Contents
Information We Collect
We collect information you provide, information your business stores in the platform, and information generated as you use it:
- Account information: Name, email address, password (stored only as a secure hash), role, and the business account you belong to. Account owners provide this when signing up; team members are added by their account owner.
- Your customers’ data: Names, phone numbers, email addresses, addresses, tags, notes, lead status and any other details your team chooses to import or record about your business’s customers.
- Communication data: The content and delivery status of WhatsApp messages, SMS messages and email campaigns sent or received through your connected channels, and replies from your customers.
- Integration credentials: API keys and access tokens your business enters to connect its own WhatsApp, email and SMS provider accounts, and OAuth tokens for connected social media accounts.
- Billing information: Your plan, subscription status, billing interval and invoice history. Payment card details are collected and stored by our payment processor, Stripe, and never reach our servers.
- Security and device data: IP address, browser and device information, a device identifier used to recognise trusted devices, sign-in history and security events such as sign-ins, verification codes and session changes.
- Media files: Images, videos, audio and documents your team uploads to the media library or attaches to templates, campaigns and social posts.
We do not use third-party advertising or analytics trackers, so we don't collect browsing behaviour across other websites.
Who Is Responsible for Your Data
Cligo plays two different roles depending on the data:
- Your customers’ data: your business is in control. Each business decides what information it stores about its own customers and how it contacts them. For this data the business is the data controller, and Cligo processes it only on that business’s instructions to provide the service.
- Account and billing data: Cligo is responsible. For information about account owners and team members (sign-in details, security logs, subscription and billing), Cligo is the data controller.
How We Use Your Information
We use information only to provide, secure and improve the service:
- Create and manage your account, verify your email address and recognise trusted devices
- Control access within your team according to roles (Admin, Manager, Agent, Staff)
- Store and organise your business’s customer records
- Send and receive WhatsApp, SMS and email messages through the channels your business has connected
- Publish or schedule content to the social media accounts your business has connected
- Generate AI-assisted text for social media posts when your team requests it
- Show analytics on message delivery and campaign performance
- Process subscriptions, trials, plan changes and invoices
- Enforce your plan’s limits, and keep the service secure, including detecting fraud and abuse
- Respond to support requests and send essential service emails such as verification codes
We do not sell your data, use it for advertising, or use your business's data or your customers' data to train AI models.
Payments
Paid plans are billed through Stripe. When you subscribe, you enter your payment details on Stripe's secure checkout or billing portal, so your card number never passes through or is stored on our servers.
We store the identifiers Stripe gives us for your customer record and subscription, your plan, billing interval (monthly or annual), subscription status and renewal dates, and we can retrieve your invoice history from Stripe to show it to you and to our platform administrators. Stripe processes payment data under its own privacy policy.
AI Cold Calling (Coming Soon)
AI-assisted outbound calling is not yet available to customer accounts. When it becomes available, it will place calls through our voice provider, Telnyx, following a conversation flow your business defines, and may involve:
- Recording and transcription: Where your business enables recording, the call audio and a transcript, stored so the call can be reviewed.
- AI summaries: A summary, outcome and lead details generated from the transcript using Google’s Gemini API.
- Compliance data: Do Not Call status, calling-hours eligibility (in the contact’s own timezone) and attempt counts, checked before every call.
We will update this policy with full details before the feature is offered to customers.
Data Security
We use industry-standard measures to protect your data:
- Every account’s data is isolated from every other account on the platform
- All traffic is encrypted in transit over HTTPS/TLS
- Passwords are hashed with bcrypt and never stored in plain text
- Integration credentials and social media tokens are encrypted at rest with AES-256-GCM
- Signing in from a new device requires a verification code sent to your email
- Access tokens expire after 1 hour and sessions after 30 days; you can review and sign out your devices at any time
- Role-based access control limits what each team member can see and do
- Sign-in and verification attempts are rate-limited to resist password guessing
- Uploaded files are stored separately for each account in cloud storage (Cloudflare R2)
No system is completely immune to breaches. If a breach affects your information, we will notify affected account owners promptly in accordance with applicable law.
Data Retention
We keep data only as long as needed to provide the service:
| Data | Kept for |
|---|---|
| Account, customer records, messages, campaigns and files | Until your team deletes them, or until your account is deleted |
| Data in an account whose trial or subscription has lapsed | Kept, read-only, so you can view or export it or resume a plan, until the account is deleted |
| Social media tokens | Until the account is disconnected |
| In-app notifications | 90 days, then deleted automatically |
| Sign-in and security logs | 180 days, then deleted automatically |
| Billing records | Held by Stripe as required for accounting and tax purposes |
| A deleted account | Locked immediately, then permanently deleted after a 30-day grace period, during which the owner can restore it by signing in |
Your Rights
Depending on where you live, you may have the following rights over your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data. You can update your own profile in Settings.
- Deletion: Account owners can delete their whole account from Settings → Account; team members can ask their account owner to remove them.
- Portability: Request your data in a structured, machine-readable format. Your team can also export contacts from the platform.
- Objection and restriction: Object to, or ask us to restrict, certain processing.
- Withdraw consent: Disconnect social media accounts or integrations at any time from the platform settings.
To exercise your rights, email [email protected]. We will respond within 30 days.
Third-Party Services
Cligo works with the following services. We encourage you to review their privacy policies:
Children's Privacy
Cligo is a business platform for professional use. It is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy as our practices, features or legal requirements change. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Notify account owners by email or in the app before material changes take effect
Continuing to use Cligo after changes take effect means you accept the updated policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Cligo Technologies
Email: [email protected]
Response time: Within 30 business days
Social Media Integrations
Your business connects its own social media accounts through each platform's official OAuth login. We never see or store your social media passwords. When you connect an account, we store the following solely to operate the integration:
Facebook
Your name, profile picture, and access tokens for the Facebook Pages you choose. Used solely to publish posts to those Pages.
Instagram
Business account ID, username and profile picture through the Meta Graph API, via a linked Facebook Page. Used solely to publish images and videos to that business profile.
LinkedIn
Name, profile picture and member ID. Used solely to publish posts to your profile or company page.
X (Twitter)
Account ID, name and profile picture. Used solely to publish posts.
TikTok
Display name, avatar and open ID through TikTok Login Kit, and access tokens to upload videos as drafts to your TikTok inbox (or publish directly once our TikTok app is approved for direct posting). TikTok data is never shared with third parties.
YouTube
Channel ID, channel name, avatar and access tokens through Google OAuth. Used solely to upload videos, set thumbnails and read video categories via the YouTube Data API v3.