Privacy Policy
1. Who is responsible for your data
This Policy explains how Claq processes personal data, in line with the EU General Data Protection Regulation (GDPR), the UK GDPR, the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and applicable US state privacy laws.
- Controller of your account data (sign-up, login, subscription, support): João Pedro Gonzales Magri, an individual entrepreneur (sole proprietor) based in Apucarana, Paraná, Brazil. Contact: suporte@claq.work.
- Data your agency enters about its clients, contacts and team: your agency is the controller and Claq is its processor, as set out in our Terms. If you are a client of an agency that uses Claq, please contact that agency first.
- Payment data: Paddle.com, our Merchant of Record, processes your payment and billing details as an independent controller under its own privacy policy.
2. What data we collect
| When | Data |
|---|---|
| Sign-up | Agency name, your name, email, password (stored with one-way encryption; we cannot see it) and, if you choose to add it, your company's tax ID. |
| Team invitations | Name, email and role of the invited person. |
| Using the app | Technical access logs (date, time, IP address and browser) and the activity history inside the agency. |
| Subscription | Plan, billing cycle, payment status, invoice amounts and Paddle customer and subscription IDs. Card details are entered in Paddle's checkout; we never receive them. |
| Emails and support | Which account emails were sent, whether you opted out of reminders, and the messages you send us. |
| Agency content | What the agency enters: clients, contacts, projects, quotes, equipment, schedule, logo and text. |
| Brief form | What a visitor fills in on an agency's public brief form (for example, name, email, phone and project details). This data goes to the agency that owns the form. |
| Waitlist | Name, email, company, country and the plan you are interested in, when you join a waitlist on our website. |
We collect this data directly from you or from your agency. Providing account and billing data is necessary to use Claq; without it we cannot provide the service.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR art. 6 / LGPD art. 7) |
|---|---|
| Creating and maintaining your account, authenticating access and providing the service | Performance of a contract |
| Billing your subscription and keeping tax and accounting records | Performance of a contract and legal obligation |
| Preventing fraud and abuse (such as repeated free trials or automated sign-ups) and keeping the service secure | Legitimate interests |
| Sending service notices (email confirmation, password reset, billing) | Performance of a contract |
| Sending account reminders and review requests, always with an option to opt out | Legitimate interests |
| Sending news and marketing content | Consent, which you can withdraw at any time |
| Answering support requests, responding to authorities and defending legal claims | Legitimate interests and legal obligation |
We do not sell or rent personal data, we do not share it for cross-context behavioral advertising, and we do not use agencies' content for advertising or to train AI models. We do not make decisions about you based solely on automated processing.
4. Who we share it with (sub-processors)
Only with the providers needed to run Claq, and only what each one needs:
| Provider | Purpose | Location |
|---|---|---|
| Paddle.com | Merchant of Record for purchases outside Brazil: checkout, payments, invoices, sales tax/VAT and refunds | United Kingdom, with processing in other countries |
| Supabase | Database, authentication and server functions | United States |
| Lovable | Hosting of the website and the app | Cloud infrastructure, multiple regions |
| Cloudflare | Bot protection on sign-up (Turnstile) | Global network |
| Resend | Sending the app's emails | United States |
| ImprovMX and Google (Gmail) | Receiving and answering support emails sent to suporte@claq.work | United States and other countries |
| Asaas | Payment processing for customers in Brazil only | Brazil |
| BrasilAPI | Public company registry check (CNPJ), Brazilian customers only | Brazil |
We may also disclose data to public authorities when required by law or court order, or to a company that takes over Claq. Within each agency, data is visible only to that agency's team, and each person sees only what their role allows. One agency never sees another agency's data.
5. International transfers
Claq is operated from Brazil, and some providers process data in other countries, mainly the United States. When personal data from the European Economic Area, Switzerland or the United Kingdom is transferred to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or, where available, the provider's certification under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
- Account and agency data: while the account is active.
- After cancellation or the end of the trial: up to 90 days in read-only mode, so the agency can export its data. Then it is deleted, and backups are overwritten within 30 days.
- Billing and tax records: for the period required by law (usually 5 years).
- Access logs: 6 months.
- Waitlist data: until you ask us to remove it or we launch the service in your region and you choose not to sign up, and in any case no longer than 2 years.
- To prevent repeated free trials, we keep a marker of the email and tax ID already used for as long as needed for that purpose.
7. How we protect it
- Connections are always encrypted (HTTPS/TLS).
- Passwords are stored with one-way encryption.
- Separation between agencies and role permissions are enforced in the database itself, not just on screen.
- Administrative access requires two-factor authentication and is limited to what is needed for support and maintenance.
- Payment card data never touches our systems.
No system is 100% secure. If a security incident creates a relevant risk, we will notify the affected agencies and the competent data protection authorities, as required by law.
8. Your rights
Depending on where you live, you can ask us to:
- confirm whether we process your data and give you a copy of it;
- correct inaccurate or incomplete data;
- delete your data, or restrict its processing;
- object to processing based on legitimate interests, including at any time to direct marketing;
- receive your data in a portable format;
- withdraw consent, where processing is based on consent, without affecting earlier processing.
To exercise your rights, email suporte@claq.work. We will reply within 30 days and will not discriminate against you for exercising them. We may need to verify your identity. You also have the right to lodge a complaint with your local data protection authority (in the EU, the authority of your country; in the UK, the ICO; in Brazil, the ANPD).
US residents: in the last 12 months we collected the categories of data described in section 2 (identifiers, commercial information, internet activity) for the purposes in section 3, and disclosed them only to the service providers in section 4. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about you.
9. Cookies and similar technologies
We only use storage that is strictly necessary: the app stores your session and simple preferences (such as language) in your browser, Cloudflare Turnstile helps block automated sign-ups, and Paddle's checkout uses its own cookies to process payments securely and prevent fraud. We do not use advertising or tracking cookies. Our website may record aggregate visit statistics that do not identify you. Because we only use strictly necessary technologies, we do not show a cookie consent banner.
10. Children
Claq is a service for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
11. Contact
For any question about privacy and data protection, contact João Pedro Gonzales Magri, Apucarana, Paraná, Brazil, at suporte@claq.work.
12. Changes to this Policy
We may update this Policy. The date at the top shows the latest version. We will announce material changes in the app or by email before they take effect.
Questions? Write to suporte@claq.work.