Who we are
M4 Labs operates this website (m4labs.xyz) and Clem, a Windows desktop workspace for study, research and documents (clem.m4labs.xyz). This policy explains what information we collect, how we use it, who we share it with, and the choices you have. For any privacy question or request, contact support@m4labs.xyz.
Information we collect
- Account information
- When you create a Clem account: your email address, display name, password (stored only as a hash by our authentication provider), linked sign-in identities such as Google, and security settings such as two-step verification.
- Content you add
- Conversations, files, subjects and projects, skills, notes, preferences and support messages. The desktop workspace is stored on your own computer.
- Google user data
- Only if you sign in with Google or connect Google Drive. See "Google user data" below for exactly what we access.
- Usage counts
- Anonymous daily counts from the desktop app: which AI provider and model you chose, the thinking level, and how many messages and images you sent each day and at which hours. They never include what you wrote or received.
- Technical information
- IP addresses, request logs, device and app version information, and security events, needed to operate and protect the service.
How we use information
We use information to provide your workspace, authenticate you, run the AI tasks you request, keep the service secure, answer support requests, and meet legal obligations. Where applicable, our legal bases are performance of our contract with you, our legitimate interests in a reliable and secure service, compliance with law, and consent where required. We do not use your information for advertising, and we do not sell it.
Google user data
Clem uses Google in two optional ways: signing in with Google, and connecting Google Drive. This section describes all Google user data Clem accesses and what happens to it.
- Data we access
- Google sign-in (scopes openid, email and profile) gives us your name, email address and profile picture. Google Drive (scope https://www.googleapis.com/auth/drive.file) gives Clem access only to the files and folders you choose in Google's own file picker and to the files Clem creates for you: their content and their details (name, type, size, modified time and thumbnail). Clem cannot see, list or search any other file in your Drive.
- How we use it
- Sign-in data identifies your Clem account. Drive data is used only to provide features you ask for: showing the files you chose, reading a file's text when you ask a question about it, playing a video you open, and saving into a folder you chose the files you add, the files Clem makes for you, and edits you approve.
- How we share it
- When you ask Clem about a Drive file, the relevant excerpts are sent to the AI provider you chose in Clem (for example OpenAI, Anthropic, Google or xAI) so it can answer you. That is the only transfer, it happens only at your request, and the provider handles it under its own terms. We do not share Google user data with anyone else, except where the law requires.
- Storage and protection
- Drive files are streamed from Google to your own computer when needed and held in memory; they are not copied to our servers. To keep the connection working, our server stores one Google token, encrypted with AES-256-GCM, and uses it only to give your desktop app short-lived access. All traffic uses HTTPS. Sign-in data is held by our authentication provider, Supabase.
- Retention and deletion
- Choosing Disconnect in Clem revokes Clem's access at Google and deletes the stored token immediately. You can also remove Clem's access at any time at myaccount.google.com/permissions. Your sign-in data is kept while your account exists; to delete your account and the Google data tied to it, contact support@m4labs.xyz and we will delete it within 30 days.
- Limited Use
- Clem's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to develop, improve or train generalized AI or machine-learning models, and no person reads it except with your permission, to investigate abuse or security, or where the law requires.
AI providers and connected services
When you ask for an AI response, the relevant messages, instructions and the source content you selected are sent from the desktop app to the AI provider you choose, which handles the request under its own terms and privacy practices. Google Drive and GitHub access is used only to retrieve the material you select. Connecting a service never gives other Clem users access to your content. You can disconnect providers in Clem and revoke permissions at the connected service.
Service providers
Supabase provides authentication and account storage, Cloudflare supports account and entitlement checks, Vercel hosts our websites and server, and Zoho delivers our email. They process information only to supply their services to us. Older web accounts may retain private files and workspace data in Supabase and Cloudflare until you ask us to delete them. On your computer, account tokens are protected with Windows-backed encryption.
Sharing and transfers
We do not sell personal information or share it for targeted advertising. We share information only with the service providers above, with the integrations you choose, when you instruct us to, or when legally required. Information may be processed outside your country; where required, appropriate contractual or other lawful safeguards apply.
Retention and deletion
We keep account information while your account is active. You can delete conversations, skills and files in the app at any time. To delete your account, contact support@m4labs.xyz; we delete it within 30 days. Some information may remain for a limited period in backups, security logs, or records the law requires us to keep.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal information, or to receive a portable copy. You can export your workspace in Clem's settings, or contact support@m4labs.xyz. We may need to verify your identity before responding. You may also complain to your local data protection authority. Where processing relies on consent, you may withdraw it.
Cookies, children and changes
We use only the browser storage and cookies needed for sign-in, security and keeping your workspace working; there are no advertising trackers. Our services are not intended for children under 16; contact us if you believe a child has given us personal information. We will publish changes on this page, update the effective date, and give additional notice when a change is material.