ClioX

Privacy Policy.

Last UpdatedDecember 12, 2025

At ClioX, we believe that data sovereignty is a fundamental right. This policy outlines how we protect your information while building the trust layer for the AI era. Clio-X Data Solutions Limited ("ClioX", "we", "us", or "our") respects your privacy and is committed to protecting your personal information.

01

Privacy Contact details

For questions related to privacy, contact:

Clio-X Data Solutions Limited

2366 Main Mall

Vancouver, BC Canada V6T 1Z4

Email: info@cliox.io

If you have any questions about the protection of your personal data at ClioX, please contact our Privacy Officer:

Privacy Officer

Victoria Lemieux

Clio-X Data Solutions Limited

2366 Main Mall

Vancouver, BC Canada V6T 1Z4

Email: info@cliox.io

02

What's personal data?

Personal data is any information that can be (directly or indirectly) related to you. ClioX processes a minimal amount of personal data, as we believe your personal data belongs to you. We process the following personal data.

  • IP address:Your IP address is processed when visiting and using our portal demonstrator.
  • E-mail:If you contact ClioX via e-mail, we process your e-mail address and any personal data you decide to provide in your message (such as your name).

For detailed information about the processing operations, lawfulness, purposes, and how your personal data serves to reach these purposes, please take a look at the chapter "Processing operations according to Article 13 GDPR".

03

Recipients and cross-border data transfer

Vercel

When visiting and using our portal demonstrator, your IP address is processed by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel is a service provider that hosts our portal demonstrator. Our portal demonstrator is served by Vercel using a Content Delivery Network, a geographically distributed network, with servers located in different geographic and legal jurisdictions. This means, if you are located within the EEA, your IP address will most likely (but not guaranteed) be processed on a Vercel server within the EEA. Further information about the purpose, legal basis, and retention period can be found in chapter 4.

There is no adequacy decision for the USA from the European Commission. Our cooperation with Vercel is based on a Data Processing Agreement (DPA) including Standard Contractual Clauses (SCC). You have the right to receive a copy of these SCC. To exercise your right, please contact us at info@cliox.io.

Exoscale and OVH Cloud

When using our portal demonstrator functionalities, your IP address is processed by our portal demonstrator backend. Portal demonstrator backend components are managed by deltaDAO and hosted on

  • Exoscaleservers located in Frankfurt, Germany. Akenes SAE (hereafter Exoscale) is headquartered in Boulevard de Grancy 19A, 1006 – Lausanne, Switzerland.
  • OVH Cloudservers located in Germany, France and Poland. OVH GmbH is headquartered in Oskar-Jäger-Str. 173/K6, 50825 Cologne.

DeltaDAO's cooperation with Exoscale and OVH GmbH is based on a Data Processing Agreement (DPA).

  • Here you can find Exoscale's current DPA.
  • Here you can find OVH GmbH's current DPA.

Further information about the purpose, legal basis, and retention period can be found in chapter 4.

Microsoft Corporation

When you contact us via e-mail, our (mail) service provider Microsoft Corporation (located at 1 Microsoft Way, Redmond, Washington 98052-8300, USA) supports us in processing your personal data so we can communicate with you. There is no adequacy decision for the USA from the European Commission. We have restricted storage on the EEA and signed SCC with our provider. You have the right to receive a copy of these SCC. To exercise your right, please contact us at info@cliox.io.

Further information about the purpose, legal basis, and retention period can be found in chapter 4.

Reown and Coinbase Global

Reown, Inc. (WalletConnect protocol) and Coinbase Global, Inc. (WalletLink protocol) process IP addresses for protecting your security by assessing the legitimacy of the Data Space’s domain and providing warnings about detected issues. Reown, Inc. and Coinbase Global, Inc. are located in the US. There is no adequacy decision for the USA from the European Commission.

Further information about the purpose, legal basis, and retention period can be found in chapter 4.

