Privacy Policy

Welcome to Clova ("Clova," "we," "us," or "our"), a mobile application designed for cocktail enthusiasts aged 18 and above. Clova provides a community-driven platform for discovering, learning, creating, and sharing cocktail recipes, managing your personal home bar inventory, and connecting with a global audience of drink creators and enthusiasts.

This Privacy Policy ("Policy") explains in detail how Clova collects, uses, stores, shares, and protects your personal information when you access or use our mobile application and related services (collectively, the "Services"). By registering for or using Clova, you acknowledge that you have read, understood, and agree to the practices described in this Policy.

If you do not agree with this Policy, please do not access or use the Services. For any questions or concerns about your privacy, please contact us at service@clova.cloud.

1. Scope of This Policy

This Policy applies to all users of the Clova mobile application, whether on iOS or Android, including users who access Clova without a registered account ("Guest Users") and registered account holders ("Members"). It covers information collected through the App, our website, and any related APIs or integrations.

This Policy does not govern third-party websites, services, or applications that may be linked from within Clova. We encourage you to review the privacy policies of any third-party platforms you engage with. Clova is not responsible for the privacy practices of those third parties.

2. Eligibility and Age Restrictions

Clova is intended exclusively for individuals who are 18 years of age or older. By creating an account or otherwise using the Services, you represent and warrant that you meet this age requirement. We do not knowingly permit users under the age of 18 to register or access the platform.

If we become aware that a user is under the age of 18, we will promptly suspend or terminate the account and delete any associated personal information. Parents or guardians who believe their minor child has created an account on Clova should contact us immediately at service@clova.cloud.

3. Information We Collect

3.1 Account and Registration Information

When you register for a Clova account, we collect:

• Full name or display name
• Email address
• Date of birth (to verify you are 18 or older)
• Username and password (stored in encrypted form)
• Profile photo (optional)
• Short bio or profile description (optional)

3.2 Content You Create and Upload

Clova is a content-sharing platform. When you use our creative features, we collect and store:

• Cocktail recipes you publish, including ingredient lists, measurements, preparation methods, and tasting notes
• Photos and images you upload in connection with recipes or profile content
• Text posts, captions, comments, and replies
• Private messages and direct communications sent through the in-app messaging system
• Content preferences, bookmarks, saved recipes, and collections

3.3 Inventory and Bar Data

When you use the "My Bar" feature, we collect:

• A list of spirits, liqueurs, mixers, and other ingredients you add to your digital cabinet
• Shopping lists and restocking notes you create within the app
• Matching preferences and filters you set when browsing your inventory-compatible recipes

3.4 Device and Technical Information

We automatically collect certain technical data when you access the Services, including:

• Device identifiers such as device ID, IDFA (iOS), or GAID (Android)
• Operating system type and version
• App version and build number
• IP address and approximate geographic location derived from IP
• Browser or mobile client type
• Crash logs, error reports, and diagnostic data
• Session duration, feature usage patterns, and interaction logs

3.5 Usage and Behavioral Data

We collect data about how you interact with Clova, such as:

• Recipes you view, like, save, or share
• Creators you follow or unfollow
• Search queries and filtering preferences
• Tokens purchased and feature unlocks (AI Bartender, Recipe Card Generator, Drops)
• Notification interactions and in-app click paths

3.6 Payment and Transaction Information

If you purchase tokens or premium features within Clova, payment transactions are processed through Apple App Store or Google Play. We do not directly collect or store complete payment card information. We do receive and retain:

• Purchase confirmation and transaction identifiers
• Token balance and transaction history within the app
• Date and amount of purchases

3.7 Communications with Clova

If you contact our support team or submit feedback, we retain the content of those communications, including your email address and any information you voluntarily provide, for the purpose of responding to your inquiry and improving our services.

3.8 Information from Third Parties

If you choose to register or log in using a third-party authentication provider (such as Apple Sign-In or Google Sign-In), we receive basic profile information authorized by that provider, typically including your name and email address. We do not receive your third-party account passwords.

4. How We Use Your Information

4.1 Providing and Operating the Services

We use the information we collect to:

• Create and maintain your Clova account
• Enable you to publish, save, and interact with cocktail recipes
• Power the My Bar inventory system and recipe-matching functionality
• Facilitate social features including following, commenting, and direct messaging
• Process token purchases and unlock premium features

4.2 Personalization and Recommendations

We use your usage data, inventory information, and content interactions to:

• Recommend recipes tailored to your bar inventory and taste preferences
• Curate your social feed based on creators and categories you engage with
• Surface relevant Drops, trending content, and featured recipes
• Power the AI Bartender feature to generate personalized cocktail suggestions

4.3 Communication and Notifications

We use your contact information to:

• Send service-related notifications such as account verification, password resets, and security alerts
• Deliver push notifications about activity on your content or from creators you follow
• Provide updates about new features, policy changes, or platform announcements (where you have opted in)

4.4 Safety, Security, and Compliance

We use your information to:

• Detect and prevent fraudulent activity, spam, and abuse
• Enforce our Terms of Service and Community Guidelines
• Verify that users meet the minimum age requirement of 18 years
• Respond to legal obligations, regulatory requests, and law enforcement inquiries

4.5 Research, Analytics, and Product Improvement

We use aggregated and anonymized data to analyze usage trends, identify product improvement opportunities, conduct internal research, and develop new features. This data is processed in a manner that does not identify individual users.

