LEGAL
Privacy Policy.
Effective date: 10 May 2026
Last updated: 10 May 2026
This Privacy Policy explains how Clarra collects, uses, stores, protects, and shares your personal data when you access clarra.co or use any of our services. It applies to all users regardless of location, including users in the European Union, the United States, and all other jurisdictions. By creating an account or placing an order, you confirm that you have read and understood this Privacy Policy.
Contact for all privacy matters: support@clarra.co
1. Who We Are
Clarra is a studioless AI portrait service operating at clarra.co. We generate professional-quality portrait images using artificial intelligence trained on reference photos you upload. We do not operate a physical studio. All portraits are AI-generated and are not real photographs.
Under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Clarra acts as the Data Controller in respect of personal data you provide to us directly. Where we engage third-party services to process data on our behalf, those parties act as Data Processors under binding Data Processing Agreements.
2. The Data We Collect
2.1 Data you provide directly
| Data category | Examples | Purpose |
|---|---|---|
| Account data | Full name, email address, password (hashed) | Account creation and authentication |
| Reference photographs | 3 face photos, 3 full-body photos per order | AI model training and portrait generation |
| Order data | Package selected, status, delivery timestamps | Service delivery and support |
| Communications | Emails and support messages you send us | Customer support and legal records |
| Payment metadata | Transaction ID, amount, currency | Order processing and financial compliance |
We do not store your payment card number, CVV, or full card details. All payment data is handled exclusively by our third-party payment processor.
2.2 Data collected automatically
| Data category | Examples | Purpose |
|---|---|---|
| Usage data | Pages visited, features used, session duration | Platform improvement and analytics |
| Device and browser data | Browser type, operating system, screen resolution | Technical compatibility and security |
| Network data | IP address, approximate geographic location | Security, fraud prevention, legal compliance |
| Cookie data | Session, analytics and preference cookies | See Section 9 |
2.3 Special category data — your photographs
Under GDPR Article 9, photographs processed to identify a natural person constitute biometric data — a special category of personal data requiring heightened protection. Your uploaded reference photos are used to build a personalised AI portrait model unique to you. This constitutes special category data processing.
We process this data exclusively on the basis of your explicit consent, given at the point of upload via a clearly presented consent checkbox. You may withdraw this consent at any time by contacting support@clarra.co. Withdrawal after your order has entered processing does not entitle you to a refund, as AI credits and processing costs are committed immediately upon order initiation — see our Terms and Conditions for the full no-refund policy.
We do not use your uploaded photographs to train public AI models. We do not sell them to third parties. We do not use them for any purpose other than generating your ordered portrait gallery.
3. How We Use Your Data
| Purpose | Legal basis (GDPR) | US equivalent |
|---|---|---|
| Account creation and management | Contract performance — Art. 6(1)(b) | Contractual necessity |
| Delivering your portrait gallery | Contract performance — Art. 6(1)(b) | Contractual necessity |
| Processing payment | Contract performance — Art. 6(1)(b) | Contractual necessity |
| AI model training on your photos | Explicit consent — Art. 6(1)(a) + Art. 9(2)(a) | Informed written consent |
| Order status notifications | Contract performance — Art. 6(1)(b) | Contractual necessity |
| Fraud prevention and security | Legitimate interests — Art. 6(1)(f) | Legitimate business interest |
| Platform analytics and improvement | Legitimate interests — Art. 6(1)(f) | Legitimate business interest |
| Marketing communications | Consent — Art. 6(1)(a) | Opt-in consent |
| Financial record-keeping | Legal obligation — Art. 6(1)(c) | Legal obligation |
| Responding to legal requests | Legal obligation — Art. 6(1)(c) | Legal obligation |
We will never use your data for purposes incompatible with those listed above without obtaining fresh consent or establishing a new lawful basis.
4. How Your Photos Are Processed — Step by Step
Understanding exactly what happens to your uploaded photos is important to us.
Upload and secure storage.
When you upload your 6 reference photos, they are transmitted to Clarra's secure storage environment over encrypted connections (TLS 1.2 or higher). Files are stored in a private, access-controlled bucket visible only to your account and to authorised processing systems.
AI processing.
Your photos are transmitted securely to one or more third-party AI image-generation providers, which may vary by order depending on the style and package you choose. Depending on the tool used, this may involve training a personalised portrait model on your photos, or processing your photos directly to generate images. In every case the data is used exclusively to produce your portrait gallery. Within 30 days of delivery, Clarra manually reviews each order and deletes your photos and any derived model or copies held by those providers. You may request earlier deletion at any time.
Portrait generation.
The AI provider generates your portrait images using our professionally designed studio prompts. Generated images are returned to Clarra's secure storage and made available in your private dashboard gallery.
Manual quality review.
A Clarra team member reviews all generated images before they are released to your gallery. This is part of our quality assurance process and is one of the reasons all purchases are non-refundable — real human review time is committed to every order before delivery.
