Privacy policy
Last updated: 30 October 2026
Operator: UAB "Solario projektai"
Company code: 304156786
Address: Subačiaus g. 17-10, LT-01300 Vilnius, Lithuania
Contact: business@claister.com
Who this policy covers
This policy explains personal data processing on claister.com, in the Claister application at app.claister.com, and in our support communications. Claister is a workspace for accounting firms, their team members and their clients.
For account administration, security, website operation and support, the Claister operator is responsible for the processing described here. When an accounting firm puts client information, documents or communications into its workspace, that firm normally determines why the information is processed. Claister processes it to provide the service on the firm's instructions. Ask your accounting firm about its own privacy practices and client records.
Our Data Processing Agreement, at claister.com/dpa, sets out that arrangement with each firm: the firm is the controller of its client data and Claister is its processor.
If you use a client portal
Your accounting firm invited you to its client portal on Claister. The firm decides what is shared with you there and what happens to the documents, messages, requests and payment details in the portal; it is the controller of that information. Claister provides the portal for the firm and processes the information only on the firm's instructions.
To see, correct, export or delete your information in the portal, contact your accounting firm. If you contact us instead, we pass the request to the firm and help it answer. For your own sign-in (your email address, password, two-factor settings and the browsers you are signed in on), Claister is responsible and you can write to business@claister.com.
Information we process
Account information includes your name, email address, phone number, profile information, account identifiers and authentication records. If you choose a password, it is stored as a password hash. If you enable two-factor authentication, we process the authentication and recovery information needed to protect your account.
Workspace information includes the clients, contacts, tasks, deadlines, documents, spreadsheets, text documents, time entries and messages that you or your firm add. It can include personal information about employees and clients. Optional connections, meeting recording and AI features process the information you choose to provide or connect for that feature.
Within the signed-in web app, Claister records coarse feature opens alongside existing audit, workflow and AI-call metadata to understand adoption and support needs. Each open contains a fixed feature name, your signed-in account and workspace IDs, and a server timestamp. It does not contain page URLs, search terms, record IDs, private content or reading time. These optional feature-open events are removed after 180 days by the background worker; Do Not Track and Global Privacy Control disable their collection. Only explicitly authorized internal administrators can read usage aggregates and submitted support reports. Low activity is not treated as proof of confusion, and private content is not sent to an AI model for this analysis.
Technical and security information includes session identifiers, IP addresses, browser or device information, access and audit events, and diagnostic information needed to operate and protect the service. A bug report can include the page, a screenshot and diagnostics you submit. Support messages contain the information you send us.
Sign in with Apple
Sign in with Apple is optional. Apple provides an app-specific account identifier, a verified email address and, on your first authorization, the name you choose to share. Your email may be an Apple private relay address if you choose Hide My Email. We use these details to create or authenticate your Claister account. We do not receive your Apple password or access to iCloud files, Apple Mail, contacts or other Apple account content.
We retain the account identifier and an encrypted Apple refresh token so that we can revoke the Apple authorization when its connection or your Claister account is deleted. We verify Apple's signed identity and account notifications. An Apple consent revocation or account deletion invalidates the affected Claister sessions and clears the reusable Apple token. It does not automatically delete records controlled by an accounting firm.
You can manage Claister's Apple authorization and private email forwarding in your Apple Account settings. Disabling forwarding can prevent Claister account emails from reaching you. You can delete your Claister account in Settings → Security, or contact business@claister.com for help changing your sign-in method. If Apple is your only sign-in method, arrange another way to sign in before revoking its authorization.
Google sign-in
Google sign-in is optional. When you choose it, Google provides your Google account identifier, verified email address, name and profile picture. We use these details to identify you, create or authenticate your Claister account, and display your profile. Google sign-in does not give us your Google password.
Sign-in requests only the OpenID, email and profile permissions. It does not provide access to Gmail messages, Google Drive files, Google Sheets or Google Docs. We do not retain reusable Google access tokens or refresh tokens for this sign-in integration.
If we introduce a feature that connects Google Workspace services, we will explain the feature and its data use, update this policy as needed, and request the relevant permissions separately when you choose to connect it. Basic sign-in does not authorize those future features.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models.
You can remove Claister's Google access in your Google Account's third-party connections settings. Revoking access does not delete your Claister account or your firm's workspace records. Contact us about account deletion; if Google is your only sign-in method, arrange another sign-in method before revoking access.
Google API Services User Data Policy · Manage your Google connections
Why we process information
We process information to provide accounts and workspaces, authenticate people, enforce access permissions, deliver requested communications, store and display the work you save, and answer support requests. We rely on performance of our agreement with you or your firm where processing is necessary to provide the service.
We process security, audit and diagnostic information to protect accounts, prevent abuse, investigate faults and maintain a reliable service. These purposes are our legitimate interests. We may retain or disclose information where required by applicable law or necessary to handle legal claims.
We use the phone number you give when you sign up, or later in Settings, to help with setup and support and to ask how Claister works for you. This is our legitimate interest. You can remove the number in Settings → General at any time, or write to business@claister.com and we will not call you.
