Privacy Policy

01Who we are

Clickflox (“Clickflox”, “we”, “us”) is run by Kenoxis Technologies Private Limited, registered at G-283, Third Floor, Sector-63, Noida, Gautam Buddha Nagar, Uttar Pradesh 201309, India. This policy covers our website, the Clickflox app, the hosted lead forms our customers publish, and our API.

Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data of our customers, their team members and visitors to our website. For personal data that customers put into Clickflox about other people, such as the leads their forms collect, the customer is the Data Fiduciary and we are its Data Processor (see Leads and WhatsApp). In the language of the GDPR, a Data Fiduciary is a controller and a Data Processor is a processor.

02What we collect

• Account details. Your name, email address and password when you sign up. We store your password only as an Argon2 hash, never as readable text. We also store your business or agency name, its type and country, and each team member’s role.
• Workspace details. For each business you advertise: its name, website address, industry, country, currency, time zone and languages, your goals and budgets, the places you target, and your spend limits and automation settings.
• Website content. The text of the public pages of the website you ask us to read, and the facts we find in it (see Reading your website).
• Your work in Clickflox. Research, plans, campaigns, ad copy, images and videos, approvals and recommendations, and an audit log of who changed what and when.
• Ad-account data. When you connect an ad platform (Google Ads, Meta, Microsoft Advertising, ChatGPT Ads, Snapchat, Spotify, LinkedIn, X or TikTok) or PostGrid for postcards: account names and IDs, campaigns, budgets, and results such as spend, clicks and conversions (see Data from ad platforms).
• Leads. What people enter in your lead forms, or what you import: usually a name, phone number, email address, city, message and answers to your questions, with their consent and the ad that brought them.
• Billing. Your plan, credit balance and credit history. Payment details go straight to our payment providers. We receive only the payment reference, amount and status, and the details needed for invoices, such as your billing name, address and GST number.
• Keys you add. If you add your own AI provider keys, we store them encrypted.
• Early-access requests. Your name, work email, business, website, role, country, monthly ad spend range, the plan you’re interested in and your message.
• Messages to us. What you send when you contact us.
• Technical data. When you sign in, we keep a session record with your browser’s user agent and the time you signed in. Our servers keep standard logs, such as IP address, time and the address requested, for security and troubleshooting.
• AI usage. For each AI request: the task, provider, model, tokens used, credits charged and time taken, so you can see what it cost.

03How we use it

• To provide Clickflox: your account and workspaces, reading your website, research, plans, ads, publishing, leads, reports, recommendations and billing.
• To keep Clickflox and your accounts secure, and to prevent fraud and abuse.
• To send you service messages, such as security alerts, low credit balances, failed payments and changes to our policies.
• To answer your questions and your early-access request.
• To understand how Clickflox is used and to improve it, using aggregated figures where we can.
• To meet our legal duties, such as keeping tax records and answering lawful requests.

We send marketing emails only if you agree to them, and every one has a link to stop them.

Under the DPDP Act, we process your personal data with your consent, or for a legitimate use the Act allows, such as when you give us your details for a purpose like opening an account. You can withdraw consent at any time; that doesn’t affect what we did before. Under the GDPR and similar laws, our legal bases are our contract with you, our legitimate interests in running and protecting Clickflox, your consent, and our legal obligations.

04Cookies

Clickflox sets one cookie of its own, kx_session. It keeps you signed in, so the app can’t work without it.

• It is set when you sign up or sign in, and lasts 30 days or until you sign out.
• It is HTTP-only, so scripts on the page can’t read it.
• We store only a hash of its value, not the value itself.

The app also uses your browser’s local storage to remember which workspace you opened last.

We don’t use advertising or analytics cookies, and we don’t let other companies track you on our website. Our hosted lead forms set no cookies. When you pay, the checkout from Stripe or Razorpay may set its own cookies to process the payment and prevent fraud; their privacy policies cover those.

05Reading your website

When you add a website, our crawler, ClickfloxBot, reads its public pages. It:

• follows the site’s robots.txt and reads its sitemap;
• reads up to 30 pages and stays on that website;
• reads only pages that anyone can see without signing in.

We store the text of the pages it reads and the facts we find in them, such as services, prices, offers, locations and the contact details the business publishes, each with the page it came from. We also note the addresses of images on the site, so your ads can use your own photos. We use all of this to build your Brand Brain, plans and ads.

Please ask us to read only a website you own or are allowed to use for advertising.

