Privacy policy

Last updated: October 14, 2026

This policy explains how Clamor (clamor.dev) collects, uses and protects personal data. Clamor reads a website's Google Search Console data, plans and writes blog posts for it, and publishes them to the site's Framer CMS.

Short version. We collect only what we need to run Clamor for you. We do not sell your data, we do not use it for advertising, and we do not use your Google data to train AI models. Email tommy@clamor.dev to access or delete your data at any time.

Who we are

Clamor is operated by Tommaso De Rossi, an individual based in Italy ("Clamor", "we", "us"). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller of the personal data described in this policy.

Contact for all privacy questions and requests: tommy@clamor.dev.

Data we collect

When you sign in with Google, Google shares your name, email address and profile picture with us, together with an account identifier. We use only the basic openid, email and profile scopes for sign-in.

Google Search Console data

When you connect Search Console for a site, you grant Clamor read-only access through Google's consent screen. We then read, for the properties you connect:

the list of Search Console properties you can access,
search analytics: queries, pages, clicks, impressions, click-through rate and average position,
the OAuth access and refresh tokens needed to keep reading this data.

Framer connection

To publish posts, you give us your Framer project URL and a Framer API key. We store the API key encrypted and use it only to read your CMS collections and to create, update or unpublish the posts Clamor manages.

Content Clamor creates

Clamor stores the keyword plans, opportunities, drafts, published posts, settings and activity history it creates for your sites, and any instructions or messages you send to Clamor.

Billing data

Paid plans are handled by Stripe. Stripe collects your card details directly; we never see or store full card numbers. We receive and store your Stripe customer ID, subscription status, plan, billing email and country, and invoice history.

Technical data, logs and cookies

Session data: when you sign in we store a session record with your IP address and browser user agent.
Cookies: we use strictly necessary cookies only: a session cookie that keeps you signed in, a short-lived cache of that session, and cookies that protect the sign-in flow. We do not use advertising or third-party tracking cookies.
Server logs: our hosting provider records request logs (IP address, URL, time, user agent, errors) to keep the service secure and working.

How we use your data and legal bases

Purpose	Data used	Legal basis (GDPR)
Create your account and sign you in	Account data, session data, cookies	Contract (Art. 6(1)(b))
Find search opportunities and measure results for your sites	Search Console data	Contract (Art. 6(1)(b))
Write and publish posts to your Framer CMS	Framer connection, content, Search Console data	Contract (Art. 6(1)(b))
Bill your subscription and keep tax records	Billing data	Contract and legal obligation (6(1)(c))
Send service emails (results, trial and billing notices)	Email address, content, results	Contract (Art. 6(1)(b))
Keep the service secure, prevent abuse and fix errors	Session data, logs	Legitimate interests (Art. 6(1)(f))
Answer your questions and requests	Email address, your messages	Contract or legitimate interests

We do not sell or rent personal data, we do not use it for advertising, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Google API Services User Data Policy

Clamor's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We use Google user data (your sign-in profile and Search Console data) only to provide and improve the user-facing features of Clamor that you see in the app: signing you in, finding search opportunities for your own sites, writing and refreshing posts, and reporting their results.
We do not transfer Google user data to third parties, except to the service providers listed below as needed to run those features, to comply with applicable law, or as part of a merger or acquisition with notice to you.
We do not use Google user data for advertising, including retargeting, personalized or interest-based ads.
We do not sell Google user data, and we do not use it to determine creditworthiness or for lending.
We do not use Google user data to train or improve generalized or non-personalized AI or machine learning models. When we send Search Console data to an AI model provider to write a post for your site, it is used only to produce that output for you, and our providers do not train their models on it.
No human at Clamor reads your Google user data unless you ask us to (for example for support), it is needed for security or to investigate abuse, or the law requires it.

You can revoke Clamor's access at any time from your Google Account permissions page.

Service providers (processors)

We share personal data only with providers that process it on our behalf, under contracts that require them to protect it.

Provider	Purpose	Location
Cloudflare, Inc.	Hosting, network, database connection pooling, logs	Global edge network
PlanetScale, Inc.	Postgres database	United States
Google LLC	Sign-in and Search Console APIs	United States
Stripe, Inc. and Stripe Payments Europe	Payments, subscriptions, invoices	United States, EU
AI model providers (such as OpenAI, Anthropic and Google)	Generating keyword plans and posts from your site's data	United States
Framer B.V.	Publishing posts to your Framer project, at your request	EU, United States

AI model providers receive the content needed to write a post, such as your site's pages, queries and our instructions. We use their business APIs, which do not use API data to train their models.

We may also disclose data if required by law, to protect our rights or the safety of users, or to a successor if Clamor is sold or merged, in which case we will tell you first.

International transfers

Our main providers are in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred there, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. You can ask us for a copy of the relevant safeguards.

How long we keep data

Data	Retention
Account, Search Console data, content, settings	While your account is active. Deleted within 30 days after you delete it
Google and Framer access tokens	Until you disconnect the service or delete your account
Session records	Until the session expires or you sign out
Server logs	Up to 30 days
Billing records and invoices	10 years, as required by Italian tax law

Backups are overwritten on a rolling schedule, so deleted data can remain in backups for a short time before it is erased.

Posts published to your Framer site belong to you and stay there until you remove them. Deleting your Clamor account does not delete content from your own website.

Security

We protect your data with encryption in transit (TLS) and encryption at rest. Framer API keys are additionally encrypted in our database, OAuth tokens are only used by our servers, and access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authority as required by law.

Your rights

You have the right to access your data, to correct it, to delete it, to restrict or object to processing based on legitimate interests, and to data portability. Where processing is based on consent, you can withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority, such as the Italian Garante per la protezione dei dati personali, or the authority where you live.

California (CCPA / CPRA)

California residents have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes other than providing the service. The categories of personal information we collect are those listed in Data we collect.

How to exercise your rights

Email tommy@clamor.dev from the address linked to your account. We answer within 30 days and may ask you to confirm your identity. An authorized agent can make a request on your behalf with your written permission.

Deleting your data

To delete your account and all associated data, email tommy@clamor.dev. We delete your account, connected sites, Search Console data, tokens, Framer API keys and generated content within 30 days, except billing records we must keep by law. You can also:

remove Clamor's access to your Google account at myaccount.google.com/permissions,
revoke the Framer API key from your Framer project settings.

Children

Clamor is a business service. It is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as Clamor changes. We will update the date at the top, and for material changes we will notify you by email or in the app before they take effect.

Contact

Operator: Tommaso De Rossi, Clamor
Email: tommy@clamor.dev
Website: clamor.dev