Privacy Policy

High Level Claw (gohighclaw.app)
Effective date: 2026-09-18
Last updated: 2026-10-30
Controller for platform data: Open Claw Assistance LLC, 30 N Gould St #21315, Sheridan, WY 82801, USA, support@openclawassistance.com

Capitalized terms have the meanings given in the Terms of Service.

1. Scope and roles

This policy covers gohighclaw.app, app.gohighclaw.app, the High Level Claw application, our APIs and MCP endpoint, and the Tenant Sites, booking pages, signing pages, and forms we host for Customers. It explains what we collect, why, who we share it with, how long we keep it, and the choices you have.

We act in two roles:

• We are the controller (or "business" under California law) for information about Customers and their Authorized Users: account, billing, support, security, and usage data. Sections 2 to 12 describe that processing.
• We are a processor (or "service provider") for information about a Customer's Contacts: leads, callers, texters, email recipients, signers, and visitors to that Customer's Tenant Sites. The Customer decides why and how that information is used. Section 13 explains what this means for Contacts. Our Data Processing Addendum governs that processing for Customers.

2. Information we collect about Customers and Authorized Users

• Account data. Name, email address, and profile image, handled through our authentication provider. If you sign in with Google, we receive your name, email, and avatar from Google; we never see your password. Organization name, role, timezone, and settings.
• Business registration data. Legal business name, business address, EIN or other registration number, website, industry, and an authorized contact's name, email, and phone, collected to register your business for 10DLC messaging and, where applicable, for Stripe Connect onboarding.
• Billing data. Plan, subscription status, invoices, Credits purchases, and Credits receipts through Stripe. Card numbers are entered on Stripe's pages and never touch our servers.
• Business Blueprint data. Information about your business gathered from links you give us (your website, listing, social pages) and public sources (Google Places, Yelp, and the open web) during onboarding, plus your edits.
• Customer Content. Everything you create or connect in the Service. This includes Contact records, messages, call recordings and transcripts, documents, websites, ads, social posts, contracts, invoices, and automations. Much of this is Contact data for which you are the controller.
• Connected Services data. OAuth tokens and Customer Keys you connect, stored encrypted, plus the metadata each connection needs (for example the Gmail address you send from, the calendars you selected, your Stripe Connect account id, and your connected social profile names).
• Usage and diagnostics. Logs, feature usage counts, AI action receipts, Credits receipts, audit records, device and browser information, IP address, and error reports.
• Support communications. Emails, chat messages with the assistant, and anything you send to support.

3. How we use information

We use the information above to:

• provide, operate, secure, and support the Service and your Organizations;
• register and operate Telecom Services for your business, including 10DLC brand and campaign registration;
• run AI features on your instructions, including sending prompts derived from your Customer Content to the AI provider you selected or, for platform-funded tasks, to our AI providers;
• bill subscriptions, Credits, and Pass-Through Charges, and keep the receipts and statements the law and our accountants require;
• detect, prevent, and investigate fraud, abuse, spam, security incidents, and violations of our policies, including carrier and registry compliance reviews;
• send service messages (receipts, security notices, low-balance and approval notices, and product updates you can opt out of);
• comply with law, respond to lawful requests, and enforce our agreements; and
• understand aggregate usage so we can improve the Service. We do not use Customer Content or Output to train our own AI models, and we do not sell personal information.

4. Google user data and the Limited Use disclosure

When you connect Google to the Service, we request only the scopes each feature needs and use the data only for that feature:

• Gmail (send-only scope). Used only to send email messages that you or your Automations compose from your Gmail address. We do not request or use scopes that read, search, modify, or delete your inbox, and we do not access your contacts through Gmail. Replies to automated email are routed to a platform inbound address that you set as the reply-to; the reply is not read from your Gmail.
• Google Calendar. Used to read availability and to create, update, and cancel appointments for bookings, with Google Meet links where you choose them.
• Google Business Profile (when available). Used to read your listing and reviews and to post updates you approve.
• Google Sign-In. Used for authentication only.

High Level Claw's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we only use Google user data to provide or improve the user-facing features you connected; we do not transfer it to others except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; and we do not allow humans to read it except with your consent, for security or abuse investigations, to comply with law, or for internal operations on aggregated and anonymized data. We do not use Google user data to develop, improve, or train generalized AI or machine learning models. You can revoke access at any time in Settings or at myaccount.google.com/permissions, and we delete the related tokens when you disconnect.

Calendar-derived data and AI scheduling. Available times calculated using Google Calendar, booking confirmations, saved offered times and subsequent scheduling history remain Google-derived data, even when summarized or aggregated. User-facing scheduling may send this information to Google Gemini for the AI Receptionist, OpenRouter and its specifically reviewed model-hosting providers for text scheduling, and ElevenLabs when optional speech is selected. The selected destinations must have documented terms and settings excluding generalized model training, and the sharing requires separate consent. Connecting Calendar or saving an AI key alone does not establish either requirement. If those requirements have not been established, AI scheduling is unavailable; the Calendar connection and manual booking remain available. No provider is treated as eligible merely because it accepts a key, charges a fee, or describes its service as an API. No-training restrictions are distinct from zero data retention.

These restrictions apply to platform-funded and customer-key processing, including saved scheduling derivatives. Disconnecting Google deletes its connection tokens but does not automatically delete existing appointments or conversation records; use the data-deletion controls in Section 11 to remove those records. Existing derivatives remain subject to the same restrictions. We do not operate a self-hosted or offline version of these third-party models.

5. Who we share information with

We share information only with the processors that run the Service, each of which receives only what its function requires. Our current subprocessors are:

Providers you connect yourself with Customer Keys or your own accounts (for example your Anthropic, OpenAI, Google Gemini, KIE, HeyGen, ElevenLabs, Twilio, Resend, or Zernio accounts) are your processors, not ours; your contract with each provider governs their handling of your data. We will announce changes to this list in the Service at least 15 days before a new subprocessor processes Contact data, as the Data Processing Addendum describes.

