# Privacy Policy **Last updated: September 22, 2026** Clixs LLC, a Delaware limited liability company ("Clixs", "we", "our", or "us"), operates the website https://clixs.io and the Clixs platform (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your information when you use our Service. By using the Service, you agree to the collection and use of information in accordance with this policy. --- ## 1. Information We Collect ### 1.1 Account Information When you sign up for Clixs, we collect: - Name, email address, and profile picture (via Google Sign-In) - Authentication identifiers (Supabase user ID, Google account ID) - Business profile information you provide (company name, website URL, industry) ### 1.2 Google Ads Account Data When you connect your Google Ads account via OAuth, we access the following with your explicit consent: - Google Ads account IDs and customer IDs (manager and sub-accounts) - Campaign data (campaigns, ad groups, keywords, ads, extensions) - Performance metrics (impressions, clicks, conversions, cost, CTR, CPC) - Account configuration (budgets, bidding strategies, targeting settings) - Audience and demographic data associated with your campaigns - Geographic and language targeting data We access Google Ads data **only on accounts you explicitly authorize** and **only to provide the campaign management features you request**. ### 1.3 Payment Information Subscription payments are processed by Stripe, Inc. We do not store your full credit card details on our servers. We retain transaction metadata: subscription status, plan tier, billing cycle, last 4 digits of card, and billing email. ### 1.4 Usage and Technical Data - Pages visited, features used, clicks, and session duration - IP address, browser type, device type, operating system - Referral URLs and timestamps - Error logs and diagnostic data ### 1.5 Communications - Support tickets, chat messages, and email correspondence with our team - Conversational inputs you provide to AI features within the Service --- ## 2. Google API Services User Data Policy — Limited Use Disclosure Clixs's use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: - **We use Google user data only to provide or improve user-facing features** of Clixs (campaign creation, optimization, reporting, AI-assisted recommendations). - **We do not transfer Google user data to third parties** except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice to users. - **We do not use Google user data for serving advertisements**, including retargeting, personalized, or interest-based advertising. - **We do not allow humans to read Google user data** unless: (a) we have your affirmative consent for specific data, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized. --- ## 3. How We Use Your Information We use the information we collect to: - Provide, maintain, and improve the Service (account creation, campaign building, reporting, AI recommendations) - Process transactions and manage subscriptions - Send technical notices, security alerts, and support messages - Respond to support requests and feedback - Detect and prevent fraud, abuse, and security incidents - Generate aggregated, anonymized analytics about Service usage (this aggregated data does not identify any individual user) - Comply with legal obligations ### 3.1 AI and Machine Learning — Training Disclosure Clixs uses third-party AI providers (currently Anthropic) to power features like campaign suggestions and content generation. With respect to your data: - **We do not use your Google Ads account data to train AI foundation models or any general-purpose machine learning models**, ours or our providers'. - Inputs you submit to AI features are processed in real time to generate responses for you, and are not retained by Anthropic for model training (per Anthropic's API zero-retention defaults). - We may use **aggregated and anonymized** usage patterns (e.g., "users typically run X campaigns per month") to improve our own product features. This aggregated data cannot be used to re-identify any individual user or account. - If we ever change this practice, we will notify you in advance and obtain explicit consent before using identifiable data for training. --- ## 3.2 Legal Bases for Processing (GDPR) For users in the European Economic Area, United Kingdom, and Switzerland, we rely on the following legal bases under Article 6 of the GDPR: | Processing Activity | Legal Basis | |---------------------|-------------| | Creating and maintaining your account | Performance of a contract (Art. 6(1)(b)) | | Processing payments | Performance of a contract (Art. 6(1)(b)) | | Accessing your Google Ads data | Your consent given via OAuth (Art. 6(1)(a)) | | Sending service announcements | Legitimate interest in operating the Service (Art. 6(1)(f)) | | Marketing communications | Your explicit opt-in consent (Art. 6(1)(a)) | | Fraud prevention and security | Legitimate interest in protecting users (Art. 6(1)(f)) | | Compliance with tax and accounting law | Legal obligation (Art. 6(1)(c)) | You may withdraw consent at any time without affecting the lawfulness of prior processing. --- ## 3.3 Special Categories of Personal Data We do **not** intentionally collect or process special categories of personal data as defined under GDPR Article 9, including: - Racial or ethnic origin - Political opinions - Religious or philosophical beliefs - Trade union membership - Genetic or biometric data - Health data - Data concerning a person's sex life or sexual orientation If you choose to upload such data into your campaign content (e.g., as ad copy targeting a specific audience), you do so at your own discretion and are responsible for the lawfulness of that processing. --- ## 4. How We Share Information We do **not** sell or rent your personal information. We share information only as follows: ### 4.1 Service Providers (Sub-processors) We use trusted third-party services to operate Clixs. These providers are bound by contract to use your data only to provide services to us: | Provider | Purpose | Data Processed | |----------|---------|----------------| | **Supabase, Inc.** | Authentication, database hosting | Account info, app data | | **Vercel, Inc.** | Application hosting and delivery | Request logs, IP addresses | | **Stripe, Inc.