Privacy Policy

ClaimBob (claimbob.co.uk) is operated by Anecco LLC, a Wyoming limited liability company, filing ID 2023-001378763, trading as ClaimBob, 30 N Gould St #39553, Sheridan, WY 82801, USA (“we”, “us”). We are the controller of the personal data described in this policy: Anecco LLC, registered with the UK Information Commissioner's Office under registration number ZC274038.

Contact for anything about your personal data: hello@claimbob.co.uk

Our representative in the United Kingdom (Article 27 UK GDPR): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom. People in the United Kingdom can also contact us through our representative at https://app.prighter.com/portal/13142130318.

• We collect what we need to run your account, your checks and your billing.
• Your ads are analysed by AI from our provider Anthropic. Anthropic does not use them to train its models.
• In a team, everyone on the account can see the team's checks and who ran them. Reports you had before joining a team stay private unless you choose to share them.
• We don't sell your data and we don't use it for advertising.
• You can ask us for a copy of your data, to correct it or to delete it at any time.

• Account details: name, email address, company name, sign-in details (a securely hashed password or your Google sign-in), and your team and role.
• Ads and checks: the ad text, images and landing-page addresses you submit (for checks and for a done-for-you audit, including any Meta Ad Library IDs, which we look up in Meta's public Ad Library), the text of those landing pages (we fetch each page to check it), the product details you add, the reports we produce, who on your team ran each check and when, and whether a report is private or shared with your team. For a video ad, this includes the video file, a transcript of what is said in it, the text shown on screen, and up to 12 still frames from it, plus a small still of each flagged moment (up to 12 more). Ads can contain personal data, such as names, photos or voices in a testimonial. Please only submit ads you have the right to share with us.
• Billing: your plan, invoices and refunds, and the details you give Stripe at checkout (your company name, an optional VAT number, your email and billing address, and the card's billing country and postcode), which appear on your invoices. Card payments are handled by Stripe. We never see or store your full card number.
• Messages: emails you send us and records of the service emails we send you.
• Video waitlist: if you ask to hear when video ad checks launch, your email address, the consent you gave (the exact wording, when, and on which page), whether you confirmed it, and a one-way hash of your IP address that we use to stop repeated sign-ups. We never keep the IP address itself.
• ASA checklist and weekly email: if you ask for our checklist, your email address, the consent you gave (the exact wording and when), when you confirmed your address, the campaign tags of the link you came from (utm_source and utm_campaign, if there were any), and a one-way hash of your IP address that we use to stop repeated sign-ups. We never keep the IP address itself.
• Free preview: if you use the free preview, the domain of your email address (for example gmail.com or brand.co.uk), and one-way hashes of your email address, of your IP address, of a random ID kept in a cookie in your browser and, if you signed in with Google, of your Google account ID, so each person, browser and network can only use it a limited number of times. The free preview record never holds your email address, IP address or Google account ID itself.
• Product emails: if you agree to receive product news and tips, the consent you gave (the exact wording, when, and where), and when you withdraw it.
• Visits and sign-up steps: cookieless visit statistics for our public pages (see section 11), and, for your account, which steps of signing up and buying it has taken and when (account created, first check, free preview used, checkout opened, first payment). We use these to see where people stop, not to profile you.
• Technical data: IP address, browser and device type, logs and security records (for example a record of team invitations and removals, billing events from Stripe, and changes our staff make to an account).
• Business contacts: if we contact your company about ClaimBob, we use your name, work email, company and role, and your company's ads. We find them in public sources: your company's website, Companies House (the names of directors), email addresses openly published on LinkedIn profiles, and your company's ads in the Meta Ad Library.

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details.

When you run a check, the content you submit, and the text of the landing page we fetch, is processed by our checking service and sent to Anthropic, which provides the AI models that analyse it. Anthropic processes it on our behalf and does not use it to train its models. Under Anthropic's terms for its commercial services, it deletes this content within 30 days, except where it needs to keep it longer to enforce its usage policies or by law. That period is set by Anthropic's terms, not by us.

Video ads. When you check a video ad, our checking service takes the sound from the video and sends it to Deepgram, which turns the speech into text. Deepgram processes it on our behalf, in the EU (EEA) and only in memory: it does not store your audio or use it to train its models. The transcript, the text shown on screen and still frames from the video are then sent to Anthropic for the analysis, as for any other ad.

Findings are automated suggestions to help you meet advertising rules. They are not decisions with legal or similarly significant effects on anyone. A done-for-you audit is also reviewed by a person.