5. User-Generated Content (UGC)

5.1 Content Ownership and License

You retain ownership of all original content you create and post on Clova. By uploading content to the platform, you grant Clova a worldwide, royalty-free, non-exclusive, sublicensable license to host, display, distribute, reproduce, modify (for formatting purposes), and make available your content in connection with operating and promoting the Services.

5.2 Public Nature of Posted Content

Content you post publicly on Clova -- including recipes, profile photos, comments, and bios -- is visible to all users of the platform, including those who are not logged in. You should not include sensitive personal information in publicly visible content. Private messages are visible only to you and the recipient(s) of those messages.

5.3 Content Moderation and Removal

Clova reserves the right to review, moderate, or remove user-generated content that violates our Community Guidelines or Terms of Service. Content may be removed without prior notice in cases involving:

• Prohibited or illegal content
• Harassment, threats, or abuse directed at other users
• Spam, commercial solicitation, or coordinated inauthentic behavior
• Content involving minors in inappropriate contexts
• Intellectual property infringement

5.4 Data Retention of UGC

Content you post remains on the platform until you delete it or until your account is terminated. After account deletion, publicly posted content may be retained in anonymized or aggregated form for platform analytics purposes. Private messages are deleted upon account termination unless subject to a pending legal hold.

5.5 Copyright and Intellectual Property

By posting content on Clova, you represent that you have the rights necessary to grant the license described above and that your content does not infringe any third-party intellectual property rights. If you believe your copyright has been infringed by content on Clova, please notify us at service@clova.cloud with the subject line "Copyright Notice" and we will investigate promptly.

6. AI Features and Automated Processing

Clova offers AI-powered features including the AI Bartender, the Recipe Card Generator, and personalized content recommendations. These features are powered by automated processing of your inventory data, usage history, content preferences, and interaction patterns.

The AI Bartender generates recipe suggestions based on the ingredients in your My Bar inventory and any taste preferences you have indicated. The outputs are suggestions only and are not guaranteed to be accurate or suitable for your specific circumstances. You are responsible for exercising your own judgment in following any AI-generated recommendation.

We do not use your personal data to train general-purpose AI models that are made available to third parties. Data used to power AI features within Clova is processed solely for the purpose of delivering those features to you.

7. Tokens, Purchases, and Virtual Items

Clova offers a token-based system that allows users to unlock premium features such as the AI Bartender, Recipe Card Generator, and Drops. Tokens are purchased through Apple App Store or Google Play. All token transactions are subject to the payment terms of the respective platform.

• Tokens are non-refundable except where required by applicable law or the platform store policy
• Token balances are associated with your Clova account and are not transferable between accounts
• Clova reserves the right to modify token pricing and availability of features at any time
• In the event of account termination, unused tokens are forfeited unless otherwise required by law

8. Information Sharing and Disclosure

8.1 With Other Users

Certain information is visible to other users of Clova by default or based on your privacy settings, including your display name, profile photo, bio, publicly posted recipes, follower and following counts, and comments you make on public content. Content shared in the public feed is visible to all users and may be indexed by search engines.

8.2 With Service Providers

We share personal information with trusted third-party vendors who perform services on our behalf, including:

• Cloud hosting and data storage providers
• Analytics and performance monitoring services
• Customer support platforms
• Push notification delivery services
• Payment processing platforms (Apple, Google)

These providers are contractually obligated to use your information only as directed by Clova and in accordance with this Policy.

8.3 For Legal and Safety Purposes

We may disclose your information when we believe in good faith that such disclosure is necessary to:

• Comply with applicable laws, regulations, or legal process
• Respond to valid governmental, regulatory, or law enforcement requests
• Protect the rights, safety, or property of Clova, its users, or the public
• Investigate or address suspected violations of our Terms of Service

8.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy proceeding involving Clova, your personal information may be transferred to the acquiring entity as part of the transaction. We will provide notice on our platform or via email before your data is transferred and becomes subject to a different privacy policy.

8.5 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you, for purposes including industry research, marketing analytics, and partnerships. This data does not constitute personal information under applicable law.

