Privacy Policy

Your data, plainly.

Beast is a Romanian-language organiser app with a single input bar: you type a sentence the way you speak, and meetings, tasks, money and people fall into place. This page explains what data Beast uses, why, where it is stored and how you delete it.

Last updated: 7 October 2026 · Applies to the app at app.beast.clon.one and to this website.

1. 1. Who is responsible
2. 2. Data we use
3. 3. Google Calendar
4. 4. Limited Use (Google)
5. 5. The Beast model
6. 6. Purposes and legal bases
7. 7. Who we share with
8. 8. Where data is stored
9. 9. How long
10. 10. How to delete
11. 11. Security
12. 12. Children
13. 13. Your rights
14. 14. Cookies
15. 15. Changes and contact

01Who is responsible

The data controller is „CLONE AI” S.R.L., a company registered in the Republic of Moldova, IDNO (company number) 1025600065276, managed by Cociorva Nicolae.

Registered address: 34 Vatlina St., Republic of Moldova
Contact for any privacy question: salut@clon.one

02Data we use

Your account (Sign in with Google)

At sign-in we request only openid, email and profile from Google. We store your Google-verified email address, name, first name and the link to your profile picture, which is shown next to your name in your team and in People.

We also keep a register of Google sign-ins: the Google account identifier, the email address (and whether Google verified it), name and picture, when you first and last signed in, how many times, the path (sign-in, invitation, event or booking link, calendar connection — only the type of link, never the link itself) and the outcome (account created, sign-in refused, visitor). It is written every time someone identifies with Google, even when the sign-in does not succeed, so we know who tried to get in and can help them. Only Beast administrators can see it.

What you type into Beast

Your sentences and what they become: tasks, meetings, calls, expenses, income, debts, notes, your journal, people cards (names, emails, phone numbers, company, notes) and your settings (time zone, notifications). If you write about other people, you decide what you write; please only record what you are entitled to keep about them.

Google Calendar (only if you connect it)

See section 3.

Bookings through a public link

Someone who books a time through a team's booking link gives us their name, email address and the chosen time — typed in, or by signing in with Google (then only openid, email, profile, with no access to the visitor's calendar). We also keep the booking's time zone and IP address to prevent abuse. The meeting is created in Beast for the team and in the organiser's Google Calendar, with an invitation for the visitor.

Technical data

The session cookie (to keep you signed in), IP address and time in our security log (sign-ins, important changes), your push subscription if you turn notifications on, and server logs.

03Google Calendar

Connecting your calendar is separate from sign-in and you start it yourself, from Settings → Google Calendar or from the button on Home. Only then do we ask for two additional permissions, the narrowest ones that cover the features below:

• https://www.googleapis.com/auth/calendar.events.owned — see, create, change and delete events on calendars you own. Beast uses it only on your primary calendar.
• https://www.googleapis.com/auth/calendar.events.freebusy — see your availability. Beast uses it only to ask Google for the busy times (start and end, no titles) of your primary calendar when it looks for a free time to schedule a meeting. These busy times are used on the spot and not stored.

We do not request access to calendar settings, sharing permissions, your calendar list, Gmail, Drive or Contacts. (Calendars connected before October 2026 may use the earlier permission calendar.events; Beast uses them in exactly the same, primary-calendar-only way.)

What we read

Only your primary calendar, in a window from one week ago to 90 days ahead: the event title, start and end time (or "all day"), location, video link (Google Meet or other), attendees (display name or email, first 8), whether the event shows you as busy or free, and, for meetings created from Beast, the attendees' responses. We do not store or use event descriptions or attachments. Declined and cancelled events are not imported.

What we do with it

What we don't do: read calendars other than your primary one, delete events Beast did not create, use Google data for advertising, profiling or credit decisions, or give it to anyone for anything other than the features above.

04Limited Use (Google)

Specifically:

• We use data from Google only to provide the user-facing features listed above, which you can see in the app.
• Google Calendar data is never used to develop, improve or train artificial intelligence or machine learning models — neither the Beast model nor any other (consistent with the Google Workspace API User Data and Developer Policy). Imported events are excluded from training samples; if one of your sentences refers to a Google event ("the meeting with Ion took place"), the title and time that came from Google are removed from the sample.
• We do not sell this data or transfer it to advertising platforms, data brokers or other resellers.
• People on our team do not read your Google data unless you explicitly ask us to (for example, to fix a problem), it is necessary for security (investigating abuse), or the law requires it.

05The Beast model

Beast understands sentences with its own model, which runs on our servers. Your sentences are not sent to other companies' AI services.

To improve it we keep — only with your consent, asked at first sign-in — the sentences you type, what the model understood and your corrections. During the beta, this consent is a condition for using the app; you can withdraw it at any time in Settings, and the sentences kept for training are then deleted.

