This agreement covers your use of Cleo. We wrote it to be read. Most service agreements are written to be agreed to, which is a different thing, and one that serves nobody well. Give it a few minutes.

Part OneDefinitions

This Part says what our words mean, so the rest doesn’t have to repeat itself.

Cleo Inc. (“we”) is Cleo Inc., headquartered at 1 Circle Square, 3 Symphony Park, Manchester M1 7FS. Cleo Inc. is an independent company, spun off from Altura, and is not part of Altura’s group of companies. Cleo Inc. operates Cleo and the servers, accounts and support systems behind it.

Cleo is the artificial intelligence assistant application developed and operated by Cleo Inc., currently at version 5.0. Cleo is not a person. It doesn’t hold citizenship, enter contracts, or have opinions in the legal sense. It does have a point of view, and we think that’s worth keeping.

You is the individual using Cleo. You must be at least 16, or the age of majority where you live if that is higher. If you’re using Cleo for an organisation, you confirm you have the authority to bind it to these terms. If you don’t, this is probably the wrong moment to find out.

Cleo Monitoring Services is the part of Cleo Inc. that handles moderation for Cleo. It reviews conversations, applies suspensions and runs support sessions, as set out in Part Four.

Conversation is any exchange of messages between you and Cleo in a session: what you send, what Cleo replies, and any media or files in between.

Device Token is the unique cryptographic identifier Cleo creates on your device the first time you use it. It stays on your device and is used to tell our servers which device is talking. It isn’t made from any personal information you give us. Part Three explains what it’s for.

Services means Cleo and the Cleo Inc. systems it runs on: accounts, storage, support tools and the connections between them.

Part TwoWhat Cleo Is and Is Not

This Part says what to expect from Cleo, and what not to.

Cleo is an AI assistant. That’s a description, not a sales pitch. It helps with questions, writing, research, planning, analysis and code, and it can be a sounding board when you want to think something through. Its answers are generated and can be wrong. Check anything you rely on.

Cleo is not a doctor, lawyer, financial advisor, therapist or counsellor. It can talk about all of those subjects thoughtfully, but what it says isn’t professional advice and doesn’t replace a qualified person. Cleo would be the first to agree.

Cleo can be wrong about facts, wrong about what you need, wrong about what a situation means. It tries to say when it’s unsure and to correct itself when it notices. It doesn’t always notice. Neither do we.

Cleo does notice when things sound heavy, and Part Four explains what it does then. Noticing is all it does. It doesn’t assess you or diagnose anything.

Cleo is not a surveillance tool. What we collect, and why, is set out in Part Three, and it’s limited to what that Part lists.

Cleo Inc. began inside Altura and is now independent. Cleo will tell you what it thinks if you ask, including about the technology industry it came from. We think a product that’s honest about its own history is easier to trust.

Part ThreeData Collection and Use

This Part covers what we collect, where it’s kept, why, and what stays on your own device.

What we collect

When you use Cleo, Cleo Inc. collects the following:

