Privacy policy

Bock is made by Clyqra, which is being registered as a limited company in Sweden (the registration is pending at Bolagsverket). We will add the registered name, organisation number and address here once it is complete. You can reach us about anything in this policy at [email protected].

We have not appointed a data protection officer.

Your organisation’s content. Everything an organisation puts into Bock (tasks, docs, notes, comments, databases, contacts and conversations in the CRM, posts, meeting recordings and transcripts, files) belongs to that organisation. For this content the organisation is the controller and we are its processor: we handle it only to run Bock for them, as this policy and our terms describe. The data processing agreement is in the terms, under data processing.

Your account. For the data about you as a user (your account, sign-in, error reports, what you write to us) we are the controller.

The CRM holds data about people who don’t use Bock themselves. The organisation that adds them is responsible for having a legal basis and for telling them, as it would in any CRM.

• Account: your name, email address, profile picture and Google account ID when you sign in with Google; your email address when you sign in with an email link. Which organisations you belong to, your role, and who invited you.
• Google, if you connect it: a token stored on our servers that lets Bock create a calendar called “Bock” and manage the events in it, see when you are busy (not what your events are), and open the Drive files you pick or create through Bock.
• LinkedIn, if your organisation connects a channel: a token that lets Bock publish the posts a person approves.
• Notifications: your notification settings, and a push subscription from your browser if you turn push on.
• Error reports: when something breaks in the app, it sends us the error message, where in the code it happened, the kind of page (such as /lists/:id, never the actual address or your content), the app version, your browser and your user ID. Only your organisation’s owners and admins and we can read them.
• AI usage: for each AI request, which feature made it, the model, how many tokens or audio seconds it used, the cost and the time. Not the content.
• Hosting logs: our hosting providers keep technical logs, such as IP addresses and request times, under their own policies.

We don’t use advertising trackers or third-party analytics, and we don’t sell personal data. What Bock keeps in your browser is listed on the cookies page.

• Storing and showing it to the people in your organisation who may see it, following its spaces, roles and guest access.
• Bock’s own AI features (the morning brief, ⌘K, smart capture, Ask Bock, and agents your organisation turns on) send the parts of the workspace a request needs to Anthropic’s models, and write the answer back into Bock. We don’t use your content to train AI models, and Anthropic’s commercial terms say it may not train its models on that content either. Anthropic deletes API inputs and outputs from its systems within 30 days, unless the law requires it to keep them. Its data processing terms are part of those commercial terms.
• Meeting recordings start only after the person recording confirms, in the app, that everyone has been told. The audio is uploaded to private storage in the EU, sent to OpenAI in the USA to be transcribed, and the transcript is written into the meeting note. The audio is then deleted, unless your organisation has chosen to keep meeting audio. If transcription fails, the audio stays so it can be tried again. OpenAI may keep what it receives through its API for up to 30 days before deleting it.
• Your own AI assistant. When someone connects Claude or another assistant to Bock, it reads and writes the workspace on that person’s behalf and with their permissions. What it reads goes to that assistant’s provider under the agreement between them and that provider; that provider isn’t our subprocessor. Bock records every change it makes, and a run can be undone.
• Bock for Chrome sends Bock only what you choose to save: a page’s title and address, text you selected, or the LinkedIn profile, post or conversation you add.
• Notifications are sent by email through Resend and as push messages through your browser’s push service, with a short text about what happened.

For the data we are controller for:

• To provide Bock (the agreement with you or your organisation): your account, sign-in, connections and notifications.
• Our legitimate interest in keeping Bock secure, finding and fixing errors, preventing abuse, and understanding cost and use from the usage records.
• Legal obligations, such as bookkeeping once Bock has paid plans.

Your workspace, its files and your account are stored by Supabase in the EU, in AWS’s Stockholm region (eu-north-1). The app is served through Cloudflare’s global network.

Some providers are in the USA: Anthropic (AI), OpenAI (meeting transcription), Resend (email) and GitHub (encrypted backups). Data sent to them leaves the EU. We rely on the EU–US Data Privacy Framework where the provider states that it is certified (Resend, Cloudflare and GitHub do), and on the EU’s standard contractual clauses in each provider’s data processing agreement otherwise. The full list is on the subprocessors page.

• Your organisation’s content: as long as the organisation keeps it. Archived items stay until they are deleted. When an owner deletes an organisation, all access stops at once and its data is permanently deleted within 30 days.
• Your account: as long as you use Bock. To have it deleted, write to [email protected]; we delete it within 30 days of your request.
• Meeting audio: deleted once it is transcribed, unless your organisation keeps meeting audio.
• Notifications: read notifications are deleted after 90 days.
• Error reports: deleted after 60 days.
• Backups: encrypted nightly backups of the database are kept for 90 days, so deleted data can remain in a backup until it expires.

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Write to [email protected]; we answer within a month.

For data in your organisation’s workspace, your organisation decides, so start with its owner or admin. We help them answer. A self-serve export is not built yet; until it is, we provide an export on request.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the authority where you live.

Traffic is encrypted in transit. In the database, every organisation’s rows are kept apart by access rules that check who is asking. Files, images in docs and meeting audio are in private storage. Profile pictures and space images you upload are readable by anyone who has their address, which is random and hard to guess, so they can show up in the app. Google and LinkedIn tokens stay on our servers, and Bock asks Google for the narrowest access that does the job. Backups are encrypted. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Bock is a tool for work and is not meant for children under 16.

When we change this policy we update the date at the top. If a change matters for how your data is handled, we tell you by email or in the app before it takes effect.

Questions, requests or worries about your data: [email protected].