Delivery and deletion.
Your gallery is delivered to your private dashboard. Your uploaded reference photos, any copies held by the AI providers used for your order, and the delivered gallery itself are all deleted within 30 days of delivery through our manual review-and-deletion process. Generated gallery images remain accessible for 30 days after delivery, after which they are permanently deleted unless you have downloaded them.
5. Data Retention Schedule
| Data type | Retention period | Reason |
|---|---|---|
| Uploaded reference photos | Deleted within 30 days of delivery (manual process) | Biometric data minimisation |
| Copies held by AI image-generation providers, including any model trained on your photos | Deleted within 30 days of delivery (manual process) | Biometric data minimisation |
| Generated gallery images | Deleted within 30 days of delivery (manual process) | Standard service access window |
| Account profile data | Duration of account + 30 days after deletion | Contract performance |
| Order records | 5 years | Tax and legal compliance |
| Payment records | 7 years | Financial regulatory obligation |
| Support communications | 3 years | Legitimate interests / legal claims |
| Marketing consent records | Until consent withdrawn + 1 year | Proof of lawful processing |
| Server logs | 30 days | Security and fraud prevention |
You may request early deletion of your uploaded photos, and of any copies or models held by the AI providers used for your order, at any time by emailing support@clarra.co. Requests are processed within 5 business days.
6. Data Sharing and Third-Party Processors
We do not sell your personal data. We do not share your data with advertisers. We share data only with the following categories of processors who are contractually bound to process it solely on our instructions and in accordance with applicable data protection law:
| Processor category | Role | Data shared | Safeguard |
|---|---|---|---|
| AI image-generation providers (which may vary by order) | Generating your portraits — by training a personalised model on your photos and/or processing your photos directly | Reference photos, generated images, order reference | Standard Contractual Clauses |
| Payment processor | Secure payment processing | Payment metadata, transaction data | EU-US Data Privacy Framework or SCCs |
| Cloud infrastructure provider | Database, authentication, file storage | Account data, order data, files | Standard Contractual Clauses |
| Analytics provider | Usage analytics to improve the platform | Anonymised usage data, IP address | Anonymisation + SCCs |
| Advertising measurement provider | Measuring ad campaign performance | Anonymised purchase events | SCCs + consent |
We maintain an up-to-date internal register of all processors. You may request information about the categories of processors we use at any time by emailing support@clarra.co. We will notify you if we change processors in a way that materially affects how your data is handled. We may also disclose your data without consent where required by law, court order, or to protect the rights and safety of Clarra or its users.
7. International Data Transfers
Clarra is based in the Republic of Latvia and operates under EU law. Where your data is transferred outside the European Economic Area — for example to AI infrastructure or payment processing services operating in the United States or other third countries — we ensure such transfers are protected by one or more of the following:
- Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46(2)(c).
- EU-US Data Privacy Framework certification where applicable.
- Adequacy decisions made by the European Commission where applicable.
You may request details of the specific safeguards applied to your data by emailing support@clarra.co.
8. Your Rights
8.1 EU and EEA users — GDPR rights
Right of access (Article 15)
Request a copy of all personal data we hold about you, including how it is processed and with whom it is shared.
Right to rectification (Article 16)
Request correction of any inaccurate or incomplete personal data.
Right to erasure — "right to be forgotten" (Article 17)
Request deletion of your personal data. We comply unless we are legally required to retain it.
Right to restrict processing (Article 18)
Request that we limit how we use your data — for example, while you contest its accuracy.
Right to data portability (Article 20)
Request your data in a structured, machine-readable format to transfer to another service.
Right to object (Article 21)
Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
Right to withdraw consent (Article 7(3))
Where processing is based on consent — including the processing of your reference photographs as special category data — you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not entitle you to a refund where order processing has already commenced.
Right not to be subject to solely automated decision-making (Article 22)
Clarra does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
To exercise any GDPR right, email support@clarra.co with the subject line "GDPR Rights Request". We will respond within 30 days. If you are unsatisfied, you have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) at www.dvi.gov.lv, or with the data protection authority in your country of residence.
8.2 California residents — CCPA / CPRA rights
Right to know
Request disclosure of the categories and specific pieces of personal information collected about you in the past 12 months, including sources, purposes, and recipients.
Right to delete
Request deletion of personal information we have collected, subject to legal exceptions.
Right to correct
Request correction of inaccurate personal information.
Right to opt out of sale or sharing
Clarra does not sell or share your personal information for cross-context behavioural advertising.
Right to limit use of sensitive personal information
You may request that we limit use of sensitive personal information — including photographs processed as biometric data — to what is strictly necessary to deliver the service.
Right to non-discrimination
We will not discriminate against you for exercising any CCPA rights.
To exercise your California rights, email support@clarra.co with the subject line "California Privacy Request". We will respond within 45 days.
