Clara IP, S.A.P.I. de C.V. (“Clara”) is the data controller for the personal data collected through Clara Global, the corporate expense reimbursement management platform available at https://global.clara.com/ (“Clara Global” or the “Service”), in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions.
This Notice applies to administrators and users of the companies that use Clara Global, to the billing contacts of those companies, and to people who visit the Clara Global website or use its public demo. It does not apply to other products of Clara or of its group companies, such as the corporate card, which have their own privacy notice.
Capitalized terms not defined in this Notice have the meaning given to them in the Clara Global Terms and Conditions.
1. Capacity in which Clara processes your data
Clara acts as data controller for the data it processes for its own purposes: creating and managing accounts, providing and charging for the Service, providing support, protecting the platform, complying with its legal obligations and, with your consent, measuring its acquisition channels and improving the product.
The information that the company contracting Clara Global (the “Client”) and its Users record to manage reimbursements (Reimbursement Requests, amounts, Supporting Documentation, Users’ banking and tax data, and approval decisions) is processed on behalf of the Client and in accordance with its instructions, since the Client decides which expenses it reimburses and holds the employment or contractual relationship with its Users. With respect to that information, Clara acts as the Client’s data processor. If you are a User, we recommend that you also review the privacy notice of the company you work with.
2. Personal data we collect
2.1 Registration and account data
Name, business email address, company and entities to which you belong, role and permissions within Clara Global, and Authentication Credentials, which are stored encrypted.
2.2 Reimbursement Request data
Amount, currency, date, merchant, description, category, comments, review and approval history, and Supporting Documentation (invoices, receipts, tickets or other vouchers). These documents may contain data of third parties who are not Users, such as the name of a merchant or supplier.
2.3 Users’ banking and tax data
Account number or CLABE, bank and RFC (Mexican tax ID), which the Client needs to generate the Payment Report and make reimbursements by its own means, outside Clara Global.
2.4 Plan billing and payment data
Company name, billing email address, tax data needed to issue tax invoices, card brand and last four digits, subscription status and dates, information on refunds, disputes or chargebacks related to your payments and, if you provide it, the cancellation reason. Clara does not receive or store the full card number or its security code: those details are entered directly into Stripe’s payment form.
2.5 Support data
Your communications with the Customer Support area.
2.6 Technical and usage data
IP address, browser and device type, operating system, access dates and times, pages visited, actions within the platform and error logs. Also recordings of your sessions in Clara Global and the identifiers of the cookies described in section 9.
2.7 Sensitive personal data
Clara does not request sensitive personal data. However, Supporting Documentation may incidentally contain it; for example, a receipt for medical expenses. We recommend uploading only the information needed to support the expense. If a document contains sensitive data, Clara will process it only as part of that document, on behalf of the Client and with the security measures described in this Notice.
2.8 Public demo
Any information you upload to the Clara Global public demo, which runs on fictitious data, is discarded and not retained.
3. Purposes of processing
3.1 Purposes necessary for the Service
- a)Creating, verifying and managing your account and your company’s account, and controlling access to Clara Global.
- b)Providing the Service: recording, reviewing, approving, rejecting and tracking Reimbursement Requests in accordance with the workflows configured by the Client, and generating the Payment Report.
- c)Extracting information from Supporting Documentation (OCR), suggesting categories and assessing expenses against the Client’s policies through artificial intelligence features, in accordance with section 6.
- d)Purchasing, charging, renewing and cancelling paid Plans, managing courtesy plans and failed payments, and issuing the applicable tax invoices.
- e)Sending Administrators operational communications about the account, the Plan, charges, failed payments, Courtesy Plans and the status of the Service. Given their nature, these communications cannot be turned off.
- f)Handling support requests, complaints and inquiries.
- g)Protecting the security of Clara Global, preventing fraud and misuse, and diagnosing and fixing errors.
- h)Complying with legal, tax and regulatory obligations, and responding to requests from competent authorities.