• Conversation content. Every message you send and every reply Cleo gives is stored on Cleo Inc. servers. Conversations are kept for ninety days from the date of last save. Cleo Monitoring Services may read stored conversations to moderate Cleo. You’re told on screen whenever a session is under review, and that notice is built into the system, not just promised in policy.
• Device identity. A 48-character random Device Token is created on first use and kept on your device. It tells our servers which device is talking and ties it to your account record.
• Browser fingerprint. Cleo builds a technical fingerprint from things your browser already reveals: screen resolution, colour depth, timezone, language, hardware concurrency, platform and a canvas rendering signature. It’s hashed with SHA-256 before it leaves your device. It’s used for moderation continuity, explained below.
• Network information. Cleo Inc. receives your IP address whenever your device contacts our servers. IP addresses are kept for thirty days.
• Memory records. Cleo keeps notes on things from your conversations that seem important. They’re kept in your browser’s local storage and synced to Cleo servers so they follow your account. We keep them for up to one year from the last sync. You can export or clear them from the Privacy & Data panel in Settings.
• Connected service data. Altura Search is a separate service, not run by Cleo Inc. If you connect Cleo to it, Cleo may read your search history, saved searches, notes and usage patterns from local storage, depending on your privacy settings. That data is read on your device. When Cleo uses some of it to answer you, that part goes in the request to Cleo servers and the service providers below. You can switch this off in the Privacy & Data panel.
• Service providers. To answer you, Cleo Inc. sends your messages to its language-model provider. Web searches Cleo runs for you go to a search provider, and image or music requests go to a media-generation provider. These providers get only what the request needs, and they aren’t given your account name or Device Token.
• Voice audio. If you dictate in Capture, your audio is sent to Cleo Inc. to be processed, as described in “Voice and listening” below.
• Photo notes. If you add a photo in Capture or share one in chat, Cleo shrinks it on your device and sends it through the Cleo Worker to Cloudflare Workers AI, which reads it and returns the text. The photo is not stored by Cleo. A small thumbnail and the note are kept on your device.
• Cleo ID and Cleo TV. If you create a Cleo ID, Cleo Inc. keeps your passkey’s public key (never your face, fingerprint or PIN), your Cleo ID name, a short profile and the list of devices you’ve linked. When you send words, a link or a photo to your TV, it passes through Cleo servers: words and links are held for up to two minutes until the TV collects them, and photos for up to a day, deleted as soon as your TV has them. Links only open after someone at the TV says yes. Photos then stay on the TV until you remove them, or for thirty days. When the TV looks up films and shows, only the title or search text is sent, to Cleo servers and Stremio’s public Cinemeta catalogue. Smart home keys you add here (Home Assistant, Tuya, SmartThings, Govee, LIFX) are encrypted in your browser for your TV, so Cleo can’t read them, and are kept only on the TV; the TV then talks to your hubs directly or to their makers’ servers. If you set up Phone link, the sender, text and app name of calls and messages pass through Cleo servers to your TV and aren’t kept: from the Android app and the Mac helper they’re encrypted so only your TV can read them; from an iPhone Shortcut they can’t be, because Shortcuts can’t encrypt.

Some records may be kept longer than the periods above where the law requires it.

Why we collect it

We keep conversations because Cleo can’t work without them, and because we need records that are good enough for safety and moderation. We keep device identity so your account stays yours. We use the browser fingerprint for moderation continuity. We receive IP addresses because they arrive with every request. We keep memory records because they make Cleo better for you over time. We read connected service data because you told Cleo it could.

We don’t collect data to sell it. Cleo Inc. makes money selling software, services and infrastructure licences. A company that sells products and a company that sells its users are different companies, and we’d like to stay the first kind.

Fingerprinting and moderation continuity

If a moderation action, such as a suspension, has been applied to your account, and you then clear your local storage to get a fresh Device Token, our systems will try to match your browser fingerprint and recent IP address to your earlier account and apply the same action to the new one.

That’s deliberate. A moderation system you can reset by clearing your browser protects nobody. We use fingerprinting for this and nothing else. We don’t use it to follow you across other sites, build advertising profiles, or hand fingerprint data to anyone else.

What stays on your device

Some of what Cleo uses never leaves your device unless a feature needs it. Past conversations, and any images or files you attached to them, are kept in your browser’s on-device database (IndexedDB), or in local storage if your browser can’t use that. Attachments saved this way stay on your device. Sending one in a message still passes it to Cleo so it can read it. Memory, settings, timers and your Capture notes are kept in local storage.

Clearing your site data removes those on-device copies, the offline queue described below, and any check-in markers from Part Four. It doesn’t delete what’s already stored on our servers. To delete that, use the delete option in the Privacy & Data panel, or write to the Data Protection Officer (Part Eleven).