Plausible

ClioX relies on deltaDAO's use of Plausible Analytics (by Plausible Insights OÜ, Västriku tn 2, 50403, Tartu, Estonia, Registration number 14709274), a privacy-friendly web analytics tool for tracking overall trends in our website traffic. deltaDAO signed a DPA with Plausible Analytics. Further information about the purpose, legal basis, and retention period can be found in chapter 4.

04

Processing operations

We process your personal data for the following purposes.

4.1 Providing our portal demonstrator and ensuring its security

Your IP address is collected, used, and stored when visiting our portal demonstrator. Our portal demonstrator (frontend) is hosted externally by our service provider Vercel (see also chapter 3).

Purpose:Collecting and using your IP address is necessary for providing our portal demonstrator because it is a technical requirement for ensuring communication between your device and our portal demonstrator. Your IP address and other log file data are also processed for security, fraud-prevention, abuse-prevention, and troubleshooting purposes.
Legal basis:The legal basis for this processing is our legitimate interest.
Legitimate interests:Our legitimate interest is to provide the portal demonstrator and to enable security, a technically error-free presentation, and the optimization of the portal demonstrator.
Retention period:Vercel retains your personal data for as long as needed to provide their services. Additionally, Vercel does not delete the data when it is needed for the establishment, exercise, or defense of legal claims. In this case, the information is retained as long as needed for exercising respective potential legal claims.
Right to object:You have the right to object to the processing of your personal data (see also chapter 8.6).

4.2 Providing portal demonstrator functionalities

When using our portal demonstrator functionalities (viewing, publishing, editing and consuming services, and requesting tokens), your IP address is collected, used, and stored by our portal demonstrator backend. Backend components are managed by deltaDAO and hosted on Exoscale and OVH Cloud (see also chapter 3).

Purpose:Collecting and using your IP address is necessary for providing our portal demonstrator functionalities because it is a technical requirement for ensuring communication between your device and our portal demonstrator backend.
Legal basis:
  • The legal basis for this processing is our legitimate interest. Our Legitimate interest is to display services on the portal demonstrator to you.
  • The legal basis for this processing is the performance of a contract.
Retention period:IP addresses received by the backend components are only retained for the minimum time necessary to process the transaction. They are erased automatically, usually within a few minutes.
Right to object:You have the right to object to the processing of your personal data where we based the processing on legitimate interests (see also chapter 8.6).

4.3 Contact via e-mail

If you contact us via e-mail, ClioX collects, uses, and stores your e-mail address, and any other information you provide us in your message, such as your name. When you send us an e-mail, our (mail) service provider Microsoft Corporation (see also chapter 3) supports us in processing your personal data so we can communicate with you.

All contact form submissions are processed exclusively within Canada on University of British Columbia (UBC) servers, which are compliant with and protected under the Personal Information Protection and Electronic Documents Act (PIPEDA).

Purpose:We collect, use and store this personal data to respond to your inquiries.
Legal basis:The legal basis for this processing is our legitimate interest.
Legitimate interests:Our legitimate interest is to answer your inquiries.
Retention period:We store your personal data as long as we need it to process your inquires. We store your personal data beyond this period if we are obliged to do so due to retention obligations under tax and commercial law or in the event of legal disputes. If the latter is the case, your personal data will be erased after the retention period has expired.
Right to object:You have the right to object to the processing of your personal data (see also chapter 8.6).

Compliance with PIPEDA’s Ten Principles of Privacy:

At ClioX, our privacy policy reflects all ten principles of fair information practices, as mandated by PIPEDA:

