a. Personal Data we collect about Representatives

• Registration and account information. When you create or access a CLARC Member Account, we collect your name, email address, job title, and organizational affiliation.
• Identity and authorization information. When you register as a Delegation Authority, i.e. the individual formally authorized by a Member Organization to bind the organization in connection with agent registrations, we may collect additional identity verification information as required to fulfill our obligations under applicable law.
• Usage and activity data. We collect records of your activity in the CLARC Member Portal, including agent registrations, credential updates, policy configurations, and audit log access.
• Communications. We keep records of support requests, correspondence, and other communications you have with us.

b. How we use and share Personal Data of Representatives

• Providing the Services. We use your Personal Data to create and maintain your Member Account, process agent registrations, authenticate your identity, and provide you with access to CLARC Services.
• Registry Records. Your name and title as Delegation Authority are included in Registry Records associated with each agent your organization registers. These records are disclosed to Verifiers as part of the verification process.
• Regulatory compliance and fraud prevention. We use your information to comply with applicable laws and regulations, including BSA/AML requirements, OFAC sanctions obligations, and other legal requirements applicable to financial infrastructure providers.
• Communications. We use your contact information to send you service-related notifications, including credential expiry notices, security alerts, and policy updates.

a. Personal Data we collect about Verifiers

• Account and contact information. We collect the legal entity name, contact details for the account administrator, and technical contact information for API integration and support purposes.
• Query logs. We maintain logs of verification queries made by each Verifier, including the agent identifier queried, the timestamp of the query, and the result returned.

b. How we use and share Personal Data of Verifiers

• Providing the Services. We use Verifier account information to manage API access, process verification queries, and return Attestation Data in response to those queries.
• Registry integrity. We use query logs to monitor for patterns that may indicate misuse of the verification API or attempts to enumerate Registry Records.
• Billing. We use query volume data to calculate usage-based fees where applicable under a Verifier's commercial agreement with CLARC.

a. Personal Data we collect about Visitors

• Contact information. If you submit an enquiry, request information, or contact us through the website, we collect the information you provide, which may include your name, email address, and the content of your message.
• Technical data. We automatically collect IP address, browser type, device type, pages visited, time on page, and referral source when you visit our website.

b. How we use and share Personal Data of Visitors

• Responding to enquiries. We use contact information to respond to your messages and follow up on information requests.
• Website operation and improvement. We use technical data to operate, maintain, and improve the website.

2.1 Attestation Records and Registry Disclosures

A fundamental feature of the CLARC Service is the disclosure of Registry Records and Attestation Data to Verifiers. When a Verifier queries the CLARC registry, we return Attestation Data that confirms whether a given AI agent is registered, the scope of its authorization, and the identity of the Member Organization that registered it.

Attestation Data contains Registry Record information including the agent identifier, the Member Organization's membership status, the authorization scopes associated with the agent, and the name and title of the Delegation Authority who authorized the registration. This disclosure is a core function of the CLARC Service and is described in the Member Agreement.

2.2 Service Providers

We share Personal Data with third-party service providers that help us deliver the CLARC Services, including cloud infrastructure providers, identity verification vendors, communication platforms, analytics providers, and privacy-friendly bot-detection and abuse-prevention providers. These service providers are contractually required to use Personal Data only to provide services to us and in accordance with applicable law.

2.3 Legal and Regulatory Disclosure

We may disclose Personal Data where required by applicable law, court order, or governmental authority. We may also disclose Personal Data to protect the rights, property, or safety of CLARC, our Members, Verifiers, or others.

2.4 Corporate Transactions

If CLARC is involved in a merger, acquisition, financing, or sale of all or substantially all of its assets, Personal Data may be transferred as part of that transaction. We will notify affected individuals as required by applicable law.

2.5 No Sale of Personal Data

CLARC does not sell Personal Data to third parties for their own commercial or marketing purposes.

5.1 Security

We implement appropriate technical and organizational security measures designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction.

No security system is impenetrable. While we work to protect your information, we cannot guarantee that our security measures will prevent every unauthorized access to or use of Personal Data.

To help protect our contact form from spam and automated abuse, we use a privacy-friendly bot-detection service (Cloudflare Turnstile). This service does not use tracking cookies and does not collect Personal Data for advertising or cross-site tracking purposes.

5.2 Retention

We make reasonable efforts to provide a level of security appropriate to the risk associated with the processing of your Personal Data.

We encourage you to assist us in protecting your Personal Data. If you hold a CLARC account, you can do so by using a strong, unique password and keeping your account credentials confidential.

We retain your Personal Data for as long as we continue to provide the CLARC Services to you, or for a period in which we may have a legal obligation or legitimate interest to retain it, including to:

• Comply with our legal and regulatory obligations;
• Enable fraud monitoring, detection, and prevention activities; and
• Comply with our tax, accounting, and financial reporting obligations, including when such retention is required by our contractual commitments to Members and Verifiers.

In cases where we keep your Personal Data, we do so in accordance with any limitation periods and record retention obligations that are imposed by applicable law.

8.1 United States — California

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may provide you with additional rights with respect to your Personal Data, including the right to know, delete, correct, and opt out of the sale or sharing of Personal Data. As noted above, CLARC does not sell Personal Data. To exercise your rights under the CCPA/CPRA, please contact us at privacy@clarclabs.com.

8.2 European Economic Area and United Kingdom

If you are located in the EEA or UK, the General Data Protection Regulation (GDPR) or UK GDPR (as applicable) provides you with rights including access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with your local data protection authority. To exercise your rights, contact us at privacy@clarclabs.com.