Service providers that process data on our behalf, under contracts that protect it:

• Vercel Inc. – website hosting, the servers that run checks, and cookieless visit statistics for our public pages (United States; our servers run in London)
• Supabase Inc. – database, file storage and sign-in (data stored in London, United Kingdom)
• Anthropic PBC – AI analysis, and AI tools we use to find business contacts and write emails to them (United States)
• Deepgram, Inc. – speech-to-text for video ads: the sound of the video (processed in the EU (EEA), only in memory; not stored or used for training). Deepgram, Inc. is a US company; any transfer of personal data is covered by the UK Addendum to the EU Standard Contractual Clauses.
• Stripe – payments, refunds and invoices (United States)
• Resend – service emails, including sign-in emails, the video waitlist emails, the ASA checklist and weekly emails (Resend also keeps the list of people who get the weekly email), and product emails if you agreed to them (United States; our emails are sent from its Ireland region)
• Google – our business email, and Google sign-in if you choose it (United States)
• Prighter Ltd – our representative in the United Kingdom: it receives requests from the ICO and from people in the UK and passes them on to us (United Kingdom; requests sent through its portal are stored with Hetzner, in a data centre in the EU)

Within your team: the account owner and every member can see each team check, who ran it and when. Reports a member had before joining stay private to them unless they choose to share them. Only the account owner can see payments and invoices.

Our staff: a small number of authorised ClaimBob staff can access accounts, checks and reports where needed to give support, keep the service secure and handle billing.

We may also share data with professional advisers, with authorities where the law requires it, or with a buyer if our business is sold. We do not sell personal data.

We are based in the United States, and most of our providers process data there. When personal data from the UK is handled outside the UK, we rely on one of these safeguards: the provider's certification under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards.

• Account and checks: while your account is open. When an account is closed, we delete its data within 90 days, apart from what we must keep by law.
• Video files: the video you upload is deleted right after its check, as soon as the check is finished, and also when it fails or is cancelled. The report keeps the findings, their timestamps, the transcript, the text shown on screen and up to 12 still frames, plus a small still of each flagged moment (up to 12 more), for as long as the report itself (see “Account and checks” above).
• Leaving a team: checks you ran inside the team stay with the team account, showing your name, for as long as that account keeps them. Reports you had before joining go with you.
• Billing records: as long as tax law requires, normally six years. Records of discount offers taken (including the card fingerprint) are kept with them.
• Security logs: 12 months, also after an account has been deleted. They include the record that an account was closed, with the email address of the person who closed it, which helps us prevent misuse of the founding discount and other offers. Records of the service emails we send are kept for 12 months too.
• Business contacts: up to two years after our last contact, or sooner if you ask.
• Video waitlist: until you unsubscribe. A sign-up that is never confirmed is deleted after 30 days. After you unsubscribe we keep the record of it for 12 months, so we can show we stopped.
• ASA checklist and weekly email: until you unsubscribe. When you do, we take you off the list at Resend straight away and delete your details within 30 days. A sign-up that is never confirmed is deleted after 30 days.
• Sign-up steps: while your account is open. When it is deleted, we keep only a count of the steps, with nothing that identifies the account or you.
• Free preview: the record that a free preview was used (the email domain and the hashes) for 12 months, also after an account has been deleted.
• Product emails: your consent until you withdraw it. After that we keep the record of it for 12 months, so we can show we stopped.
• AI provider: under Anthropic's terms, Anthropic deletes submitted content within 30 days (see section 5).
• Speech-to-text provider: Deepgram does not keep your audio to improve its models. It processes the audio in the EU (EEA), only in memory, and does not store it.

You have the right to:

• get a copy of your data
• have it corrected
• have it deleted
• restrict how we use it
• object to our use of it, including an absolute right to object to direct marketing
• receive it in a portable format
• withdraw consent where we rely on consent

Email hello@claimbob.co.uk. We reply within one month, and it is normally free.

If your request concerns team checks on a team account, we may need to involve the account owner, because the account belongs to their organisation.

If you are unhappy with how we handle your personal data, please contact us first at hello@claimbob.co.uk. We will confirm we have received your complaint within 30 days, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113. If you are in the European Economic Area, you can also complain to your local data protection authority.

We only use cookies that are strictly necessary to keep you signed in and to protect the service. We do not use advertising, analytics or tracking cookies, and the site loads nothing from other companies' servers while you browse it. If that changes, we will update this policy and ask for your consent where the law requires it.

Visit statistics without cookies: on our public pages (not in the app), we count visits with Vercel Web Analytics. It sets no cookies and stores nothing on your device. It records the page, the site you came from, your country and the type of device and browser, and tells a returning visitor apart only within the same day, by a short-lived value worked out from the request that is not kept. We see totals, not individual visitors.

• Sign-in cookies (named sb-…-auth-token), set when you sign in, keep you signed in. They last 30 days and are renewed each time you use ClaimBob, so after 30 days without a visit you sign in again. Signing out removes them. While you sign in with Google, a short-lived cookie also protects that step.
• Free preview cookie (named cb_bid), set when you start a free preview, holds a random ID so the free preview cannot be used again from the same browser. It lasts 12 months. We keep only a one-way hash of it.
• Your light or dark theme, if you choose one, is remembered in your browser's local storage (not a cookie). It is not sent to us.
• Payment pages are run by Stripe on its own site, which sets its own cookies to take payment and prevent fraud.

Data is encrypted in transit. Each customer account is kept separate in our database through access rules, private reports are only visible to the person who created them (and to authorised staff where needed, see section 6), and access to systems is limited to those who need it. Staff access to our admin tools requires two-factor sign-in.

ClaimBob is a service for businesses and is not intended for anyone under 18.

We will post any changes here and update the date above. If a change is significant, we will email account owners before it takes effect. See also our Terms of Service.