Privacy Policy

Cliento ("Cliento", "we", "us", "our") operates the website www.mycliento.com and the Cliento customer relationship management (CRM) platform, including the web application, website widgets and forms, chatbot, appointment scheduling, unified inbox, email marketing and related services (together, the "Service").

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to visitors of our website, to customers whose Cliento workspace is provisioned by our platform team ("Customers") and their team members, and to the contacts, leads and end users whose data Customers process through the Service ("End Users").

For questions about this policy or your data, contact us at privacy@mycliento.com.

Cliento as a controller. For data about website visitors and Customer account holders (e.g. your name, email, login details, billing and usage data), Cliento decides how and why the data is processed and acts as the data controller.

Cliento as a processor. For End User data that a Customer uploads, imports or captures through the Service (e.g. contacts, leads, messages, appointments, form submissions), the Customer is the data controller and Cliento processes that data only on the Customer's instructions, in accordance with our Terms of Service and any data processing agreement in place.

If you are an End User and want to exercise your rights over data held in a Customer's workspace, please contact that business directly. We will assist them in responding to your request.

Information you provide directly

• Account data: name, email address, password (stored hashed), profile photo, job title, business name, phone number.
• Workspace data: business details, opening hours, services and prices, team members and their roles, branding such as your logo.
• CRM data: contacts, leads, notes, tags, tasks, appointments, conversations, support tickets and knowledge-base articles that you or your team enter or import.
• Communications: messages you send us through contact forms, support tickets or email.
• Billing data: your workspace plan and subscription status. Plans are currently managed by our platform team; online card billing is not available.

Information collected automatically

• Usage and device data: pages viewed, features used, browser type, operating system, language, approximate location derived from IP address, referring URLs, and timestamps.
• Log and security data: IP addresses, login events, error reports and audit records used to keep the Service secure and reliable.
• Cookies and similar technologies, as described in the Cookies section below.

Information from third-party integrations

When a Customer chooses to connect a third-party service (for example Google Calendar, Google Ads, Facebook Pages, Instagram Business or Meta Ads), we receive the data that the Customer authorises through that provider's consent screen, limited to the scopes required for the feature. See the dedicated Google and Meta sections below.

Information collected through Customer websites

When a Customer embeds a Cliento form, chatbot or widget on their own website, we collect the details that a visitor submits (such as name, email, phone number, requested service and message) together with technical data such as the page URL and IP address, on behalf of that Customer.

• To provide, operate, maintain and improve the Service and its features.
• To create and manage accounts, authenticate users and enforce roles and permissions.
• To capture, store and organise leads, contacts, conversations and appointments for Customers.
• To prepare appointment reminders, review requests and marketing campaigns and run internal workflows that Customers configure. Outbound email delivery is not currently enabled.
• To synchronise data with third-party services that a Customer has explicitly connected.
• To provide customer support and respond to enquiries.
• To send service announcements, security alerts and, where permitted, product updates (you can opt out of marketing emails at any time).
• To monitor, detect and prevent fraud, abuse, security incidents and violations of our Terms.
• To analyse usage in aggregate so we can improve performance and design.
• To comply with legal obligations and enforce our agreements.

Artificial intelligence features. Some features (such as the chatbot, reply suggestions and summaries) use AI models to process the content you or your End Users provide. This content is used only to generate the requested output for your workspace. We do not use Customer or End User data, nor data obtained from Google or Meta APIs, to train generalised AI or machine-learning models.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you signed up for.
• Legitimate interests — to secure and improve the Service, prevent abuse and communicate with you about your account, where these interests are not overridden by your rights.
• Consent — for optional cookies, marketing communications and third-party integrations you choose to connect. You may withdraw consent at any time.
• Legal obligation — where processing is required by applicable law, such as tax and accounting rules.

Cliento currently provides an optional Google Calendar connection. Additional Google integrations are in development. When you connect a Google account you will be shown a Google consent screen that lists the exact permissions ("scopes") requested. We request only the minimum scopes needed for the feature you enable.

• Google Calendar (calendar.events, calendar.readonly): used solely to create, update and read appointment events in the calendar you select so that bookings made in Cliento appear in your Google Calendar and to help avoid double bookings.
• Google Ads: this integration is in development and is not currently available.
• Account identity: identity details authorised during the Google connection are used to identify the connected account.

Limited Use disclosure. Cliento's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• only use Google user data to provide or improve user-facing features that are prominent in the Cliento interface;
• do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you;
• do not use Google user data for serving advertisements, including retargeting, personalised or interest-based advertising;
• do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security or to comply with law, or the data has been aggregated and anonymised for internal operations;
• do not use Google user data to develop, improve or train generalised AI or machine-learning models.

