Privacy Policy

Overview and roles

ClearWarnings is a product of 5minMindful LLC ("we," "our," or "us"), a Delaware limited liability company at 2803 Philadelphia Pike, Suite B #569, Claymont, DE 19703. It helps small businesses write, issue and keep employee written warnings. This policy explains what information we handle when you use the website, the free generator, or an account.

Two roles. For the records an employer creates about its employees (names, the notes a manager writes, the warning text, signatures and comments), the employer is the data controller: it decides what is recorded and why, and we process that information only to provide the service to the employer. For the information we collect about account holders and website visitors (your email address, sign-in details, analytics, and messages you send us), we are the controller.

ClearWarnings helps you document. It isn't a law firm and doesn't provide legal advice. Nothing in this policy is advice about employment law in your state or country.

The free generator

The written warning generator at /warning-generator works without an account. Here is exactly what happens when you use it:

• Nothing you type is stored on our servers. The notes, the generated warning and the flags exist in your browser and in the request that produces them. We keep no copy.
• The employee's first name never leaves your browser as a name. Before your notes are sent to the writing service, every occurrence of the name you entered is replaced with the placeholder "[Employee]". The name is swapped back in on your screen.
• The notes are sent to Anthropic, the AI provider that writes the draft, under our commercial agreement with them. Anthropic's commercial API terms state that inputs and outputs are not used to train their models.
• Abuse protection. Cloudflare Turnstile checks that a browser, not a script, is making the request, and a rate limiter counts requests per IP address for up to one day. Neither sees your notes.
• Event data only. We record that a warning was generated, its incident type, how long the notes were, and how many flags were raised. Not the text.
• Downloads and copies are produced on request from the text in your browser and are not kept.

If you choose "Save to employee record," the draft is held in your browser's session storage until you finish creating an account, then saved to that account as described below.

Accounts and records

When you create an account, we store:

• Your name, email address and sign-in credentials (passwords are hashed; we never see them).
• Your company as an organization, and who belongs to it.
• Where you came from when you signed up (for example that you arrived from the free generator, and the campaign tags in that link), so we know which parts of the site work.

When you save or create a written warning, we store, on your organization's behalf:

• The employee's name and, if you add them, their email address and job title.
• The incident date and type, and your original notes exactly as you wrote them.
• The AI draft, the version of the prompt that produced it, and the working copy you edit.
• When you issue the document: the final text, the time it was issued, who issued it, and a SHA-256 hash of the final text.
• Any addenda you add afterwards, and any record that the employee declined to sign.

Once issued, a document cannot be edited or deleted through the product, by you or by us, except by deleting the whole organization (see Retention and deletion). Corrections are added as dated addenda. This is what makes the record useful; it is also why you should review a draft carefully before issuing it.

You decide what goes in. You are responsible for having the right to record information about your employees, for keeping it accurate, and for following the employment and privacy laws that apply to you, including any duty to tell employees what you keep about them. Please do not enter medical details, government identification numbers or other sensitive categories of information unless you have a lawful basis to record them.

Signatures and audit trail

When an employee signs a document from a signing link, we record: the full name they typed, the date and time, the IP address and browser (user agent) of the device used, the SHA-256 hash of the exact document version they were shown, and any comments they entered. The signature record cannot be changed afterwards.

Signing links contain a random token that is valid for a limited time and for one signature. We store only a hash of that token. Opening a link records a view event with the time, IP address and browser; nothing else changes until the employee presses the sign button.

Every document has an append-only audit trail: created, issued, viewed, signed, declined, addendum added. Audit entries are kept for as long as the document exists.

If you are an employee

If you received a signing link, your employer is using ClearWarnings to keep a record of a document it issued to you. Your employer decides what that record contains. Signing confirms only that you received and read the document; it does not mean you agree with it, and you can add your own comments before signing.

To see, correct or delete information about you, ask your employer; they control the record and we act on their instructions. If you believe your employer is misusing the service, you can also write to us at privacy@clearwarnings.com.

Services we use

These companies process information for us. Each is bound by its own terms and security commitments.

When we add a transactional email provider for signing links and account email, we will list it here before it goes live. We do not sell personal information and we do not share it with advertisers.

Analytics and cookies

We use PostHog to understand which pages are used and where the generator succeeds or fails. Analytics events carry counts, lengths and categories, never the text of a warning or an employee's name. Visitors from the EEA and the United Kingdom see a consent banner and analytics stay off until they agree; everyone can change that choice from the "Cookie settings" link in the footer.

The cookies we set ourselves are essential: your sign-in session, your region for the consent banner, and your cookie choice. We do not use advertising cookies.

Security

• All traffic is encrypted in transit (TLS), and stored data is encrypted at rest by our database provider.
• Every record is scoped to your organization in the database itself (row-level security), so one company cannot read another's.
• Locks on issued documents, signatures and audit entries are enforced by the database, not only by the application.
• Signing tokens are stored only as hashes. Passwords are handled by our authentication provider and hashed.
• Rate limits and bot protection guard the public generator.

No system is perfectly secure. We have not been independently certified against any security standard, and we do not claim to be. If you discover a vulnerability, write to security@clearwarnings.com.

Retention and deletion

• Free generator: nothing is retained. Rate-limit counters expire within a day.
• Drafts: you can delete a draft at any time.
• Issued documents, signatures, declines, addenda and audit entries: kept for as long as your organization keeps them. They are not editable. They are deleted together when the organization is deleted.
• Accounts: deleting your account removes your profile. If you are the only member of your organization, ask us to delete the organization and all of its records; we will confirm before doing so, because the deletion is permanent.
• Backups: our database provider keeps rolling backups for a short period; deleted data leaves backups on their schedule.

To request deletion, write to privacy@clearwarnings.com from the email address on the account.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete personal information we hold about you, to object to or restrict some processing, and to complain to a supervisory authority. For information we control (your account), write to us and we will respond within 30 days. For information your employer controls (employee records), we will forward your request to the employer or direct you to them.

European Economic Area and United Kingdom. Our lawful bases are the contract with the account holder, our legitimate interest in running and protecting the service, and consent for analytics. Data is stored in the United States; we rely on our providers' standard contractual clauses for transfers.

California. We do not sell or share personal information for cross-context behavioral advertising. You can exercise the rights above by writing to us; we will not treat you differently for doing so.

Children

ClearWarnings is for businesses and their staff. The website and the service are not directed to children under 13, and we do not knowingly collect information from them. If an employer records a document about an employee under 18, the employer is responsible for complying with the laws that apply to that record.

Changes

When this policy changes, the date at the top changes with it. For changes that affect what we collect or how we use it, we will email account holders before the change takes effect.

Contact

Privacy questions: privacy@clearwarnings.com. Everything else: support@clearwarnings.com.

5minMindful LLC, 2803 Philadelphia Pike, Suite B #569, Claymont, DE 19703, United States.