8.6 With Your Consent

We may share your personal information with third parties where you have given us explicit consent to do so, such as when you connect a third-party application or authorize a specific integration.

9. Social and Community Features

Clova is a social platform. When you interact with other users -- through following, commenting, messaging, or sharing content -- those interactions are visible to the intended audience based on the feature you are using. Public comments are visible to all users. Direct messages are visible only to the sender and recipient(s).

You may control your social experience through the settings in your profile, including adjusting who can send you messages, comment on your content, or view your activity. We encourage all users to exercise discretion when sharing personal information in social contexts.

10. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services. Specific retention periods include:

• Account and profile data: Retained for the duration of your account and up to 90 days following account deletion, unless a longer retention period is required by law
• UGC and recipes: Public content may be retained in anonymized form following account deletion
• Transaction records: Retained for a minimum of 5 years for financial compliance purposes
• Usage and analytics data: Retained in aggregated form indefinitely; raw usage logs are deleted after 12 months
• Support communications: Retained for 3 years from the date of the last communication

When personal information is no longer needed, it is securely deleted or anonymized in accordance with our internal data management policies.

11. Data Security

We implement technical, organizational, and administrative measures designed to protect your personal information against unauthorized access, loss, destruction, or alteration. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security) protocols
• Encryption of sensitive data at rest, including passwords and authentication credentials
• Role-based access controls limiting employee access to personal data
• Regular security audits and vulnerability assessments
• Multi-factor authentication options for user accounts
• Incident response procedures for detecting and responding to data breaches

Despite these measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data. If you become aware of any unauthorized use of your account, please notify us immediately at service@clova.cloud.

12. International Data Transfers

Clova is a global platform. Your personal information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to third countries, we rely on appropriate legal mechanisms, including Standard Contractual Clauses approved by the European Commission, to ensure an adequate level of protection for your data. By using Clova, you acknowledge and consent to such transfers.

13. Your Privacy Rights

13.1 General Rights

Depending on your country or region of residence, you may have the following rights with respect to your personal information:

• Right of Access: Request a copy of the personal data Clova holds about you
• Right of Rectification: Request correction of inaccurate or incomplete personal data
• Right of Erasure: Request deletion of your personal data, subject to legal retention obligations
• Right to Data Portability: Request your data in a structured, machine-readable format
• Right to Restrict Processing: Request that we limit how we process your personal data
• Right to Object: Object to certain types of processing, including direct marketing
• Right to Withdraw Consent: Withdraw consent for processing based on your consent, without affecting the lawfulness of prior processing

13.2 How to Exercise Your Rights

To exercise any of the rights above, please contact us at service@clova.cloud. We will respond to all verifiable requests within 30 days of receipt, or within any shorter period required by applicable law. We may need to verify your identity before processing your request.

13.3 Account Deletion

You may delete your Clova account at any time through the account settings menu within the app. Following account deletion, we will process your erasure request in accordance with our data retention policy. Please note that deletion is irreversible and will result in the permanent loss of your content, token balance, and recipe history.

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you specific rights regarding your personal information. These include the right to know what personal information we collect, use, share, or sell; the right to delete your personal information; the right to opt out of the sale or sharing of your personal information; the right to correct inaccurate personal information; and the right to limit the use of sensitive personal information.

Clova does not sell your personal information for monetary compensation. We may share certain data with analytics partners for cross-context behavioral advertising purposes, which may constitute "sharing" under California law. You may opt out of such sharing by contacting us at service@clova.cloud or by following any opt-out link we provide.

We do not discriminate against California residents who exercise their privacy rights. To submit a CCPA request, please contact us at service@clova.cloud with the subject line "California Privacy Request."

15. European Economic Area and UK Privacy Rights (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR) or the UK GDPR, as applicable. The legal bases on which we rely to process your personal data include:

• Performance of a contract: Processing necessary to create and maintain your account and deliver the Services
• Legitimate interests: Processing for fraud prevention, security, analytics, and product improvement, balanced against your privacy interests
• Consent: Processing based on your freely given consent, including marketing communications and optional personalization
• Legal obligation: Processing necessary to comply with applicable law

You may lodge a complaint with a supervisory authority in your country of residence if you believe your rights under the GDPR or UK GDPR have been violated. Our EU representative and Data Protection Officer can be reached via service@clova.cloud.

16. Cookies and Tracking Technologies

The Clova mobile application does not use browser cookies. However, we and our third-party partners may use mobile device tracking technologies including:

• Device advertising identifiers (IDFA on iOS, GAID on Android) for attribution and analytics
• Software development kits (SDKs) embedded in our app for crash reporting, analytics, and performance monitoring
• Local storage and in-app caching for improved performance and offline capability

On iOS, we request your permission to track your device identifier via Apple's App Tracking Transparency (ATT) framework before collecting or using your IDFA for advertising purposes. You may change your tracking preferences at any time in your device settings.