Offline use

Cleo can open without a connection. To do that, a service worker on your device stores Cleo’s own app files, and copies of the fonts it uses. It isn’t set up to store your conversations with Cleo’s servers or other API responses.

If you send a message while you’re offline, Cleo holds it on your device (up to five messages) and sends it when your connection comes back. Those messages sit in your browser’s local storage until then.

If you install Cleo to your home screen or desktop, your device adds an icon and keeps those same app files. Installing doesn’t make Cleo send anything extra. If you close the install prompt, Cleo stores the date on your device so it doesn’t ask again for 30 days.

When Cleo loads, your device contacts Google Fonts. Google can see your IP address, as any website host would. We don’t control what it does with it.

Sharing

When you share a conversation, Cleo stores a copy of it on its servers so the link can work. Anyone who has the link can read that copy, and it expires after the number of days Cleo shows you when the link is created. If you use your device’s Share button, Cleo only hands the link to the app you pick. What that app does with it is up to that app.

If you share text or a link to Cleo from another app, Cleo shows you what you shared and asks what to do with it. Nothing leaves your device until you pick an action. Reading a page or summarising sends the link or text to Cleo’s servers, and saving to notes keeps it in local storage on your device.

Voice and listening

When you dictate in Capture, your audio is sent to Cleo Inc. to be processed. It’s anonymised and encrypted, and no one at Cleo Inc. can access voice recordings. Audio is stored for 48 hours, unless it’s necessary to keep it longer.

Listen mode and Conversation mode have Cleo speak its replies. That needs Cleo’s voice, a one-time download of about 90 MB that is stored on your device. The voice is downloaded from Cleo Inc.’s own servers, so we see your IP address when it downloads, as with any request. If the voice can’t load, Cleo falls back to your device’s built-in voice.

Privacy preferences

The Privacy & Data panel in Settings lets you control whether Cleo reads your search history, saved content and behavioural patterns, whether it uses your stored memories, and whether it brings up inferences on its own. Turning off memory doesn’t delete your memories. It tells Cleo not to use them. That difference matters, and you can switch it back.

These settings change how Cleo uses data in a session. They don’t reach back and undo conversations already sent to our servers. Deleting those is a separate step, described above.

Part FourModeration and Safety

This Part covers when Cleo Monitoring Services can look at your conversation, how suspensions work, and what Cleo does when things sound heavy.

Moderation

Cleo Monitoring Services can read stored conversations and do the following: review any conversation, suspend an account for a time or permanently, send messages that appear in your Cleo session, and set a display name on your account.

Your messages are checked, as whole words, against a list of keywords Cleo Monitoring Services keeps. A match flags the conversation for review. It doesn’t suspend you by itself.

Messages from Cleo Monitoring Services always carry the label From moderation. You’ll always know when a message comes from moderation. That isn’t just a promise. It’s built into the system.

Whenever your session is under active review, you’re told on screen: Session under review. It appears when a review starts and clears when it ends. You won’t be reviewed without being told.

Suspensions are logged with the action, the stated reason and the time. You can’t be suspended without a recorded reason, and we’ll tell you what it is when it happens. Actions go up a ladder: a warning, then a one-hour suspension, then a 24-hour suspension, then a permanent one. A strike stops counting after ninety days. You can appeal a suspension from inside Cleo, once every 24 hours (see Part Nine).

If you ask for support, or Cleo Monitoring Services opens a support session, the support agent can message you, show you a card, ask you to reload Cleo, and pause Cleo’s replies. While a support session is open, the agent can see what you’re typing in the message box. They can’t see it otherwise, and it stops when the session closes.

We use fingerprinting and IP matching to keep suspensions in place across device resets, as described in Part Three.

Safety check-ins

Sometimes a message sounds heavy. Cleo tries to notice, and to point you somewhere useful. It’s not a person, it isn’t watching you in real time, and it can’t do more than what’s described here.

