Last verified: September 14, 2026 · Not yet reviewed by counsel
Which deployments this applies to. The first table applies to managed ClawMetry Cloud. A local-only install sends no agent session data to any of these services, but unless you turn them off it still sends an install ping and a failure report to ClawMetry Cloud (Google Cloud), and the country lookup below. A customer-hosted server sends nothing to ClawMetry by default. The exact requests and how to stop each one are on /trust.
"Always" means every managed cloud account. "When used" means only when you or your team use that feature.
| Service | Purpose | Data it can receive | Applies |
|---|---|---|---|
| Google Cloud Platform | Hosting (Cloud Run), the account database and relay cache (Cloud SQL for PostgreSQL), and secrets (Secret Manager). Region europe-west1, Belgium. | Account email, readable operational metadata, encrypted session content (ciphertext only), telemetry pushed with an ingest key, install pings and failure reports | Always; install pings and failure reports from any install that has not opted out |
| Stripe | Billing | Billing identity and payment details. Card data is handled by Stripe and never reaches ClawMetry servers. | Paid plans |
| Resend | Transactional email: sign-in codes, invitations and alerts | Recipient email address and the message | Always |
| ipapi.co | Country lookup for install statistics | The public IP address of the machine that sent the install ping | Every install ping that reaches ClawMetry Cloud, unless DO_NOT_TRACK=1 or CLAWMETRY_OFFLINE=1 is set |
| WorkOS | SAML and OIDC single sign-on | Identity assertions for members of an organization that uses SSO | When used |
| GitHub and Google (OAuth) | Social sign-in | Sign-in identity | When used |
| Twilio | SMS alerts and voice approval calls | Destination phone number, alert name and summary | When used |
| Google (Gemini API) and Anthropic | Support chat in the cloud dashboard | The chat conversation and the page context sent with it | When used |
| Hume and OpenAI | Voice assistant on the ClawMetry desk device | Voice audio and transcripts from that device | When used |
| Microsoft Clarity | Session replay in the hosted dashboard | Page interactions and what the page shows during a recording. We have not yet verified that content decrypted in your browser is masked in recordings, so leave replay off if that matters to you. | Only after you allow session replay in the cookie banner |
| Google Analytics | Analytics in the hosted dashboard | Page views and browser identifiers | Only after you allow analytics in the cookie banner |
| Google Fonts and jsDelivr | Web fonts and page assets on hosted pages | Your IP address and browser user agent when the page loads | Hosted pages that use them |
Processing locations are verified only for Google Cloud (europe-west1, Belgium). The other services process data on their own infrastructure, and we have not yet recorded where.
These apply to people who visit this website or use its forms, not to agent data.
| Service | Purpose | Data it can receive | Applies |
|---|---|---|---|
| Google Cloud Platform | Hosting (Cloud Run, europe-west1) and form storage (Firestore) | What you submit in a form, such as your email address and message | When you submit a form |
| Resend | Newsletter and reply emails | Your email address and the message | When you subscribe or submit a form |
| ipwho.is | Approximate location (city, region, country) recorded with site events | Your IP address | When you submit a form, click a tracked button or link (such as sign-up, managed-cloud, social, copy or roadmap-vote), download the desktop app, or open or click an email we sent you. This does not wait for cookie consent. |
| ip-api.com | Fallback location lookup, used only when ipwho.is fails. It is called over plain HTTP, so the request is not encrypted in transit. | Your IP address | When ipwho.is does not answer for one of the same events: a form submission, a tracked button or link click, a copy, a desktop app download, or an open or click on an email we sent you. This does not wait for cookie consent. |
| Anthropic | Drafting a personal reply to a support or managed-instance request | Your name and the message you sent | When you submit that form and the feature is enabled |
| Google Analytics and Google Ads | Analytics and advertising conversion measurement | Page views and browser identifiers | Only after you allow them in the cookie banner |
| Microsoft Clarity | Session replay | Page interactions | Only after you allow session replay in the cookie banner |
| Vapi | Voice and chat product expert on the homepage | Your messages and, if you speak, your microphone audio | Only after you start a conversation |
Destinations you configure with your own accounts belong to you, not to ClawMetry: Slack, Discord, Telegram, PagerDuty, Opsgenie and generic webhooks for alerts, your own server in a customer-hosted deployment, and a model provider you give your own API key to (for example for alert summaries).
ClawMetry's founder maintains this list from the managed cloud's source code and deploy configuration. An automated check in that codebase fails when the code starts calling an external service the internal list does not classify. The page date changes whenever the list changes. There is no advance-notice process for changes yet; it will be part of the DPA once one exists (see /dpa). Questions: hello@clawmetry.com.
Operated by Instalabs LLC. See the Privacy Policy and compliance status.
← Compliance status