Where an optional activity requires consent, you can choose whether to participate and withdraw consent. Withdrawing consent does not affect processing that lawfully took place before withdrawal. You can use email and password instead of Google sign-in. Claister does not make autonomous decisions about people with legal or similarly significant effects; AI suggestions require human review.
Telegram accounts team members connect
A team member can connect their own Telegram account to the firm's workspace. Claister then saves messages only from the chats that person chooses and links to the firm's clients. Telegram gives such a connection access to the whole account, so a work account is recommended.
The firm decides who else in the workspace reads those saved chats and who may send messages from that person's account: the workspace owner sets it in Settings → Telegram (by default only the owner reads them and may write; admins and the client's team see them only if the owner turns that on), and a chat can be shared with a named colleague. Claister shows on every message a colleague sent from someone else's account who sent it. The team member is told this before connecting, and the firm is responsible for its own rules on using its team members' accounts. Removing a chat or disconnecting the account stops saving new messages; what was already saved stays in the firm's workspace until the firm deletes it. The same people may read the email a team member's connected mailbox receives from the firm's clients, without sending from it; other email stays the team member's own. Who opened a colleague's chats or client email is recorded for a year.
AI features
Claister's AI features help with drafting, reading documents, sorting messages, transcribing voice messages, searching the web and answering questions about the workspace. A firm can turn them off for its whole workspace in Settings, and it chooses whether they are on when it creates the workspace.
When a person uses an AI feature, Claister sends the provider only the information that feature needs and that the person is allowed to see. Requests to OpenAI are made with storage turned off, and under OpenAI's API terms the information is not used to train its models. To read a scanned document or photo, Claister sends Mistral AI the file's contents without its name, and keeps the text it reads with the document until the document is deleted. AI output is a suggestion: a person confirms before anything is sent to a client, saved as a record or changed. Claister does not make decisions about people by automated means that have legal or similarly significant effects.
Claister keeps a log of AI calls (the feature, the model, the time and the cost, without the content) for 365 days, and assistant chats for 180 days after their last activity.
Storage, security and transfers outside the EU
Claister's application, databases, files and backups are hosted in the European Union. Access to workspace records and files is checked on the server for every request. Authentication, permission controls, encryption in transit and private storage protect information. No service can guarantee absolute security.
Some providers are based in the United States: Resend for email, and, when AI is on, OpenAI, Vercel, Boat and Firecrawl. When information goes to them, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the European Commission's standard contractual clauses. Railway's support staff may reach the hosted systems from the United States under standard contractual clauses. Cloudflare keeps the encrypted backup copies in the EU and cannot read them. The sub-processors page shows the safeguard for each provider; contact us for a copy of a provider's terms.
How long information is kept
A firm's own records (clients, tasks, documents, requests, messages, time, meetings, papers and workbooks) stay until the firm deletes them or closes its workspace, because accounting records often have to be kept for years. The firm decides how long it keeps them. A document the firm deletes waits 30 days in its archive, where the firm can restore it, and is then deleted with its file.
Information that exists only to run the service is removed on a schedule:
- Email bodies: emptied 30 days after sending. The recipient, subject and delivery status stay as the delivery record.
- Expired sign-in and verification codes: deleted one day after they expire.
- Sessions: deleted when they expire. The IP address on a session is cleared after 30 days.
- Records of the browsers you sign in on: activity after 90 days, and a browser 180 days after its last use.
- Screenshots attached to bug reports: deleted after 90 days. The report text stays.
- Home feed suggestions: 30 days after a suggestion is closed, its text, which can quote a client's message, is removed. What was decided about it stays.
- Assistant chats: deleted 180 days after their last activity. The log of AI calls, without content, is kept for 365 days.
- Website analytics and in-app feature-open events: 180 days. The link between an account and the website visits before it: while the account exists.
- Meeting recordings held by Recall: deleted once Claister has its own copy of the recording, transcript and attendees.
- Backups: database snapshots are kept for up to 89 days. A backup copy of a deleted file is removed 60 days after the file leaves Claister.
Deleting an account or a workspace
You can delete your own account in Settings → Security. That removes your sign-in, profile, assistant chats, recorded meetings, and the workbooks and papers you own. Work you did for a firm, such as tasks, comments and documents, stays with that firm as its record, under the name "Deleted user".
A workspace owner can download everything in the workspace as one file and close the workspace in Settings → General. The workspace and all of its records and files are deleted 30 days after it is closed; until then an owner can cancel. Copies in backups expire on the schedule above.
Your choices and rights
Depending on the applicable law and circumstances, you can request access to your personal information, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You can withdraw consent where consent is the basis. We may need to verify your identity before responding.
You can export a workspace or delete your account yourself, as described above. Send other requests about your Claister account, website use or support communications to business@claister.com. For client records controlled by your accounting firm, contact that firm; we can assist it under the service arrangement. You can also complain to your local data protection authority, including Lithuania's State Data Protection Inspectorate at vdai.lrv.lt.
Changes and contact
We will update this policy when the service or its data processing changes. The date at the top identifies this version. A material new use of information or new Google Workspace permission will be explained before the relevant feature is enabled. Contact business@claister.com with privacy questions.
Terms of Service · Data Processing Agreement · Sub-processors · Privacy policy