Skip to content
Clientele
Get started

Security and privacy

Clienteling GDPR compliance and security

Clienteling GDPR compliance starts with proof of consent. Clientele records consent per channel with its date and source, encrypts client contact details and notes at rest, limits access by role, logs who viewed or exported what, and exports or erases one client's data on request.

Show my Money Feed See pricing

Privacy controls in Clientele and the request they answer

Consent per channel

What Clientele does
Status, date captured, source, staff member and withdrawal date for WhatsApp, SMS and email
Helps you with
Proving consent for marketing messages

Send check

What Clientele does
No message on a channel without granted consent, only inside quiet hours set per organization
Helps you with
Respecting choices and local hours

Encryption at rest

What Clientele does
Email addresses, phone and WhatsApp numbers, notes and integration credentials encrypted in the database
Helps you with
Security of processing

Roles

What Clientele does
Owner, manager and associate, with associates limited to their own book
Helps you with
Access on a need to know basis

Audit log

What Clientele does
Who viewed, created, exported, reassigned or deleted a client, when and from which address
Helps you with
Accountability and investigations

Export

What Clientele does
One client's full record as a file: profile, consents, purchases, notes, messages, appointments
Helps you with
Access and portability requests

Erasure

What Clientele does
Personal data removed, anonymous record keeps purchase totals only
Helps you with
Deletion requests under GDPR and CCPA
Retail operations manager reviewing client data access and consent records on a laptop in a quiet office

Why clienteling raises the privacy bar

Clienteling is personal by design. Associates know a client's sizes, their partner's birthday, the piece they hesitated over, and they message them on the same apps the client uses with friends. That closeness is what sells, and it is also why regulators and clients expect more care than a newsletter list.

Under GDPR in Europe and CCPA in California, a store needs to show why it holds each piece of data, prove consent for marketing messages, keep data secure, and answer access and deletion requests. In practice, the hard part is not the policy. It is the personal phone with a WhatsApp history nobody can audit, the spreadsheet of VIPs on a shared drive, and the associate who leaves with the client book. Moving clienteling into one system with consent and roles solves most of that.

Consent recorded per channel, checked on every send

WhatsApp, SMS and email each have their own consent record on the client profile. A record holds the status, the date it was captured, where it came from (a CSV import with consent columns, a Shopify marketing flag, or an associate recording it at the counter) and who recorded it. When a client withdraws, the date is kept.

When an associate presses send, Clientele checks consent for that channel first. Without granted consent, the message does not go out. Messages also respect quiet hours, by default 8:00 to 20:00 in the client's time zone, set per organization. Every change of consent is written to the audit log with the old and new status.

From the Brand plan, campaign lists (segments) apply the same consent filter, so a list for an event invitation by WhatsApp only includes clients who agreed to WhatsApp. Read more about digital clienteling with consent.

Security of processing

How client data is protected

  1. 01

    Encryption at rest

    Client email addresses, phone and WhatsApp numbers and notes are encrypted in the database. Credentials for connected integrations are encrypted as well.

  2. 02

    Separation per organization

    Every request is scoped to the organization of the signed in user, so one retailer's clients are never reachable from another account.

  3. 03

    Access by role

    Owners and managers see every book. Associates see their own book and unassigned clients. Enterprise adds SSO, SCIM and custom roles.

  4. 04

    Audit log

    Opening a profile, exporting, reassigning, changing consent, inviting staff and deleting are logged with user, time and address.

  5. 05

    Encrypted in transit

    The app and every page are served only over HTTPS.

  6. 06

    Short lived demo data

    Client lists uploaded to the homepage demo are stored encrypted and deleted after 24 hours at most.

Access and deletion requests in minutes

When a client asks what you hold about them, a manager opens the profile and exports a file with everything: contact details, consents with dates and sources, preferences, important dates, household, purchases with items, wishlist, notes, messages and appointments. The export is logged.

When a client asks to be forgotten, the manager erases the profile. Names, contact details, dates, notes, preferences, wishlists, consents, feed items and message bodies are removed. An anonymous record keeps purchase totals so the store's sales reports stay correct, and the erasure itself is written to the audit log. A deleted client still counts toward the plan's profile limit for that period, because limits count usage, not rows.

Books that stay with the business

Client books belong to the organization, not to an associate's phone. When someone leaves, a manager removes their access and reassigns their clients, and the reassignment is logged. See the client book app page for how that works day to day.

Your role and ours

For the client data you put into Clientele, your business is the controller and Clientele acts as a processor on your behalf. We use that data only to provide the service you subscribe to. Messages are drafted for an associate to review, and a person always presses send.

Clientele works with a small set of subprocessors in these categories: a hosting provider, a payment operator, an email delivery provider, a messaging provider for SMS, and an AI model provider for drafting messages. WhatsApp messages go through your store's own WhatsApp Business number. Details are in the privacy policy.

Enterprise security

Enterprise, at $2,499 a month billed yearly, adds SSO with SAML, SCIM provisioning, custom roles, a choice of EU or US data residency, priority support with a named contact, a data processing agreement and security review documentation, with the same self serve checkout as the other plans. See every plan on the pricing page.

Clientele is clienteling software built so personal outreach and privacy work together. Questions about security go to [email protected].

FAQ

Security and privacy questions from retail teams

Does Clientele make my store GDPR compliant?

No software can make a business compliant on its own. Clientele gives you the tools that GDPR and CCPA work depends on: consent per channel with date and source, access by role, an audit log, encryption at rest, and export or erasure of one client's data on request. How you collect consent and which lawful basis you rely on remain your decisions as the controller of your clients' data.

Who is the controller of my clients' data?

You are. Your business decides which clients to add and how to contact them, so you are the controller of that data. Clientele processes it on your behalf to provide the service. Enterprise plans include a data processing agreement and security review documentation.

How is consent proven for WhatsApp, SMS and email?

Each client has a separate consent record per channel with its status (granted, denied, withdrawn or unknown), the date it was captured, the source (for example import, Shopify or recorded by an associate), the staff member who recorded it and the date of any withdrawal. Messages cannot be sent on a channel without granted consent.

What happens when a client asks to be deleted?

A manager erases the client from the profile. Names, contact details, dates, notes, preferences, wishlists, consents and message bodies are removed, and an anonymous record keeps only purchase totals for the store's accounting. The erasure is written to the audit log.

Can associates see every client?

No. Associates see their own client book and unassigned clients. Owners and managers see every book in the organization. Enterprise adds SSO with SAML, SCIM provisioning and custom roles.

Where is client data hosted?

Enterprise plans include a choice of data residency in the EU or the US. On other plans data is hosted by our hosting provider, and you can ask [email protected] for the current location before you buy.

Keep reading

See consent and profiles on a sample client book

The homepage demo builds a sample Money Feed from a client list, with no account. Uploaded demo lists are deleted after 24 hours at most.

Show my Money Feed See pricing

Plans from $99 a month billed yearly. Subscriptions only, cancel at the end of any period.