• Before training, people's names, companies, emails, phone numbers, national ID numbers, IBANs, links and longer numbers are replaced automatically.
• Sensitive sentences (health, personal legal matters, family and intimate life) are not kept for training at all.
• The raw form is deleted after 90 days; only the anonymised form remains in the training set.
• Google Calendar data is excluded (see section 4).

06Purposes and legal bases

• Running Beast (account, agenda, money, people, team, reminders): performance of our contract with you — Art. 6(1)(b) GDPR.
• Google Calendar and model training: your consent — Art. 6(1)(a). You can withdraw it at any time (disconnect the calendar, withdraw consent).
• Security and abuse prevention (security log, rate limiting): our legitimate interest — Art. 6(1)(f).
• Legal obligations (accounting, requests from authorities): Art. 6(1)(c).

07Who we share with

We don't sell data and we have no ads. Data reaches others only in these ways:

• Your teammates — what you put in a team space is visible there according to that space's rules; your personal space is yours alone.
• Google — for sign-in and, if you connect it, Google Calendar and Meet (at your request).
• Resend (Resend, Inc., USA) — sends the app's emails: welcome, team invitations, reminders, booking confirmations. It receives the recipient's address and the email content.
• Hosting providers — the rented servers Beast runs on (see section 8).
• Browser push services (Google, Apple, Mozilla) — if you turn on push notifications, they carry the encrypted notification to your device.
• Assistants you connect yourself — if you create an MCP key in Settings and give it to an AI assistant, that assistant can read and write, through the key, what you see in that space (including events imported from Google, in your personal space). You create and revoke that connection; we never make such a transfer on our own initiative.
• Authorities — only when the law requires it.

Where a provider is outside the EU/EEA, the transfer relies on the safeguards required by the GDPR (for example, the European Commission's Standard Contractual Clauses).

08Where data is stored

App data is stored in a database on servers we administer, rented from hosting providers in the European Union (Contabo GmbH and Hetzner Online GmbH), on servers in the European Union (Germany and France). We don't use another company's database service. Backups are made daily on the same server.

09How long

10How to delete

Disconnecting Google Calendar (self-service, any time)

Settings → Google Calendar → Disconnect (in the app: Setări → Google Calendar → „Deconectează”). Beast revokes its access at Google, deletes the connection and tokens, and immediately deletes all events imported from your calendar. Meetings that Beast added to your Google Calendar stay there (they are yours); you can delete them in Google Calendar.

You can also remove access from your Google Account at myaccount.google.com/permissions. Beast can then no longer read or write anything; events already imported disappear when you press "Disconnect" in Beast or when you email us.

Deleting your account

Email salut@clon.one from your account's address. We delete your account and data within 30 days and confirm. Before that, you can download your data from the app (JSON / CSV). Content you put in a team space may stay there, without your name, if the team needs it; you can ask us to delete that too.

Withdrawing training consent

Settings → Beast model → Withdraw consent (in the app: „Retrage acordul”): sentences, corrections and drafts kept for training are deleted immediately.

11Security

• All traffic is encrypted (HTTPS / TLS).
• Google tokens are encrypted in the database (AES-256-GCM) and never leave the server; your browser never sees them.
• Google sign-in and calendar connection use PKCE and signed state parameters; sessions use secure cookies (__Host-, HttpOnly).
• Backups are accessible only to the server administrator.
• Our team's access to data is limited to what is needed to run the service.

If you find a security issue, email salut@clon.one.

12Children

Beast is for people aged 16 or older; age is confirmed at first sign-in. We do not knowingly collect data from children under 16. If we learn that we have, we delete the account.

13Your rights

Under Regulation (EU) 2016/679 (GDPR) and the Republic of Moldova's Law No. 133/2011 on personal data protection (and any legislation replacing it), you have the right to:

• know what data we hold about you and get a copy (access, portability);
• correct it or have it erased;
• restrict or object to processing;
• withdraw consent at any time, without affecting what was done before;
• complain to the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md) or to the data protection authority of your EU country.

For any request: salut@clon.one. We reply within 30 days.

14Cookies

The app uses only necessary cookies: the session, and short-lived security cookies during Google sign-in. No tracking, analytics or advertising cookies. This website sets no cookies; it loads fonts from Google Fonts and a few scripts from cdnjs (Cloudflare), which see your browser's IP address.

15Changes and contact

If we change anything important, we announce it in the app before it applies. The last update date is at the top.

„CLONE AI” S.R.L. · IDNO 1025600065276 · 34 Vatlina St., Republic of Moldova · salut@clon.one

This English version is provided for convenience; the Romanian version has the same content.