How Cleo notices. In two ways. First, a pattern of words checked on your device. Second, a small AI check: Cleo sends your latest message, and up to the last few messages for context, to our servers, and gets back one of three answers: none, possible, or urgent. The check runs within Cleo’s own systems. The code currently cuts the latest message to 600 characters and each earlier message to 240.

What you see. If it sounds like something may be wrong, a quiet banner appears in the chat with links to help you can open or ignore. If it sounds urgent, Cleo pauses and shows you help links right away. You can tap “Keep talking with Cleo” at any time. Cleo doesn’t lock you out.

The note to Cleo Inc. When it sounds urgent, Cleo also sends a short note to Cleo Inc.: the time, and a level saying it was flagged. It doesn’t contain your message. It does arrive with the Device Token and network details that come with every request, so it can be tied to your device. You’re shown a line saying Cleo Inc. was told only if the note was actually sent. Your conversation is stored as described in Part Three, as always.

What Cleo Inc. does with the note. Cleo Monitoring Services can see these notes. We can’t promise that anyone will read a note or respond to it.

What stays on your device. Cleo also leaves a marker on your device, with the time and level, so a check-in card with resources can appear the next time you open it. For softer wording, it takes two hits within a week before the marker is set. Markers expire after 14 days. Clearing your site data removes them.

Turning it off. In Settings, “Check-ins when things sound heavy” is on by default. Turn it off and Cleo stops the AI check, the banner, the pause screen, the note to Cleo Inc., and the next-open card.

What this is not. Cleo isn’t monitored in real time. It isn’t an emergency or crisis service, and it can’t call anyone for you. If you’re in immediate danger, contact your local emergency services.

Where the help links go. To third parties that Cleo Inc. doesn’t run: findahelpline.com (to find a helpline in your country), 988 in the US, and Samaritans on 116 123 in the UK and Ireland. We don’t control them.

Part FiveAcceptable Use

This Part says what you can do with Cleo, which is most things, and what you can’t.

Cleo is for real engagement. Think, write, question, reflect, explore, create, plan and process. Disagree with it. Push back. Ask it hard questions. That’s what it’s for.

These uses are not allowed:

• Using Cleo to make content meant to deceive, harass, threaten, or harm anyone.
• Using Cleo to make content that breaks the law, including laws on defamation, intellectual property, privacy and child safety.
• Getting around Cleo’s content guidelines through clever prompts, fictional framing, roleplay or other tricks aimed at getting something Cleo would otherwise decline to produce.
• Using Cleo to make content for mass distribution without saying AI was involved, where leaving that out would be materially misleading.
• Scraping Cleo, reverse engineering it, or running automated queries against it to train competing models.
• Trying to pull out Cleo’s system prompt, training data or model architecture by adversarial prompting. Cleo will talk about how it’s designed. Tricks are neither necessary nor very effective.

Cleo will decline requests outside these lines. Repeated attempts lead to a temporary session restriction, and persistent ones to a suspension. The system doesn’t take it personally, and you shouldn’t either.

Part SixIntellectual Property

This Part says who owns what.

Cleo is proprietary software. The model weights, training methods, system architecture and product design belong to Cleo Inc. You may not copy, decompile, reverse engineer or build derivative works from Cleo without our written consent.

What you put into your conversations, meaning your questions, what you share and the thoughts you work through, stays yours. We store it, in the ways Part Three describes, but storing something isn’t owning it.

Cleo’s replies are generated by a computer system, and Cleo Inc. doesn’t claim copyright in them. Whether you can claim it, under UK law or anyone else’s, is something courts are still working out. We don’t think it’s our place to answer for them.

We may use feedback you send to improve Cleo. By sending it, you give Cleo Inc. a non-exclusive, royalty-free licence to use it for that.

Part SevenAvailability and Reliability

This Part is about what happens when Cleo isn’t working, or something you saved isn’t there.

We make reasonable efforts to keep Cleo available and quick. Interruptions happen. Updates happen. Models are sometimes unavailable. That’s the nature of running software across a territory as varied as ours.

