ClawCloud

GDPR overview

Implementation was more concrete than at most providers of this size. ClawCloud published a standalone Data Processing Addendum defining GDPR as Regulation (EU) 2016/679 and incorporating the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914/EU of 4 June 2021, together with a UK Addendum for the UK GDPR. The competent supervisory authority is determined under clause 13 of those clauses. The privacy policy names EEA and UK rights explicitly — objection, restriction of processing, portability — exercised in writing at compliance@claw.cloud, and reminds users they may complain to a supervisory authority. Transfers outside Singapore, the EEA and the UK rest on standard contractual clauses and binding corporate rules. Two gaps remain: no Article 27 EU representative is designated, and no security certification such as SOC 2 or ISO 27001 is claimed anywhere.

Who owns the data?

Clause 4.3 of the terms left customers every right they held in their Member Content: as between the two parties, the customer owned all intellectual property in the data uploaded, and ClawCloud owned the platform. The company undertook not to access or use that content except where necessary to provide or maintain the service, or to comply with the law. For personal data it was the controller of the account information it collected directly, and only a processor for whatever customers stored on behalf of their own end users. One inconsistency deserves attention: clause 7 preserves, after termination, a licence over Member Content that clause 4.3 states was never granted.

Reuse rights

Customers could reuse their own content freely. ClawCloud claimed no ownership and no exploitation right over it, so no permission was needed to copy, move or republish anything a customer had uploaded. The restriction ran the other way: ClawCloud's own material could not be copied, reproduced, downloaded or compiled. Backups were entirely the customer's burden — the terms made them solely responsible for the security, protection and backup of their content. Customers also answered for their end users' activity, and ClawCloud reserved the right to remove, modify or reject unlawful content at its sole discretion. Copyright complaints followed Part IXA of the Singapore Copyright Act, addressed to the company's registered office.

Data retention & training

Hosting summary

Data centres were announced in eight regions: Hong Kong, Tokyo, Singapore, Virginia, Silicon Valley, Frankfurt, Jakarta and London. Customers chose the region when creating an instance, and that choice was final. The privacy policy formalised it as a Selected Region for storing customer content, but reserved a significant right alongside it: unless otherwise agreed in writing, ClawCloud could transfer and store data in other geographic regions or jurisdictions at its sole discretion. International transfers relied on standard contractual clauses, binding corporate rules and comparable agreements. The company was established in Singapore and the terms were governed by Singapore law, with exclusive jurisdiction in Singapore courts. One technical caution: claw.cloud resolves to a Cloudflare anycast address geolocated in the United States, which marks a CDN point of presence and says nothing about where customer data actually sat. No hosting certification such as SOC 2 or ISO 27001 was ever claimed.