06Data from ad platforms

Clickflox connects to Google Ads, Meta (Facebook and Instagram), Microsoft Advertising, ChatGPT Ads (OpenAI), Snapchat, Spotify, LinkedIn, X, TikTok and PostGrid only through their official APIs. For most of them you sign in on the platform’s own page and choose what to allow; for ChatGPT Ads and PostGrid you paste an API key from your own account, which we encrypt and use only for your workspace. We never see or store your passwords for those platforms.

We use this access only for the features you use:

• showing your ad accounts, campaigns and results;
• checking and publishing the campaigns you approve, and making the changes you approve or allow, such as pausing a campaign or changing a budget;
• reporting spend, clicks and conversions next to your verified leads;
• if you turn it on, bringing in leads from the platform’s lead forms, and sending lead results back to the platform so it can find more customers like your best ones.

Access tokens are encrypted at rest. We don’t sell this data, use it for advertising, or use it to train AI models. People at Clickflox look at it only when you ask us to, for example for support, or when it’s needed for security or required by law.

You can disconnect an ad account in Clickflox at any time, or remove Clickflox in the platform’s own settings. When you do, we delete the stored access tokens and stop syncing. To have the data we already hold deleted, see Deleting your data.

Google. Clickflox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Postcards and TikTok posts. For postcards, the addresses stay in the mailing list you keep in PostGrid: Clickflox sends PostGrid the postcard design and tells it which of your lists to mail. When you post a video to TikTok, we send TikTok the video, the caption and the settings you chose, and show you its status.

The other platforms. We use data from Meta, Microsoft, OpenAI, Snap, Spotify, LinkedIn, X, TikTok and PostGrid in the same limited way, in line with each platform’s developer terms, such as the Meta Platform Terms and the Microsoft Advertising API Terms of Use.

07Leads and WhatsApp

Businesses use Clickflox to collect and follow up leads. For lead data, the business is the Data Fiduciary (controller) and decides how it is used. Clickflox is its Data Processor. That means:

• we process lead data only to provide Clickflox to that business, on its instructions;
• we never sell it, use it for our own marketing, or share it with other customers;
• we don’t send it to AI providers;
• the business can export its leads at any time, and can ask us to delete them.

Our hosted lead forms show the business’s name and its consent text. We record whether the person agreed, the ad that brought them (UTM tags and click IDs such as gclid and fbclid), the lead’s stage and when the business first replied.

Businesses must have a lawful basis, such as consent, to collect leads and to contact them, and must follow the law and the platforms’ rules when they do.

If you sent your details to a business through a Clickflox form, please contact that business to see, correct or delete them. If you contact us instead, we’ll pass your request to the business and help it respond.

WhatsApp messages

Clickflox helps businesses reply to new leads on WhatsApp in one of two ways:

• Click-to-chat. Clickflox makes a WhatsApp link with a ready-written message. The business opens it and sends the message from its own WhatsApp. The chat happens in WhatsApp, and Clickflox doesn’t see it.
• Automatic reply. If automatic replies are switched on, Clickflox sends an approved WhatsApp message template, with the person’s first name, to the phone number in the enquiry, through Meta’s WhatsApp Business Platform. Meta handles the message under its WhatsApp terms. We record that the reply was sent and when.

08AI providers

Clickflox works without any AI provider. In template mode, research, plans, ad copy and images come from our own templates, and nothing is sent to an AI provider.

When AI is switched on, we send the provider only what the task needs:

• to read your website: the text of the pages we read;
• for research: your business facts, offers, locations and goals;
• for ad copy: your business facts and offers, and the campaign’s goal, channel and languages.

We don’t send leads, ad-account data or payment details to AI providers.

The provider is Anthropic, OpenAI, or a server with an OpenAI-compatible API, such as an open-source model on our own servers. Anthropic and OpenAI act as our processors, under business terms that don’t let them train their models on what we send. If you add your own AI key, requests for your workspaces go to that provider, under your own agreement with it.

09Who we share it with

We never sell personal data. We share it only with:

• Service providers that host and run Clickflox for us, such as cloud hosting, databases, file storage and email delivery. They may use it only to provide their service to us, and must protect it.
• AI providers, when AI is switched on (see AI providers).
• Payment providers: Stripe for payments in US dollars and Razorpay for payments in India. They collect your card, UPI or bank details directly, under the PCI DSS security standard. We never see or store your full card number.
• Ad platforms and WhatsApp, when you connect them and ask Clickflox to publish, sync or send messages.
• People in your account. Owners and admins can see all of the account’s workspaces. An agency’s clients see only the workspaces shared with them.
• Professional advisers, such as lawyers and auditors, who must keep it confidential.
• Authorities, when the law requires it, for example under a court order.
• A buyer or successor, if Clickflox is sold or merged. They must protect personal data as this policy says, and we’ll tell you before it happens.