** | Payment processing | Payment info, billing data | | **Google LLC (Google Ads API)** | Campaign management | Google Ads account data | | **Anthropic PBC** | AI features (campaign suggestions, content generation) | Text inputs you submit to AI features | ### 4.2 Legal Requirements We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas). ### 4.3 Business Transfers If Clixs is involved in a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy. ### 4.4 With Your Consent We may share information with other parties when you give us explicit consent. --- ## 5. Data Retention - **Account data**: retained while your account is active. Deleted within 30 days of account deletion request. - **Google Ads data**: retained for the duration of your subscription. You can disconnect a Google Ads account at any time, which removes our access. Cached data is purged within 90 days of disconnection. - **Payment records**: retained for 7 years for tax and accounting compliance. - **Logs and analytics**: retained for up to 12 months in identifiable form, then aggregated/anonymized. - **Backups**: encrypted backups may be retained for up to 90 days after primary deletion. You may request deletion of your data at any time by emailing **support@clixs.io**. --- ## 6. Data Security We implement industry-standard security measures including: - Encryption in transit (TLS 1.2+) - Encryption at rest for sensitive data (Supabase encrypted storage) - OAuth 2.0 for third-party authentication (we never see your Google password) - Role-based access controls and audit logging - Regular security reviews and dependency updates No security system is impenetrable. We cannot guarantee absolute security. If we become aware of a data breach affecting your information, we will notify you and the relevant authorities as required by law. --- ## 7. Your Rights Depending on your location, you may have the following rights: ### GDPR (European Economic Area, UK) - **Access** — request a copy of personal data we hold about you - **Rectification** — correct inaccurate or incomplete data - **Erasure** — request deletion of your data - **Portability** — receive your data in a structured, machine-readable format - **Restriction** — limit how we process your data - **Objection** — object to certain types of processing - **Withdraw consent** — at any time, where processing is based on consent ### CCPA (California) - Right to know what personal information is collected - Right to delete personal information - Right to opt out of the "sale" of personal information (note: we do not sell data) - Right to non-discrimination for exercising your rights ### Israeli Privacy Protection Law (5741-1981) - Right to access and correct personal information held in our databases To exercise any of these rights, email **support@clixs.io**. We respond within 30 days. --- ## 8. International Data Transfers Clixs LLC is incorporated in Delaware, USA, and operates the Service primarily from the United States. We use service providers located in the United States and the European Union. By using the Service, you consent to your information being transferred to and processed in these jurisdictions. For users in the EEA and UK, cross-border transfers are protected by Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Agreement, where applicable. --- ## 9. Cookies and Tracking We use cookies and similar technologies for: - **Essential cookies** — authentication and session management (required): your sign-in session, and a short-lived state cookie while you connect a Google Ads account (protection against forged connection requests) - **Functional storage** — remembering your preferences (for example which table columns you show), kept in your browser **We do not use third-party advertising, retargeting, or analytics cookies or pixels**, on the Service or on our website. Product usage events (Section 1.4) are collected first-party — sent only to Clixs's own systems, keyed to a random session identifier kept in your browser's session storage and, when you are signed in, to your account. They are never shared with advertising networks or data brokers. Because we set no non-essential cookies, the Service does not show a cookie-consent banner. If that ever changes, we will ask for your consent before setting any non-essential cookie where the law requires it, and update this section. You can disable cookies in your browser settings, but essential functionality (signing in, connecting Google Ads) will not work without them. --- ## 10. Children's Privacy Clixs is not intended for users under 18. We do not knowingly collect personal information from children. If we learn we have collected data from a child under 18, we will delete it immediately. --- ## 11. Account Deletion and Data Removal You can delete your account at any time: 1. Sign in to Clixs 2. Go to **Settings → Account → Delete Account**, or 3. Email **support@clixs.io** Account deletion removes: - Your profile information - Your Google Ads connections (revokes our OAuth tokens) - Your campaign drafts and AI conversation history - Within 30 days, all data is permanently deleted from active systems - Encrypted backups are purged within 90 days To revoke Clixs's access to your Google account without deleting your Clixs account: visit [https://myaccount.google.com/permissions](https://myaccount.google.com/permissions). --- ## 12. Changes to This Policy We may update this Privacy Policy from time to time. Material changes will be communicated via email and through an in-app notice at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision. --- ## 13. EU and UK Data Subjects Clixs LLC is a US-based entity. As of the "Last updated" date above, we have not yet formally appointed dedicated representatives in the European Union or United Kingdom under Article 27 of the GDPR / UK GDPR. We are evaluating qualified providers and will update this section promptly once appointed. **In the meantime:** - EEA and UK data subjects may contact us directly at **privacy@clixs.io** for any questions, requests, or to exercise the rights described in Section 7. - We respond to all data subject requests within 30 days regardless of your location. - You also retain the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at [https://edpb.europa.eu/about-edpb/about-edpb/members_en](https://edpb.europa.eu/about-edpb/about-edpb/members_en). For the UK, see the Information Commissioner's Office at [https://ico.org.uk](https://ico.org.uk). --- ## 14. Contact Us For questions, concerns, or to exercise your rights: **Clixs LLC** A Delaware limited liability company Email: **support@clixs.io** Website: [https://clixs.io](https://clixs.io) For data protection inquiries specifically: **privacy@clixs.io**