1. Accountability:ClioX takes full responsibility for the personal information under its control. Our designated Privacy Officer oversees compliance with PIPEDA's principles and ensures our privacy practices meet regulatory requirements. All personnel are trained and accountable for protecting customers’ personal information.
2. Identifying purposes:We identify the purposes for collecting personal information before or at the time of collection.
3. Consent:We obtain meaningful consent for collecting, using, or disclosing personal information, except where required or permitted by PIPEDA or other law(s). Consent may be "expressed" (verbally, in writing, or electronically) or "implied " through actions, such as continued use of our services after notification of privacy policy updates.
4. Limiting collection:We collect only the personal information necessary for identified purposes.
5. Limiting use, disclosure, and retention:Personal information is used or disclosed only for the purposes for which it was collected unless consent is obtained or disclosure is permitted by law. We retain this information only as long as necessary to fulfill the identified purposes or meet legal requirements.
6. Accuracy:We maintain accurate, complete, and up-to-date personal information as necessary for the identified purposes.
7. Safeguards:We protect personal information with security safeguards appropriate to its sensitivity level.
8. Openness:Our privacy policies and practices regarding personal information management are readily available upon request. We provide clear documentation explaining our policies, standards, and codes through multiple accessible formats.
9. Customer access:PIPEDA gives you a general right to access the personally identifiable information (PII) held by businesses subject to this law. Under PIPEDA, you need to make your access request in writing and pay a minimal fee of $30.00. If any organizational fees seem unjust, you have the right to complain about this. We retain the right to decide how we disclose the copies of your PII to you. We will take all necessary measures to fulfill your request within 30 days from receipt, otherwise, we must inform you of our inability to do so before the 30-day timeframe if: Meeting the time limit would unreasonably interfere with our business activities; or the time required to undertake consultations necessary to respond to the request would make it impractical to meet the time limit. We can also extend the time limit for the length of time required to convert the personal information into an alternative format. In these circumstances, we will advise you of the delay within the first 30 days and explain the reason for it.
10. Challenging compliance:You are welcome to direct any questions or inquiries concerning our compliance with this privacy policy and PIPEDA requirements by contacting our Privacy Officer. You may request a correction to any factual errors or omissions within your PII. We would ask you to provide some evidence to back up your claim. Under PIPEDA, an organization must amend the information, as required, if you successfully demonstrate that it’s incomplete or inaccurate. If we fail to resolve your concern to your satisfaction, you may also contact the Office of the Privacy Commissioner of Canada: 30 Victoria Street Gatineau, QC K1A 1H3 Toll Free: 1.800.282.1376 www.priv.gc.ca

4.4 Aggregated statistics

ClioX relies on deltaDAO's use of Plausible Analytics (see also chapter 3), a privacy-friendly web analytics tool for tracking overall trends in our website traffic. Plausible Analytics does not use cookies or similar technologies that require information to be stored on your device. Instead, the tool focuses on analyzing aggregated data without the need to access your end device or store information there. Plausible Analytics does not track individual visitors and does not create persistent identifiers. It does not use cross-platform or cross-device tracking and does not pass on data to third parties. Plausible Analytics primarily uses data that is recorded by default in server logs, such as requested URLs, access times, HTTP status codes and transferred data volumes. This information is used to analyze website traffic. Data processing at Plausible Analytics takes place in two steps:

  • Pseudonymization: When the data is received, it is pseudonymized using a hash function and a regularly changing key (“salt”). This process aims to change personal data in such a way that data subjects are no longer directly identifiable, but a distinction between sessions is made possible.
    hash(daily_salt + website_domain + ip_address + user_agent)
    Plausible Analytics never stores the raw data IP address and User-Agent in logs, databases or anywhere on disk at all.
  • Anonymization after 24 hours: Within 24 hours of pseudonymization, the data is completely anonymized by removing the “salt” so that it can no longer be traced back to the original user data. The remaining data does not allow any direct or indirect identification of data subjects.

Plausible Analytics only uses EU-based service providers for hosting and additional services such as CDN and DDoS protection. The servers are located in Germany (operated by Hetzner) and additional services are provided by Bunny (based in Slovenia).

Purpose:We process your personal data to reach measurement and website optimization.
Legal basis:The legal basis for this processing is our legitimate interest, according to Art. 6(1)(f) GDPR.
Legitimate interests:Our legitimate interest is to gain insights to improve existing and future features and services, and to evaluate user engagement.
Retention period:As described above, your personal data is anonymized after 24 hours.
Right to object:You have the right to object to the processing of your personal data (see also chapter 8.6).

