Privacy Policy

CleverSets is operated by Lysmata Systems, LLC ("Lysmata," "we," "us"). This policy describes what we collect, why, and the rights you have. The short version: we collect what we need to run the service for you, we don't run ads, we don't sell or share your data for anyone else's commercial purposes, and AI processing of your content only happens if you turn it on.

What we collect

• Account info — email address, display name, optional handle.
• Content you upload — photos, videos, documents, notes, contacts, and the metadata attached to them (titles, dates, tags, locations you enter).
• Usage data — pages viewed and actions taken, used for debugging, security, and capacity planning. Never for advertising.
• Device info — browser user agent, IP address, language preference, viewport size for UI fit.
• Billing data — if you subscribe, our payment processor (Stripe) collects your payment details. We receive only the subscription state and a customer reference — we never see or store your full card number.

What we don't do

• No third-party tracking. We don't embed Google Analytics, Facebook Pixel, ad pixels, or equivalent. Our only telemetry is Azure Application Insights, collected through our own first-party endpoint.
• No advertising. We don't sell ads or share your data with advertisers — including against content you publish publicly.
• No selling your data or content. To anyone, for anything.
• No AI training on your content. Your data is not used to train external AI models. AI features run inside our own Azure environment; your content stays within our trust boundary.

How we use what we collect

• Operating the service — storing your content, generating thumbnails and streaming versions, fanning out shares, indexing search, computing your usage against your plan's allowances.
• Legally required scanning — every uploaded image and video is checked against an industry hash-list of known child sexual abuse material (Microsoft PhotoDNA), as US federal law (18 U.S.C. § 2258A) requires. This matching identifies only known, verified illegal material; it does not otherwise analyze private content.
• Public-content safety — content you publish to a public link is additionally scanned by an automated content-safety service for severe hate, sexual, violence, and self-harm content before it goes live.
• AI features (opt-in only) — if you enable AI assistance in Settings, your content may be processed by Azure OpenAI and Azure AI services within our environment to produce things like captions and alt-text, recognized text (OCR), search vectors, organization and planning suggestions, and groupings of similar faces. You can see what was extracted per item, exclude individual items, and turning the feature off deletes the derived data.
• Communicating with you — account email only (verification, password reset, billing receipts, urgent security or policy notices). No marketing email.

Where your data lives

CleverSets runs on Microsoft Azure in the United States. Your content is encrypted in transit and at rest; backups are co-resident in the US.

Who processes data on our behalf

We use a small set of service providers, each bound by data-protection obligations and none of whom may use your data for their own purposes:

• Microsoft Azure — hosting, storage, databases, AI services, and transactional email delivery (Azure Communication Services).
• Stripe — payment processing for subscriptions and one-time purchases.
• Microsoft PhotoDNA service — the legally required CSAM hash-matching described above.

We also disclose data when the law requires it: court orders, subpoenas, and CyberTipline reports to the National Center for Missing & Exploited Children (NCMEC) for CSAM matches. And of course, anything you share or publish is visible to the people (or public) you chose — that's the product working as intended.

Retention

• Account data and content — retained while your account is active; deleted on account closure, subject to the exceptions below.
• CSAM evidence — positive hash-matches are preserved in a restricted-access vault for 90 days as federal law requires, then purged.
• Administrative audit logs — retained while the platform operates; personal-data fields are anonymized when your account is deleted.
• Terms/Privacy acceptance records — retained while your account is active. On deletion, a single anonymized record per accepted version (hashed IP and user agent, version, date) is kept for seven years to evidence consent in case of a dispute, then purged.
• AI-derived data — deleted when you turn AI assistance off, and on account deletion.
• Billing records — retained as tax and accounting law requires.

Your rights

• Access — your content is yours to see, always.
• Correction — edit anything you've uploaded.
• Deletion — delete content individually at any time, or your entire account via support request (self-service account deletion is coming).
• Export — bulk-export your library from Settings.
• AI opt-out — toggle AI assistance off in Settings; derived data is deleted.

We honor these rights for everyone, not just where a specific state statute requires it. Data-subject requests: support@cleversets.com.

Children

CleverSets is not directed to children under 13 and we do not knowingly collect data from them. If we learn we have, we'll delete it.

Account succession

Adult account holders can designate up to three legacy contacts (Settings → Legacy) and choose a disposition — export, memorialize, or delete after a grace period — that controls under applicable digital-assets law (RUFADAA) if you die or become incapacitated. Without a designation, we retain your content and lock the account pending lawful instructions through your estate. Memorialized accounts keep public content visible; private content stays private and is never disclosed.

Breach notification

If a breach affects your personal data, we will notify you and the relevant authorities as applicable law requires, without undue delay.

Changes to this policy

Material changes — anything that changes what we collect, how we use it, or who can see it — require your re-acceptance before you continue making changes to your data; reading your existing content is never blocked. Minor clarifications are announced with a banner. Every prior version remains publicly viewable at its own permanent link.

Contact

Privacy questions, data-subject requests, and RUFADAA-related inquiries: support@cleversets.com.

Effective on publication. Version 2 — supersedes version 1 (effective 2026-06-01).