We may also disclose information: to comply with law, subpoenas, or government requests; to our carrier, The Campaign Registry, and wireless carriers as required for messaging compliance and complaint investigation; to protect the rights, safety, and property of Customers, Contacts, the public, or us; to professional advisors under confidentiality; and to a successor in a merger, acquisition, or asset sale, with notice to you.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

6. Cookies and similar technologies

We use cookies for authentication, security, and preferences, and a first-party referral cookie for up to 30 days to credit referrals. We do not run third-party advertising trackers on the Service. The Cookie Policy lists each cookie. Tenant Sites may set cookies under the Customer's own policy.

7. AI processing

Prompts derived from your Customer Content (for example your Business Blueprint, a Contact's message, a call transcript, or a document) are sent to an AI provider to produce Output. Customer-key and platform-funded requests are subject to the applicable provider account terms and settings; those conditions differ by provider and service tier. Google-derived data has the additional restrictions in Section 4, which a Customer Key does not waive. We keep receipts (task, model, token counts, cost, and stop reason) for billing and debugging, and non-content privacy-review and routing identifiers for covered AI requests. We do not train our own models on your data. The AI Disclosure and Fair Use Notice explains more.

8. Call recordings, transcripts, and messages

The AI Receptionist records and transcribes calls to produce call records, summaries, and voicemail for your Inbox. Texting stores every inbound and outbound message, delivery status, and STOP, HELP, and START events in a consent ledger. These are Customer Content and Contact data. Before a call is recorded, the Receptionist says that the call may be recorded, and a caller can opt out by pressing 2, in which case nothing from that call is kept. Recordings and their transcripts are stored encrypted for 60 days from the time they are saved and are then deleted automatically; the call's summary and the record that the call happened remain until you delete the record or your Organization closes. If you connect Google Drive to your Organization, each recording and transcript is also copied into your own Google Drive, where it is yours to keep or delete under your Google account's terms; we never delete those copies. You can turn recording off in Receptionist settings.

9. Retention

We may keep information longer when a legal hold, investigation, or dispute requires it.

10. Security

Traffic is served over HTTPS. Data is encrypted at rest by our database and storage providers. Customer Keys and OAuth tokens are encrypted with AES-256-GCM with keys held in platform environment secrets, and are deleted when you remove the connection. Every tenant record carries an organization id and every query is scoped to it. Webhooks verify signatures. Public routes are rate limited. Each Organization has a tamper-evident audit chain. We use monitoring, health checks, and access controls, and we test the platform before releases. No system is perfectly secure; report concerns to support@openclawassistance.com.

11. Your rights and choices

• Access, correct, export, delete. From Settings you can edit your profile, export Customer Content, disconnect any Connected Service, remove any Customer Key, and delete an Organization or your Account. You can also email support@openclawassistance.com; we act on verified requests within 30 days (45 days where the law allows and we tell you).
• Marketing email. Opt out through the unsubscribe link or in Settings. Service and security notices continue while you have an Account.
• Do Not Track and Global Privacy Control. We treat a Global Privacy Control signal as an opt-out of any sale or sharing, which we do not do, and we do not set referral cookies when we receive it.
• Authorized agents. Where the law allows, an agent may submit a request for you if we can verify their authority.
• No discrimination. We will not treat you differently for exercising a privacy right.
• Appeals. If we deny a request, you may appeal by replying to our decision; we will respond within 45 days.

11.1 California (CCPA/CPRA) and other US state laws

In the last 12 months we collected the categories in Section 2 (identifiers, commercial information, internet activity, professional information, audio from calls, and inferences drawn to build your Business Blueprint) from you, your devices, your connected accounts, and public sources, for the purposes in Section 3, and disclosed them to the service providers in Section 5. We do not sell or share personal information, we have no actual knowledge that we sell or share the personal information of anyone under 16, and we do not use sensitive personal information to infer characteristics. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may exercise the rights in Section 11 by email or in Settings.

11.2 European Economic Area, United Kingdom, and Switzerland

If you are in these regions, our legal bases are: performance of our contract with you (providing the Service and billing); our legitimate interests (security, fraud prevention, product improvement, and business communications), balanced against your rights; consent, where we ask for it (for example optional marketing); and legal obligation. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent, by contacting support@openclawassistance.com. You may lodge a complaint with your supervisory authority. We are established in the United States; transfers from these regions rely on the Standard Contractual Clauses (and the UK Addendum) in our Data Processing Addendum, and on the Data Privacy Framework where a provider is certified.

12. Children

The Service is for businesses and adults 18 and over. We do not knowingly collect information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

13. If you are a Contact of one of our Customers

If a business that uses High Level Claw has your information (because you called, texted, emailed, booked, signed, filled out a form, or visited its website), that business is responsible for how your information is used. We process it on that business's instructions to run its phone line, texting, email, website, bookings, contracts, and CRM. To exercise your rights, contact the business directly. If you cannot reach it, email support@openclawassistance.com with the business name and we will forward your request or help you route it. You can stop text messages from any business on the Service by replying STOP, and you can ask a business to stop calling you or to delete your record at any time.

14. International transfers

We operate from the United States, and our subprocessors are primarily in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States and in the countries where our subprocessors operate.

15. Changes and contact

We will update this policy as the Service evolves and change the date above. Material changes will be announced in the Service or by email before they take effect. Contact: support@openclawassistance.com, or Open Claw Assistance LLC, 30 N Gould St #21315, Sheridan, WY 82801, USA. Phone: (888) 996-6158.