Privacy Policy

1. Who we are

ClickMaker Connect is operated by ClickMaker IT Solutions LLP, an Indian limited liability partnership, for customers in India and internationally. In this policy, "ClickMaker", "we", "us" and "our" mean that entity. "You" means a visitor, account holder or organization using the platform.

For account, billing and website data we are a data controller. For contacts, conversations and message content that a customer organization submits, we are a processor and the organization is the controller.

2. Data we collect

• Account and organization data: name, work email, password hash, organization membership, role, billing country and authentication metadata.
• WhatsApp data: WhatsApp Business Account and phone number identifiers, display names, quality and limit metadata, templates, contacts, conversation records and message content.
• Connection data: encrypted Meta access tokens, token expiry and webhook subscription state.
• Usage and billing data: API requests, message counts, plan limits, invoices, payment status and provider references.
• Security and website data: IP address, request IDs, user agent, audit events, pages visited and form submissions.

3. How we use data

• Provide, secure and operate the platform, including inbox, templates, campaigns, automations and webhooks.
• Authenticate users, enforce tenant isolation, apply permissions and prevent abuse.
• Meter usage, calculate platform charges, process payments through our payment provider and issue billing records.
• Provide support, maintain audit logs, investigate incidents and improve reliability.
• Send service notices and, where permitted, product communications with an opt-out.

4. Legal bases and international processing

Where the GDPR, UK GDPR or similar laws apply, we rely on performance of a contract, legitimate interests for security and service improvement, consent where required, and legal obligation for records we must retain. Where India's Digital Personal Data Protection Act, 2023 applies, we process data for lawful purposes with notice and, where required, consent.

Our infrastructure and subprocessors may process data outside your country. Where required, we use contractual safeguards such as standard contractual clauses and vendor commitments appropriate to the transfer. Customers remain responsible for their own transfer assessments and for obtaining valid consent from their contacts.

5. Sharing and subprocessors

We share data with providers that host, secure and operate the platform, including cloud hosting, PostgreSQL, Redis, object storage, email delivery and error monitoring. We use Dodo Payments for subscription checkout and billing, and Meta processes WhatsApp messages under its own terms.

Subprocessors are bound by confidentiality and data-protection obligations. We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition subject to appropriate safeguards. We do not sell personal data.

A current subprocessor list is available to customers on request. Material changes are communicated through the platform or by email.

6. Retention and security

We retain account and organization records while the account is active and for a reasonable period afterwards to meet legal, tax and dispute obligations. Message retention depends on the customer's plan and configuration. Raw provider webhook payloads are kept only as long as needed for delivery, troubleshooting and audit. Suppression records may outlive deletion so opt-outs are honoured.

We use HTTPS, encryption at rest for Meta credentials, hashed API keys and passwords, HttpOnly cookies, request IDs, rate limiting, tenant-scoped queries, audit logs and least-privilege access. No system is perfectly secure. Customers must protect their credentials and notify us promptly of suspected compromise.

7. Your rights

Depending on your jurisdiction, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on it. This includes rights under the GDPR and UK GDPR, the CCPA/CPRA where applicable, India's DPDP Act and other comparable laws.

Account holders can exercise many rights in the dashboard. Other requests can be sent to the privacy contact on this page. Where a request concerns data controlled by a customer organization, we will direct the request to that organization and assist it as a processor. We may need to verify identity before acting.

8. Children, changes and contact

The platform is a business service and is not directed to children. Customer organizations must not use it to message children in violation of applicable law or Meta policy.

We may update this policy to reflect product, legal or operational changes. Material changes will be communicated through the platform or by email before they take effect where required. Privacy questions and data subject requests can be sent to the privacy contact listed on this page.