- i)Establishing, exercising or defending Clara’s rights in judicial or administrative proceedings.
3.2 Secondary purposes
The following purposes are not necessary to provide the Service to you, but they allow us to improve it:
- Measuring which channels (organic search, paid campaigns, social media, referrals) bring in the people who sign up for and use Clara Global, and analyzing the journey from the first visit to use of the Service.
- Analyzing use of the platform, including session recordings, to improve the product and the user experience.
- Sending you commercial information, news, promotions and surveys about Clara Global and other Clara products.
The data used for purposes a) and b) is reviewed internally for statistical purposes, is not shown to other users and is not used to make decisions about you.
You may object to these purposes at any time: for purposes a) and b), by blocking or deleting analytics and marketing cookies in your browser settings or with a content blocker (see section 9); for purpose c), through the unsubscribe link included in each email or by writing to [email protected]. Objecting will not be a reason to deny you the Service.
4. Who we share your data with
4.1 Providers that process data on Clara’s behalf
Clara shares data with providers that process it on its behalf, solely to provide their services to Clara and subject to confidentiality and security obligations. These disclosures to processors do not require your consent:
- Cloud infrastructure and hosting providers.
- Artificial intelligence model providers, for the features described in section 6.
- Stripe, to process Plan payments and manage the subscription.
- HubSpot, to manage the commercial relationship. It receives your email address, the campaign parameters and the Google Ads click id of the link you followed, the landing page and the visitor identifier from its own cookie (hubspotutk). It does not receive the referring site or the Google Analytics identifier.
- Google (Google Analytics and Google Ads) and LogRocket, for usage analytics, advertising campaign measurement and session recording.
- Email delivery provider.
- Authorized tax invoice certification provider.
Several of these providers are located outside Mexico, mainly in the United States of America, so your data may be processed in other countries with the same protections set out in this Notice.
4.2 Transfers
Clara may transfer your data without your consent in the cases permitted by law:
- To the Client you work with, regarding your account information and your use of Clara Global, as this is necessary for the legal relationship between you, the Client and Clara.
- To Clara’s parent companies, subsidiaries or affiliates that operate under equivalent internal policies, for administration, support and compliance purposes.
- To competent authorities, when required by law or by a duly grounded request.
- When necessary to establish, exercise or defend a right in judicial proceedings.
Clara does not make transfers that require your consent. Should this become necessary in the future, Clara will request your consent beforehand.
5. Processing on behalf of the Client
With respect to the information described in the second paragraph of section 1, Clara processes it only to provide the Service to the Client and in accordance with its instructions, does not use it for its own purposes other than those set out in this Notice, and applies the same security measures. If you exercise your rights regarding that information before Clara, Clara will forward your request to the Client and assist it in responding.
6. Artificial intelligence and automated decisions
Clara Global uses artificial intelligence models operated by third parties to extract information from Supporting Documentation, suggest categories, assess expenses against the Client’s policies and generate text or analyses. To do so, the necessary information is sent to those providers: amounts, merchants, descriptions, the Client’s expense policies and, where applicable, Supporting Documentation.
The outputs of these features are suggestions and do not by themselves determine whether a Reimbursement Request is approved, rejected or paid. The only automated decisions that change the status of a request are the approval or rejection rules configured by the Client itself, which do not rely on artificial intelligence. If you believe a decision affects you, you may ask the Client to review it.
7. Your rights
7.1 ARCO Rights
You have the right to know what personal data we hold about you and how we use it (access), to ask us to correct it if it is inaccurate or incomplete (rectification), to ask us to delete it (cancellation) and to object to its use for specific purposes (objection).
To exercise these rights, send your request to [email protected] with the following information:
- Your name and an email address to receive the response.
- A document evidencing your identity or, where applicable, that of your representative and their authority.
- A clear description of the data and the right you wish to exercise.
- Any information that helps locate your data and, if you request a rectification, the supporting documentation.