17. Third-Party Integrations and Links

Clova may offer integrations with third-party platforms or contain links to external websites, social media platforms, and content sources. These third-party services have their own privacy policies, and we have no control over or responsibility for their data collection practices.

Common third-party integrations and services used within Clova may include Firebase (Google) for analytics and crash reporting, Apple Sign-In and Google Sign-In for authentication, and Stripe or Apple/Google payment platforms for token purchases. Each of these providers operates under their own privacy policy and data protection framework.

18. Children's Privacy Protection

18.1 Age Restriction

Clova is strictly intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18. By using the Services, you confirm that you are at least 18 years old. If you are a parent or guardian and believe that your child has provided personal information to Clova, please contact us immediately at service@clova.cloud and we will take prompt steps to delete such information.

18.2 Verification Measures

During registration, Clova collects date of birth information to verify that users meet the minimum age requirement. Accounts created with a date of birth indicating the user is under 18 will be rejected. We also rely on our Community Guidelines reporting system, through which other users may flag accounts suspected of being operated by minors.

18.3 Child Sexual Abuse and Exploitation (CSAE)

Clova maintains a strict zero-tolerance policy with respect to child sexual abuse and exploitation (CSAE). Any content that depicts, promotes, facilitates, or normalizes the sexual abuse, exploitation, grooming, or trafficking of minors is absolutely prohibited on the platform. This includes but is not limited to:

• Child sexual abuse material (CSAM) in any form
• Content designed to groom minors or solicit sexual contact with minors
• Depictions or descriptions of sexual acts involving individuals under 18 years of age
• Communications intended to facilitate offline contact with minors for exploitative purposes

Upon discovery of any CSAE material or credible reports thereof, Clova will immediately remove the content, suspend the offending account, and report to the National Center for Missing and Exploited Children (NCMEC) as required by applicable law. We cooperate fully with law enforcement investigations related to CSAE. Users who encounter suspected CSAE content should report it immediately through our in-app reporting tool or by emailing service@clova.cloud.

19. Community Guidelines and Content Standards

All users of Clova are required to comply with our Community Guidelines, which form a part of our Terms of Service. Our guidelines prohibit content that is illegal, harmful, hateful, misleading, or violates the privacy or rights of others. Content moderation is carried out through a combination of automated detection systems and human review.

Users may report content that they believe violates our guidelines by using the in-app reporting feature. Reported content is reviewed and, if found to be in violation, removed. Repeat or serious violators may face account suspension or permanent termination. Clova maintains a right of appeal for account enforcement decisions.

20. Push Notifications and Marketing Communications

With your permission, Clova may send push notifications to your device regarding activity on your content, new followers, messages, recommended recipes, and platform announcements. You may opt out of push notifications at any time through your device settings or within the Clova notification preferences menu.

If you have opted in to email marketing communications, you may unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us at service@clova.cloud. Please note that service-related communications (such as account security alerts and transaction confirmations) cannot be opted out of while your account remains active.

21. Your Controls and Privacy Settings

Clova provides a range of privacy controls that allow you to customize your experience:

• Profile visibility: Choose whether your profile is visible to the public or restricted to your followers
• Messaging controls: Restrict who can send you direct messages (everyone, followers only, or no one)
• Comment settings: Control who can comment on your recipes and posts
• Activity status: Show or hide your online presence
• Blocked users: Block specific users from viewing your profile or interacting with you
• Data download: Request a portable export of your personal data from the settings menu

22. Data of Deceased Users

In the event of the death of a Clova user, immediate family members or legal representatives may contact us at service@clova.cloud to request account memorialization or deletion. We may require documentation such as proof of death and proof of relationship or legal authority before acting on such a request. Memorialized accounts will be preserved but no further changes will be made to the account's content or settings.

23. Updates to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes to this Policy, we will notify you by:

• Posting the revised Policy within the Clova app with an updated "Last Updated" date
• Sending a push notification or in-app message alerting you to the changes
• For significant changes affecting your rights, sending an email notification to the address associated with your account

Your continued use of Clova following notification of any changes constitutes your acceptance of the revised Policy. If you do not agree with the updated terms, you should discontinue use of the Services and may request account deletion by contacting service@clova.cloud.

We recommend reviewing this Policy periodically to stay informed about how we protect your information. Archived versions of previous Policy versions are available upon request.

24. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at:

Clova

Privacy Team

Email: service@clova.cloud

We aim to respond to all privacy-related inquiries within 30 days of receipt.

This Privacy Policy was last updated on June 11, 2025 and is effective as of the same date.