For the current list of service providers that process personal data for us, email support@clickflox.com.

10Where we process it

Clickflox and its service providers may store and process personal data outside your country, for example with AI providers in the United States. When we transfer personal data out of India, we do so as the DPDP Act allows. When we transfer it out of the European Economic Area or the UK, we use safeguards the law recognises, such as standard contractual clauses.

11How long we keep it

• Account and workspace data: while your account is open. After it closes, we delete it, or remove anything that identifies you, within 30 days.
• Leads: until the business deletes them or closes its account.
• Ad-platform access tokens: until you disconnect the ad account or close your Clickflox account.
• Sessions: a session ends when you sign out, or after 30 days.
• Audit log: for as long as the workspace exists, so you can always see who changed what.
• Billing and tax records: as long as tax and company law require, which in India can be up to eight years.
• Security logs: up to one year, unless the law requires longer.
• Early-access requests: until we offer you access or you ask us to delete them, and no longer than two years.
• Backups: deleted data can stay in encrypted backups for up to 30 days before they are overwritten.

12How we protect it

• Data travels over encrypted HTTPS connections.
• Passwords are hashed with Argon2, and session tokens are stored only as hashes.
• Ad-platform access tokens and AI keys are encrypted at rest.
• Each workspace is kept separate, and every request is checked against the person’s account and role.
• Every change, by a person or an AI agent, is written to an append-only audit log.
• Only staff who need access to run Clickflox have it.

No system is perfectly secure. If a breach affects your personal data, we will tell you without delay, and tell the authorities the law requires us to, such as the Data Protection Board of India.

13Your rights

Wherever you live, you can ask us to:

• give you a copy of your personal data, or a summary of what we hold and how we use it;
• correct, complete or update it;
• delete it;
• give it to you in a machine-readable format, such as CSV or JSON, so you can move it;
• stop using it for a purpose you agreed to, by withdrawing your consent.

In India, the DPDP Act also lets you find out which other Data Fiduciaries and Data Processors we have shared your data with, nominate someone to exercise your rights if you die or can’t act yourself, and have a grievance handled by us. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.

In the European Economic Area, the UK and places with similar laws, you can also object to processing based on our legitimate interests, ask us to restrict processing, and complain to your local data protection authority.

We don’t sell personal information, and we don’t share it for cross-context behavioural advertising.

How to ask. Email support@clickflox.com from the email address on your account. We may ask you to confirm who you are, and we reply within one month. If your request is about a lead that a business collected, see Leads and WhatsApp. You can also export your leads as a CSV file from the Lead Center at any time.

14Deleting your data

This is how to delete your Clickflox account and its data, including the data we received from Meta, Google and Microsoft.

To delete your account and all its data:

1. Sign in as the account owner, open Settings, and under Your data choose Delete account. You confirm with the account name and your password.
2. The account, its workspaces, leads, creatives, generated files and the data we received from connected ad platforms are deleted straight away, and we email you a confirmation. Copies in encrypted backups are gone within 30 days. We keep only what the law requires, such as tax records.
3. If you can’t sign in, email support@clickflox.com from the account owner’s email address. We confirm the request with you and delete the data within 30 days.

To get a copy of your data first: in the same place, Export data downloads everything in the account as one file.

To delete only the data from an ad platform: disconnect the ad account in Clickflox, or remove Clickflox from the connected apps in your Facebook, Google or Microsoft account settings. That stops our access straight away. Then email us, and we’ll delete the data we already received from that platform within 30 days.

Before you close your account, export anything you want to keep, such as your leads.

15Children

Clickflox is for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect children’s personal data. Customers must not use Clickflox to collect children’s data or to aim ads at children. If you think a child has given us personal data, contact us and we will delete it.

16Changes to this policy

We’ll update this policy when Clickflox or the law changes. The date at the top shows when it last changed. If a change affects you in an important way, we’ll tell you by email or in the app before it takes effect.

17Contact and Grievance Officer

Kenoxis Technologies Private Limited, G-283, Third Floor, Sector-63, Noida, Gautam Buddha Nagar, Uttar Pradesh 201309, India.

• Privacy questions and requests: support@clickflox.com
• Grievance Officer: Shyam Shankar Shukla, support@clickflox.com

We acknowledge complaints within 48 hours and resolve them within one month. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India or, outside India, to your local data protection authority. See Contact us for every way to reach us.