Clara will respond within twenty (20) business days of receiving your request and, if it is granted, will give effect to it within fifteen (15) business days of the response. These periods may be extended once for an equal period when justified by the circumstances, and you will be informed of any extension.
7.2 Withdrawal of consent
You may withdraw your consent through the same channel. Please note that in some cases we may not be able to act on your request immediately, for example, when we must retain certain data to comply with a legal obligation. If you withdraw consent for data needed for the Service, we may not be able to continue providing it to you. Consent for analytics and marketing cookies is withdrawn directly in the cookie preferences, in accordance with section 9.
7.3 Limiting use or disclosure
In addition, you may limit the use of your data by blocking cookies in your browser (section 9), through the unsubscribe link for commercial communications included in each email, or by writing to [email protected]. The operational communications referred to in item e) of section 3.1 cannot be limited through these means, as they are necessary to provide the Service.
8. Retention
- Account and Service data: for as long as the account is active. When the account is deleted, this data is deleted, except for data that must be retained to comply with legal obligations, such as tax and billing information, which is blocked for the periods established by applicable law and then erased.
- Attribution data: for as long as the account exists, except for any information that must be retained under applicable law.
- Attribution cookie (clara_attribution): thirty (30) days from when it is set.
- Public demo: no information is retained.
9. Cookies and similar technologies
Clara Global uses its own and third-party cookies from your first visit, without asking for your prior consent through a banner. You can block or delete them at any time in your browser settings or with a content blocker.
| Category | What it is used for | Cookies and providers | Duration |
|---|---|---|---|
| Necessary | Site operation, login, security and remembering your preferences (language, theme, active company). | Clara’s own session and preference cookies. | Session or up to one year |
| Analytics | Measuring how Clara Global is used, detecting errors and recording sessions to improve the product. | Google Analytics (_ga, _ga_*) and LogRocket (_lr_*). | Up to two years |
| Marketing and attribution | Remembering how you reached Clara Global (campaign parameters, Google Ads click id, landing page and referring domain), measuring whether an ad led to an account being created, showing Clara ads to people who visited the site, and linking your account to that visit in our CRM. | clara_attribution (Clara’s own, 30 days); Google Ads (_gcl_*); HubSpot (hubspotutk, __hstc, __hssc, __hssrc). | 30 days to 6 months |
The clara_attribution cookie never stores full URLs, searches or tokens. You can block or delete any of these cookies in your browser settings, and a content blocker stops the analytics, advertising and CRM scripts from loading at all; Clara Global keeps working unless you block the necessary cookies. If you want the attribution data associated with your account deleted, write to [email protected].
10. Security
Clara applies administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing, including encryption of Authentication Credentials, role-based access control and the exclusion of attribution data from technical logs. Full card details are processed and safeguarded by Stripe under its payment security certifications.
The Payment Report downloaded by the Client contains Users’ banking and tax data and leaves Clara Global once downloaded. Its safekeeping is the Client’s responsibility.
11. Users in other countries
If you use Clara Global from outside Mexico, your data will be processed in Mexico and in the countries where the providers listed in section 4 are located. If the laws of your country grant you additional rights, you may exercise them through the channels set out in this Notice.
12. Minors
Clara Global is a service for businesses and is not directed at minors. Clara does not knowingly collect data from minors.
13. Changes to this Privacy Notice
Clara may amend this Notice due to legal changes, changes to the Service or changes to its privacy practices. The current version will always be available at https://global.clara.com/privacy. If a change is material, we will inform you by email or within Clara Global before it takes effect and, where required by law, we will ask for your consent again.
14. Contact and authority
For any questions about this Notice or the processing of your data, write to [email protected].
If you believe your right to the protection of personal data has been violated, you may contact the Secretaría Anticorrupción y Buen Gobierno (Mexico’s Ministry of Anti-Corruption and Good Governance), the competent authority for the protection of personal data held by private parties.