4.5 Recognize malicious traffic

When visiting and using our portal demonstrator, your IP address is processed by Reown, Inc. and Coinbase Global, Inc. (see also chapter 3).

Purpose:Your IP address is transmitted to Reown and Coinbase servers and used for protecting your security by assessing the legitimacy of the Data Space’s domain and providing warnings about detected issues, e.g., if an address is flagged as malicious.
Legal basis:The legal basis for this processing is our legitimate interest.
Legitimate interests:Our legitimate interest is to protect your security.
Retention period:Reown retains IP addresses for the minimum time necessary to process the transaction. They are erased automatically, usually within a few minutes. Coinbase retains your personal data for as long as needed to provide their service.
Right to object:You have the right to object to the processing of your personal data (see also chapter 8.6).
05

Automated decision making

Automated decision making including profiling does not take place.

06

Cookies and Analytics

6.1 Cookies

A cookie is a small file that stores information in your browser. Your web browser downloads it on the first visit to a website. The next time you open this website with the same device, the cookie and the information stored in it are either sent back to the website that created it (first-party cookie) or sent to another website it belongs to (third-party cookie). This enables the website to detect that you have opened it previously with this browser and, in some cases, to vary the displayed content. Some cookies are necessary for making websites work, and others are used for enhancing your experience on the visited website. Cookies can also be used for marketing and analytics purposes. Web storage (local storage and session storage) has similar functionality to cookies.

Our portal demonstrator uses cookies and your web storage to remember your page preferences, enable functionalities and to enhance your user experience. You have the option of disabling cookies and deleting cookies and web storage from your computer's hard disk at any time in your browser settings.

6.2 Analytics

ClioX relies on deltaDAO's use of Plausible Analytics, a privacy-friendly web analytics tool for tracking overall trends in our website traffic. Plausible Analytics does not use cookies or similar technologies that require information to be stored on your device. Plausible Analytics does not track individual visitors and does not create persistent identifiers. It does not use cross-platform or cross-device tracking and does not pass on data to third parties. You can find further information in chapter 3 and 4.

08

Your rights

If you want to make use of your rights described below, do not hesitate to contact us.

  • 8.1 Right of access

    You have the right to obtain confirmation as to whether ClioX processes personal data about you. If we are processing personal data about you, you have the right to access these personal data and to gain the information.

  • 8.2 Right to rectification

    You have the right to obtain without undue delay the rectification of inaccurate personal data about you. Additionally, you have the right that incomplete personal data about you are completed.

  • 8.3 Right to erasure

    You have the right to obtain without undue delay the erasure of personal data about you, where the defined legal grounds apply.

  • 8.4 Right to restriction

    Moreover, you have the right to obtain the restriction of processing your personal data where the defined legal grounds apply.

  • 8.5 Right to data portability

    You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Additionally, you have the right to transmit those data to another controller without hindrance, where the defined legal grounds apply. You can make use of your right to data portability by contacting us.

  • 8.6 Right to object

    On grounds relating to your particular situation, you have the right to object to the processing of your personal data where we based the processing on legitimate interests. If you object, ClioX will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing, overriding your rights, freedoms, and interests, or if the processing is required to establish, exercise, or defend legal claims.

  • 8.7 Right to lodge a complaint

    You have the right to lodge a complaint with a supervisory authority if you consider the processing of your personal data by ClioX to infringe the law in your jurisdiction. You can lodge a complaint in particular in the Member State of your habitual residence, in the Member State of your place of work, and in the place of the alleged infringement.

09

Questions

For any requests regarding our privacy policy, please send us an e-mail to info@cliox.io.

10

Changes to the Privacy Policy

We adjust this policy from time to time, by publishing a new version on our portal demonstrator. You can find the date of the current version at the beginning of this policy. The latest version of this policy applies to the processing of your personal data.

End of Document

Thank you for trusting ClioX.

Partnerwith us.

Ready to regain sovereignty over your data infrastructure? Our team is here to help you architect the future.

Office

Vancouver, BC
Canada