissions and the access you grant to the connected client.

The social connector uses this data to list accounts, publish supported content, retrieve posts and analytics, manage comments and replies, delete supported content, and research public Pages or Threads content as requested. Available actions differ by platform. Write and destructive tools are labeled for the connected client; the client's permission settings determine how previews and confirmations are presented.

When authorizing a client, you can decline access, reduce its requested permissions for reading, publishing, moderation, or deletion, and limit it to selected social accounts. If you authorize all accounts, the connection also covers accounts you connect later. These controls apply to OAuth connections; a separately created API key has the access described in its settings and is revoked separately.

We do not sell, share, or use your Facebook or Instagram data for advertising, profiling, or any purpose other than providing the social media management features you have explicitly authorized.

Your social media tokens are encrypted using AES-256-GCM encryption at rest and are never exposed in the dashboard UI, logs, or to your AI agent directly. All API calls to Meta are made server-side through our secure proxy.

Instagram Direct Messages: If you turn on DM automation for a connected Instagram professional account, we receive, through Meta's webhooks, the messages, story replies, button taps and (where you have granted comment permission) comments that people send to that account. For each, we store the sender's Instagram-scoped ID and username, the message text, message and comment IDs, the post it relates to, and timestamps. We use this data only to run the automations you set up (for example, sending a link when someone comments a keyword), to show the conversation in your inbox, to let you reply, and to hand messages your automations do not answer to the AI agent you chose.

Email addresses (lead capture): If you turn on an automation's "Ask for their email" step, it asks the person for an email address before sending its message. If they reply with one, we store that address with their contact so you can see it in your inbox and export it as a CSV file. We only store an address the person typed in reply to that question; we never look it up elsewhere. It is deleted with the conversation, when you disconnect the account, or on a verified Meta data-deletion request, like the rest of the contact. You are responsible for how you use the addresses you collect, including any consent your own marketing needs.

Your AI agent and its model provider: When you hand conversations to an agent, the incoming message and the recent conversation are sent to that agent, which runs on your MyClawBots agent space and uses the AI model provider you configured (for example, Anthropic or OpenAI) to draft a reply. In approval mode you review each draft before it is sent; in autopilot it is sent automatically. The agent's first reply to a person says it comes from an AI assistant unless you turn that line off. The agent can only read that conversation and reply once to the message it was given. Your agent space may keep run logs of these conversations until you delete the agent space, and your model provider handles what it receives under its own terms.

Tracked links: Links sent by an automation go through a short myclawbots.ai link so we can count clicks and cancel a pending follow-up once the person has opened it. For each click we record the time, a keyed one-way hash of the IP address (never the address itself), a coarse browser family (for example, "Safari") rather than the full user-agent string, and whether it looks like an automated preview. Click records are deleted after 90 days.

Opt-outs: If someone replies STOP (or a similar word), or you mark them as opted out, we permanently stop all automated, agent and manual messages to them from that Instagram account. To keep honouring that, we keep a suppression record (the account ID, a keyed one-way hash of their Instagram ID, the date and the source) even after the conversation, your connection or your account is deleted. Replying HUMAN pauses the AI for that person.

Messaging limits: We only message people who wrote to the account first. Replies follow Instagram's rules: a DM can only be answered within 24 hours of the person's last message, a comment can receive at most one private reply (within 7 days), and sends are rate-limited per account. We do not sell Instagram message data, use it for advertising or profiling, or use it to train AI models.

Facebook Page Messenger conversations: If you turn on DM automation for a Facebook Page you manage, we receive, through Meta's webhooks, the Messenger messages and button taps people send to that Page and, where you have granted permission to read Page comments, the comments people leave on the Page's own posts. For each, we store the person's Page-scoped ID (and, for a comment, the Facebook ID and name Meta includes with it), the message or comment text, message and comment IDs, the post it relates to, and timestamps. After someone messages the Page or taps one of its buttons, we may fetch their first name, last name and profile picture from Meta so you can recognise them in your inbox. We use this data only to run the automations you set up, to show the conversation in your inbox, to let you reply, and to hand messages your automations do not answer to the AI agent you chose. Tracked links, AI agents and approval drafts work exactly as described above for Instagram.

Messenger rules and opt-outs: We only message people who wrote to the Page or commented on its post. Replies follow Messenger's rules: a message can only be answered within 24 hours of the person's last message, and a comment on the Page's post can receive at most one private reply in Messenger (within 7 days), plus, if you choose, one public reply under the comment. Replying STOP (or a similar word), or being marked opted out by you, stops all automated, agent and manual messages from that Page, and we keep the same suppression record as for Instagram (the Page ID, a keyed one-way hash of the person's Page-scoped ID, the date and the source). One limit to know: Facebook identifies a commenter differently from a Messenger contact and only tells us they are the same person once a private reply has been delivered. So someone who opted out in Messenger and later comments on a Page post, before we have ever linked the two, may receive that comment's single private reply; as soon as Meta links them we record the opt-out on the comment too and send nothing further. We do not sell Messenger or Page comment data, use it for advertising or profiling, or use it to train AI models.

