Privacy policy

Who is responsible for your data

The controller of personal data about visitors and account holders is the administrator of the clientele.io service. You can reach the administrator about anything in this policy at [email protected].

Businesses that subscribe to Clientele (our customers) store data about their own clients in the service, such as contact details, purchases, preferences and messages. For that client data the customer is the controller and the administrator of the clientele.io service acts as a processor on the customer's behalf, following the customer's instructions and this policy. If you are a client of a store that uses Clientele and want to access, correct or delete your data, please contact that store. If you write to us, we forward your request to the store.

What data we process

• Account data. Name, email address, password (stored only as a secure hash), organization name, role, time zone and the settings you choose.
• Billing data. Plan, billing period, subscription status and invoices. Card details are entered on the payment operator's page and stored by the payment operator, and we receive only limited information such as the card brand and last four digits.
• Customer content. Client profiles, purchases, preferences, important dates, consent records, notes, messages, appointments and imports that customers add to the service.
• Demo data. A client list you upload to the homepage demo without an account. It is stored encrypted and deleted after 24 hours at most.
• Usage and security data. IP address, browser type, pages requested, the audit log of actions in an organization, and error logs.
• Support correspondence. Emails you send to [email protected] and our replies.

Why we process it and on what basis

• To create and run your account and provide the service you subscribe to, as necessary for the contract with you.
• To take payments, issue invoices and keep accounting records, as required by law and necessary for the contract.
• To send service emails such as sign up codes, password resets, billing notices and important changes, as necessary for the contract.
• To keep the service secure, prevent abuse and fix errors, based on our legitimate interest in a safe and working service.
• To process customer content strictly on the customer's instructions, as a processor.
• To answer your questions, based on our legitimate interest or on steps you ask us to take before a contract.

We do not sell personal data, we do not share it for cross context behavioural advertising, and we do not use customer content to advertise to anyone.

AI drafted messages

On paid plans, the service drafts messages for associates. To do this, the relevant parts of a client profile (such as first name, the reason for contact and a suggested product) are sent to an AI model provider, which returns a draft. Drafts are always reviewed and sent by a person. Only the parts needed for the draft are sent, never the full client book.

Who receives the data

We share personal data only with service providers who help us run the service, under contracts that oblige them to protect it and use it only on our instructions. The categories of recipients are:

• a hosting provider, which stores the service and its databases,
• a payment operator, which processes subscription payments and stores card details,
• an email delivery provider, which sends service emails and the emails associates send to clients,
• an SMS delivery provider, which sends text messages associates send to clients,
• an AI model provider, which drafts messages on paid plans.

WhatsApp messages are sent through the customer's own WhatsApp Business account, under the customer's agreement with that platform. We may also disclose data when the law requires it.

International transfers

Some providers may process data outside your country, including outside the European Economic Area. Where that happens, we rely on safeguards recognised by law, such as standard contractual clauses. Enterprise customers can choose EU or US data residency for their customer content.

How long we keep data

• Account data and customer content for as long as the account is active. After an account is closed, customer content is deleted within 90 days, unless the law requires us to keep part of it longer.
• Invoices and accounting records for the period required by tax and accounting law.
• Demo uploads for 24 hours at most.
• Security and error logs for up to 12 months.
• Support emails for up to 3 years after the last message.

Customers can export or erase individual client records at any time from the client profile.

How we protect data

Client email addresses, phone and WhatsApp numbers, notes and integration credentials are encrypted at rest. The service is served over HTTPS, access within an organization follows roles, data is separated per organization, and actions such as viewing, exporting and deleting client records are logged. See security and privacy for details.

Your rights under GDPR

If GDPR or a similar law applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent, without affecting earlier processing. You may also complain to your local data protection authority.

Your rights under CCPA

If you are a California resident, you have the right to know what personal information we collect, use and disclose, to request deletion, to request correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the CCPA. We will not discriminate against you for exercising these rights.

How to exercise your rights

Write to [email protected] from the email address linked to your account, or describe how we can confirm your identity. We answer within one month, or within the period the applicable law sets. Requests about data a store holds about you go to that store, as explained above.

Cookies

The service sets only essential cookies for sign in, security and preferences. Read the cookie policy.

Children

The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. Material changes are announced to account holders by email before they take effect.