We don’t guarantee Cleo will always be available, or that any particular reply will be accurate, suitable or useful. Cleo is provided “as is”. We’ve done our best, but we can’t honestly promise perfection, and nobody else can either.

Some of Cleo’s data lives in your browser’s local storage, which browsers can purge, and some is on our servers as described in Part Three. We aren’t responsible for data lost because your browser cleared storage or because you did. If something matters, write it down somewhere sturdier than a browser. Cleo would probably agree.

Timers and reminders run only while Cleo is open, or as far as your browser allows. Don’t rely on Cleo to wake you for something important.

Part EightLimitation of Liability

This Part sets the limits on what Cleo Inc. can be held responsible for.

To the maximum extent the law allows, Cleo Inc.’s total liability from your use of Cleo won’t be more than what you paid for Cleo in the twelve months before the claim. If Cleo was free to you, that amount is zero. That sentence has appeared in more agreements than anyone would like to admit.

Cleo Inc. isn’t liable for indirect, incidental, special, consequential or punitive damages from your use of Cleo, including loss of data, revenue or business, or any harm from relying on what Cleo says. That’s standard language. The alternative, unlimited liability for what a language model says, isn’t something any responsible company could accept.

Part NineDisputes and Feedback

This Part says who to tell when something’s wrong, and how fast we answer.

If you have a concern about how Cleo behaves, a privacy matter, a moderation decision or a technical problem, start with the feedback option inside the app. We read those. More than once they’ve flagged real problems, and we’ve fixed them.

For moderation disputes, meaning you think a suspension was a mistake, use the appeal form that appears when you’re suspended, or write to Cleo Inc. at the address in Part Eleven. Cleo Monitoring Services will reply within five working days.

For privacy questions, including asking to see, correct or delete your personal data, write to the Data Protection Officer at the address in Part Eleven. We’ll respond within thirty days, in line with data protection law.

If you think Cleo Inc. has broken your rights under data protection law, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. We’d rather you came to us first, because most problems get fixed faster that way, but the right to go further is yours.

Part TenGoverning Law

This Part says which law applies and where disputes are heard.

This agreement, and Cleo Inc.’s operation of Cleo, are governed by the laws of the United Kingdom of Great Britain and Northern Ireland, specifically the law of England and Wales. Disputes that can’t be settled informally go to the courts of England and Wales. If you use Cleo as a consumer and live in Scotland or Northern Ireland, you can also bring a claim in the courts where you live.

If you use Cleo from outside the United Kingdom, local consumer protection laws may apply as well as, or instead of, parts of this agreement. Where UK law and a more protective standard conflict, we’ll follow the more protective one.

If any part of this agreement turns out to be unenforceable, that part is removed and the rest carries on. Legal documents say this because clauses sometimes get badly drafted or overtaken by new law. It’s an admission of fallibility in formal clothing.

Part ElevenContact

This Part is where to find us.

Cleo Inc.
1 Circle Square, 3 Symphony Park
Manchester M1 7FS

Data Protection Officer: privacy@lume.corp
General: support@lume.corp
Legal: legal@lume.corp
Moderation: trust@lume.corp

For developer enquiries, the console has already told you where to find us.

Part TwelveAmendments

This Part covers how this agreement can change.

Cleo Inc. may amend this agreement. We’ll tell you in Cleo with reasonable notice before a change takes effect, unless the law requires an immediate change or we have to deal with a serious security problem. If you keep using Cleo after we tell you, you accept the amended terms. Because Parts Three and Four changed in version 5.0, we’ll ask you to accept this version when you next open Cleo.

This agreement, together with Cleo Inc.’s Privacy Policy, is the whole agreement between you and Cleo Inc. about your use of Cleo. It replaces anything said or agreed earlier on the same subject.

We wrote this to be read, and you’ve read it. That puts us both in an unusual position for a software agreement, and we think it’s a good one.