Privacy Policy

1. Data Controller

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you create an account.
• Organization Data: Company name, branding preferences, and portal configurations.
• Payment Information: Billing details processed through Stripe. We do not store your full card number.
• Support Requests: Messages and information you send when contacting us.

2.2 Information from ClickUp

When you connect your ClickUp workspace via OAuth, we access workspace data (tasks, statuses, time entries, custom fields) as needed to display it in your client portals. We only read data from ClickUp; we do not modify it.

2.3 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, and interaction patterns.
• Technical Data: IP address, browser type, device information, operating system.
• Analytics Data: Collected via Swetrix (privacy-focused, cookieless analytics).

3. How We Use Your Information

3.1 Primary Purposes

• Service Delivery: Operating your account, generating client portals, and syncing ClickUp data.
• Billing: Processing subscription payments and managing your plan.
• Communication: Responding to support requests and sending service-related notifications.
• Improvement: Analyzing usage patterns to improve the product.
• Security: Detecting and preventing fraud, abuse, and unauthorized access.

3.2 Legal Bases for Processing (GDPR)

• Contract Performance: Providing the Service you signed up for.
• Legitimate Interest: Product improvement, security, and fraud prevention.
• Consent: Marketing communications (you can opt out at any time).
• Legal Obligation: Compliance with applicable laws.

4. Information Sharing

We do not sell your personal information. We share data only with these categories of service providers:

• Supabase: Database hosting and authentication.
• Stripe: Payment processing.
• ClickUp: Workspace data integration (initiated by you via OAuth).
• Swetrix: Privacy-focused website analytics (no personal data shared).
• Hosting Providers: Infrastructure and content delivery.

We may also disclose information when required by law, court order, or to protect our rights, your safety, or the safety of others.

5. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS) and at rest.
• ClickUp OAuth tokens encrypted with AES-256-GCM before storage.
• Row Level Security (RLS) policies for multi-tenant data isolation.
• Regular security assessments and access controls.

6. Data Retention

• Account Data: Retained while your account is active. Deleted within 30 days of account deletion.
• ClickUp Tokens: Deleted immediately when you disconnect your workspace or delete your account.
• Payment Records: Retained as required by tax and accounting laws.
• Analytics Data: Aggregated and anonymized; no personal identifiers stored.
• Support Requests: Retained for up to 2 years for service improvement.

7. Your Privacy Rights

7.1 General Rights

• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data.
• Opt-out: Unsubscribe from marketing communications at any time.

7.2 GDPR Rights (EU Residents)

• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

7.3 CCPA Rights (California Residents)

• Know: Right to know what personal information is collected.
• Delete: Right to request deletion of personal information.
• Opt-out: Right to opt out of the sale of personal information (we do not sell your data).
• Non-discrimination: Right not to be discriminated against for exercising your rights.

To exercise your rights, contact us at hello@clientglance.com. We will respond within 30 days (or as required by applicable law).

8. International Data Transfers

Your data may be processed in the United States. For transfers from the EU, we rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards to protect your data.

9. Cookies and Tracking

We use a minimal set of cookies and tracking technologies:

9.1 Essential Cookies

Required for the Service to function. These include authentication session cookies and security tokens. You cannot opt out of these.

9.2 Analytics

We use Swetrix, a privacy-focused analytics tool that does not use cookies and does not track personal information. It collects only aggregated, anonymized usage data such as page views and referral sources.

9.3 No Third-Party Tracking

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking cookies. We do not serve ads or share browsing data with advertisers.

10. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of external sites. Review their privacy policies before providing personal information.

11. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we become aware of such collection, we will delete the information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service and update the "Last Updated" date. Continued use after changes become effective constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us:

Supervisory Authority (EU Residents)

If you are an EU resident and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection authority.