Access tokens obtained from Google are encrypted at rest and are never exposed to your browser or to other users. You can revoke Cliento's access at any time from the Integrations page in Cliento or from your Google Account permissions. On disconnection we delete the stored tokens immediately.

Integrations with Meta platforms, including Facebook Pages, Instagram Business accounts, Meta Lead Ads and Messenger/Instagram messaging, are in development and are not currently available. If enabled in the future, connecting a Meta account will require explicit authorisation through Meta's login dialog (for example pages_show_list, pages_messaging, instagram_basic, instagram_manage_messages, leads_retrieval).

When these integrations become available, authorised Meta platform data will be used only to:

• display and reply to messages from your Facebook Page and Instagram Business account inside the Cliento unified inbox;
• import leads submitted through your Meta Lead Ads forms into your CRM;
• show basic information about the connected Page or account (name, ID, profile picture) so you can identify the connection;
• report on ad performance where you connect Meta Ads.

We comply with the Meta Platform Terms and Developer Policies. We do not sell Meta platform data, do not use it for advertising outside of the features you enable, and do not share it with third parties except as needed to operate the Service. Messages and lead data received from Meta belong to the Customer's workspace and are processed on that Customer's behalf.

You can disconnect Meta integrations at any time from the Integrations page in Cliento or by removing Cliento under Facebook Business Integrations. When you disconnect, we delete the stored access tokens. You can also request deletion of all data we received from Meta on your behalf by following the steps in the Data deletion section below.

We do not sell personal data. We share it only in the following situations:

• Service providers (sub-processors) who help us operate the Service, such as cloud hosting and database providers, email and SMS delivery providers, payment processors, AI model providers and error-monitoring tools. They are bound by contracts limiting use of the data to providing services to us.
• Third-party integrations that a Customer explicitly connects (e.g. Google, Meta). Data is exchanged only as required for the connected feature.
• Within a Customer's workspace: team members with the appropriate role can see workspace data according to the permissions the Customer configures.
• Legal reasons: to comply with law, regulation, legal process or enforceable governmental request, or to protect the rights, property or safety of Cliento, our users or the public.
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to notice and the protections of this policy.

• Account and workspace data is retained for as long as the Customer's account is active.
• When a Customer closes their account, workspace data is deleted or anonymised within 30 days, except where retention is required by law (e.g. invoices) or for legitimate security purposes.
• Third-party access tokens (Google, Meta and others) are deleted immediately when an integration is disconnected or the account is closed.
• Backups are rotated on a rolling basis and purged within 90 days.
• Server logs used for security are kept for up to 12 months.

You can delete your data at any time:

• Individual records — contacts, leads, conversations and appointments can be deleted from within the Cliento app by users with the appropriate role.
• Connected services — go to Integrations in Cliento and click Disconnect; associated tokens are removed immediately.
• Your whole account and workspace — email privacy@mycliento.com from the address associated with your account with the subject "Delete my account". We will confirm the request and complete deletion within 30 days.
• Data received from Facebook or Instagram — email privacy@mycliento.com with the subject "Meta data deletion" and the name of your Page or Instagram account. We will delete all data obtained through Meta's platform for that connection and send you written confirmation.

End Users whose data is stored in a Customer's workspace should contact that business directly. On the Customer's instruction, we will delete the relevant records.

We use administrative, technical and organisational measures designed to protect personal data, including encryption in transit (TLS) and at rest, row-level access controls that isolate each workspace's data, role-based permissions, encrypted storage of third-party credentials, audit logging and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

Our service providers may process data in countries outside your own, including the European Union and the United States. Where data is transferred out of the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

We use:

• Strictly necessary cookies — to keep you signed in, remember your active workspace and protect against cross-site request forgery. These cannot be switched off.
• Preference cookies — to remember settings such as your language or view preferences.
• Analytics cookies — to understand in aggregate how the website and app are used. These are set only with your consent where required by law.

You can control cookies through your browser settings. Blocking necessary cookies may prevent parts of the Service from working.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable, machine-readable format (you can export contacts and leads as CSV directly from the app);
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@mycliento.com. We will respond within 30 days and may need to verify your identity first.

California residents have additional rights under the CCPA/CPRA, including the right to know, delete and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioural advertising.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the effective date above. For material changes we will notify Customers by email or an in-app notice before the change takes effect.

Cliento — Privacy Team
Email: privacy@mycliento.com
Website: www.mycliento.com/contact