You can disconnect a social account in the dashboard's social account settings. Disconnecting clears its stored access and refresh tokens and deactivates the connection, but preserves the account record and activity history. You can also remove MyClawBots access in the social platform's own settings.

Revoke an OAuth client in Settings → Connected apps to block its next connector request. This does not disconnect the underlying social accounts from MyClawBots, revoke other clients or API keys, delete activity records, or remove published posts. Revoke separately created API keys in Settings → API & MCP Access.

On receiving a verified Meta or Threads data-deletion callback, we delete the matching stored social connection records. This does not delete your entire MyClawBots account or all publishing logs.

To request deletion of your account, social data, connection history, or activity logs, contact contact@myclawbots.ai. We may need to verify ownership before acting. We will process deletion requests within 30 days, subject to applicable legal requirements, and explain any information that must be retained and why. Deletion from MyClawBots does not delete copies held by a connected client or social platform; use that service's controls for those copies.

Instagram Direct Messages: You can delete a single conversation from the Automations inbox; this removes its messages, links, click records, pending follow-ups and any email address the person gave. Disconnecting an Instagram account, or a verified Meta or Instagram data-deletion or deauthorization request, deletes all of that account's DM data: conversations, contacts, automations, links, click records and stored webhook events. Opt-out suppression records are kept so that a person who opted out is not messaged again unless they reply START.

Facebook Page Messenger conversations: The same applies to a Facebook Page. Deleting a conversation removes its messages, links, click records and pending follow-ups; disconnecting the Page, or a verified Meta data-deletion or deauthorization request, deletes all of that Page's DM data. Opt-out suppression records are kept so that a person who opted out is not messaged again unless they reply START.

We use essential cookies to maintain your session and authentication state. These are necessary for the service to function.

We may use analytics cookies to understand how our service is used and to improve the user experience. You can opt out of non-essential cookies through your browser settings.

We retain your account information for as long as your account is active. Project data is retained until you delete the project or your account.

Social account access and refresh tokens remain stored until the connection is disconnected or deleted. Token expiration may stop access earlier; expiration does not itself delete the account record.

Staged media files become eligible for automatic deletion after two hours. Cleanup runs every 15 minutes while the service is running, so files are normally removed within approximately two hours and 15 minutes; outages or cleanup failures can delay removal. Files may be removed earlier and are not permanent storage. A one-time upload link expires after 15 minutes if unused.

Connector authorization codes expire after 60 seconds, access tokens after one hour, and each refresh token after 90 days. Refreshing a connection can issue a replacement token. Revocation disables access before these periods end. These are credential validity periods, not deletion deadlines for stored connection records.

Database records for consent, token history, disconnected accounts, publishing activity, and audit or usage logs currently have no fixed automatic deletion period and may remain indefinitely unless deleted through a verified request or operational cleanup. Revoking a connection or an expired token does not automatically erase these records. Contact us to request deletion; we do not promise a plan-based automatic purge.

You can request deletion of your account and all associated data at any time by contacting us.

Instagram Direct Messages: Raw webhook events are deleted 30 days after they are processed. Tracked-link click records are deleted after 90 days. Conversations, contacts, automations, tracked links and follow-up schedules are kept until you delete the conversation, disconnect the Instagram account, or delete your MyClawBots account. Opt-out suppression records are kept indefinitely, as described above.

Facebook Page Messenger conversations follow the same schedule: raw webhook events (Messenger messages, button taps and Page comments) are deleted 30 days after they are processed, click records after 90 days, and conversations, contacts (including any fetched name and profile picture), automations, tracked links and follow-up schedules are kept until you delete the conversation, disconnect the Page, or delete your MyClawBots account.

You have the right to access, correct, or delete your personal information. You can manage most of this directly through your dashboard settings.

You have the right to export your data in a portable format upon request.

You have the right to revoke any third-party integrations (including Facebook and Instagram) at any time through the dashboard or through the third-party's own settings.

For connector-specific access, choose only the permissions and accounts you need, and revoke a connected app when you no longer use it. Contact contact@myclawbots.ai for access, correction, export, or deletion requests that are not available in the dashboard.

If you are located in the European Economic Area (EEA), you have additional rights under the GDPR, including the right to restrict processing and the right to data portability.

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the effective date.

Your continued use of the service after changes are posted constitutes your acceptance of the updated policy.

MyClawBots is responsible for the data practices described in this policy. For privacy questions or requests, contact contact@myclawbots.ai and identify the account and data involved. Do not include passwords, API keys, or access tokens in your message.

When you upload an image or video for publishing, we temporarily store it and provide a public URL so the selected social platform can fetch it. Anyone with that URL can access the file while it is available; it is not private file storage. Only upload media you intend to share. Removing a staged file does not remove copies already fetched or published elsewhere.

A direct upload sends the file to MyClawBots using a one-time upload link. If your client instead sends an image encoded inside a tool request, the file content also passes through that client's conversation or tool-processing systems. Its retention there is governed by the client's policy. Do not include passwords, API keys, payment-card data, government identifiers, or protected health information in social connector requests or uploaded media.