8.3 Illinois residents — BIPA
If you are a resident of Illinois, the Illinois Biometric Information Privacy Act (BIPA) may apply to your reference photographs. Under BIPA, Clarra commits to:
- Obtaining your informed written consent before processing biometric data.
- Never selling, leasing, trading, or profiting from your biometric data.
- Not disclosing biometric data except to sub-processors required to deliver the service, under binding data protection obligations.
- Retaining biometric data only for as long as necessary and destroying it, including any copies held by our AI providers, within 30 days of delivery.
- Maintaining this publicly available retention schedule.
For BIPA-related enquiries, contact support@clarra.co.
8.4 Other US state privacy rights
Residents of Virginia, Colorado, Connecticut, Texas, and other US states with applicable privacy laws have rights that include access, deletion, correction, opt-out of sale, and non-discrimination. To exercise any of these rights, email support@clarra.co.
9. Cookies and Tracking Technologies
9.1 Cookie types we use
| Cookie type | Purpose | Can you decline? |
|---|---|---|
| Essential cookies | Session management, login, security | No — required for the platform to function |
| Analytics cookies | Understanding how users navigate the platform to improve it | Yes |
| Advertising cookies | Measuring the performance of our advertising campaigns | Yes |
| Preference cookies | Remember display settings and language | Yes |
When you first visit clarra.co, a consent banner will appear. Analytics and advertising cookies only activate after you give explicit consent. You may update your preferences at any time via the "Cookie Preferences" link in the footer.
9.2 Advertising measurement cookies
Where you have consented to advertising cookies, we use third-party advertising measurement tools to understand the effectiveness of our campaigns. These tools collect anonymised event data — such as page visits and purchase completions — linked to anonymised user identifiers. We do not share your name, email address, or photographs with any advertising measurement provider through these tools. If you have declined advertising cookies, these tools will not activate during your session.
10. Data Security
We take the security of your personal data — and particularly your reference photographs — seriously.
Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (100% HTTPS). No data is ever sent over unencrypted connections.
Encryption at rest: All stored data, including uploaded photos and generated images, is encrypted at rest using AES-256 encryption standards.
Access controls: Uploaded photos and generated galleries are stored in private, access-controlled storage buckets. Only your account and authorised processing systems can access your files.
Staff access: A minimum number of authorised Clarra team members can access user data, strictly on a need-to-know basis and only for quality review and support purposes.
Sub-processor security: All processors in our stack are required by contract to maintain equivalent encryption and access control standards.
Breach notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Latvian Data State Inspectorate within 72 hours of becoming aware, and will notify affected users without undue delay as required by GDPR Articles 33 and 34.
11. Children's Privacy
The Clarra platform is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you are between 16 and 18, you must have parental or guardian consent to use our services.
If you believe a person under 16 has provided personal data to Clarra without appropriate consent, please contact support@clarra.co and we will delete that data immediately.
12. No-Refund Policy and Its Relationship to Data Processing
Our no-refund policy is directly connected to how your data is processed. When you complete payment:
- Your reference photos are immediately queued for transmission to our AI infrastructure.
- AI model training credits are committed and billed to Clarra by our AI provider — these costs are non-recoverable once initiated.
- A human quality reviewer is assigned to your order — this is a real, time-committed resource.
Because these processes begin immediately upon payment and the costs are irreversible,
all purchases are final and non-refundable.
Requesting deletion of your data after processing has begun does not entitle you to a refund. You may still request deletion of your photos and any AI-held copies, which will be processed within 5 business days, but the order will not be reversed. Full details are in our Terms and Conditions at clarra.co/terms-of-service.
13. Third-Party Links
The Clarra website may contain links to third-party websites or services. This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party sites you visit. Clarra is not responsible for the privacy practices or content of third-party sites.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. We will notify you of material changes by email at least 14 days before they take effect. The updated policy will also be posted at clarra.co/privacy-policy with an updated "Last updated" date.
If you do not agree to the updated Privacy Policy, you may close your account before the changes take effect by contacting support@clarra.co. Your continued use of the platform after the effective date constitutes acceptance.
15. Contact and Data Subject Requests
For all privacy matters, data subject rights requests, cookie preferences, data deletion requests, security concerns, and general enquiries:
Email: support@clarra.co
Subject line for rights requests: "Privacy Request — [type of request]"
Response time: 30 days for GDPR requests · 45 days for CCPA requests
Website: clarra.co
For unresolved complaints about our data practices:
Latvian Data State Inspectorate (Datu valsts inspekcija)
Website: www.dvi.gov.lv
Email: info@dvi.gov.lv
EU Online Dispute Resolution Platform:
https://ec.europa.eu/consumers/odr
Questions about your data?
For all privacy matters, data subject requests, and security concerns, get in touch with our team.
Latvian Data State Inspectorate (Datu valsts inspekcija) · www.dvi.gov.lv · info@dvi.gov.lv
EU Online Dispute Resolution: ec.europa.eu/consumers/odr