Privacy Policy

Your privacy matters. Here's exactly how we handle your data.

Last updated: February 11, 2026

1. Introduction

OpenClaw AI ("OpenClaw," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our open-source AI assistant platform, website (openclawai.io), managed hosting services, and iOS application (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy.

2. Data We Collect

We practice data minimalism. We only collect what's necessary to provide our Services:

Account Information

  • Email address (for account creation and communication)
  • Display name (optional)
  • Payment information (processed securely by our payment provider; we do not store card details)

Usage Analytics

  • Aggregate, anonymized usage statistics (e.g., feature usage, error rates)
  • Device type and operating system (for compatibility)
  • We do not track individual behavior or build advertising profiles

3. AI Conversations & Your Content

🔒 Your conversations are yours.

  • Your AI conversations are NOT used for model training
  • Your AI conversations are NOT shared with third parties
  • Your AI conversations are NOT reviewed by OpenClaw staff
  • Your AI conversations are NOT sold to anyone, ever

When using AI features, your messages are sent to your configured AI provider (e.g., OpenAI, Anthropic) to generate responses. Each provider has their own privacy policy and data handling practices. We encourage you to review your AI provider's policies.

4. Self-Hosted Deployments

When you self-host OpenClaw:

  • You control your data entirely. All conversations, configurations, memory files, and logs remain on your infrastructure.
  • OpenClaw does not phone home or transmit data to our servers.
  • No telemetry is collected by default.
  • We have no access to your instance, your data, or your AI provider credentials.

Self-hosting gives you complete sovereignty over your data. We recommend encrypting your storage and following our security best practices.

5. Managed Hosting

When you use our managed hosting service:

  • Your data is encrypted at rest using AES-256 encryption
  • Your data is encrypted in transit using TLS 1.3
  • Each customer runs in an isolated instance — your data is never commingled with other users
  • We maintain strict access controls; staff access to customer data requires justification and is logged
  • Data is stored in secure data centers (EU and US regions available)
  • Regular backups are performed and encrypted

6. Third-Party Services

We use a limited number of third-party services:

  • Payment Processor: We use Stripe to process payments. Stripe's privacy policy governs the handling of your payment data. We never store your full credit card number.
  • Analytics: We use privacy-focused, anonymized analytics to understand aggregate usage patterns. No personal data or conversation content is included.
  • AI Providers: Your configured AI provider (OpenAI, Anthropic, Google, etc.) processes your messages. Their respective privacy policies apply to that data.

We do not sell, rent, or share your personal information with advertisers or data brokers.

7. Data Retention & Deletion

  • Account data is retained while your account is active and for up to 30 days after deletion request to allow for recovery.
  • Conversation data on managed hosting is retained until you delete it or close your account.
  • Payment records are retained as required by applicable tax and financial regulations.
  • Analytics data is aggregated and anonymized; it cannot be traced back to individuals.

You can request complete deletion of your data at any time by contacting support@openclawai.io. We will process deletion requests within 30 days.

8. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

For EU/EEA Residents (GDPR)

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate personal data
  • Right to Erasure: Request deletion of your personal data
  • Right to Restrict Processing: Limit how we use your data
  • Right to Data Portability: Receive your data in a structured format
  • Right to Object: Object to certain types of processing

For California Residents (CCPA)

  • Right to Know: What personal information we collect and how it's used
  • Right to Delete: Request deletion of your personal information
  • Right to Opt-Out: We do not sell personal information, so this right is automatically satisfied
  • Right to Non-Discrimination: Equal service regardless of privacy choices

To exercise any of these rights, contact us at support@openclawai.io.

9. Advertising & Conversion Tracking

We use Google Ads conversion tracking (gtag.js) to measure the effectiveness of our advertising campaigns. This tracking helps us understand which ads lead to sign-ups and purchases on our platform.

What is tracked

  • Sign-up conversions: When a user creates an account after clicking a Google ad
  • Purchase conversions: When a user completes a subscription purchase after clicking a Google ad

What is NOT tracked

  • Conversation content or AI usage
  • Personal browsing history beyond our site
  • Any data from self-hosted deployments

Google Ads conversion tracking uses cookies to attribute conversions to specific ad clicks. You can opt out of personalized advertising by visiting Google Ads Settings or by installing the Google Analytics Opt-out Browser Add-on.

Conversion tracking is only active when our advertising ID is configured. It is not present on self-hosted instances.

10. Cookie Policy

We use only minimal, functional cookies necessary for the operation of our Services:

  • Session cookies: To keep you logged in
  • Preference cookies: To remember your settings

We also use:

  • Google Ads conversion cookies: To measure the effectiveness of our advertising campaigns (see Section 9 above)

We do not use:

  • Third-party marketing cookies beyond Google Ads conversion tracking
  • Cross-site tracking pixels

11. Children's Privacy

Our Services are not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will also notify registered users via email.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: