Privacy Policy
Last updated: 25 September 2026
This policy explains how Clagee (“Clagee”, “we”, “us”) handles personal data in connection with the Clagee platform at app.clagee.com (the “Service”). It covers two different roles we play:
- Account data: information about the businesses and people who sign up for and use Clagee. For this we decide how the data is used; we are the controller (“data fiduciary”).
- Customer Data: information about our customers’ own shoppers and contacts, which brands bring into their workspaces. For this the brand is the controller and we process it only on the brand’s instructions. If you are a shopper who received a message from a brand using Clagee, please contact that brand first; we will help them answer you.
1. Account data we collect
| What | Why |
|---|---|
| Name, work email, phone number, password (stored only as a salted hash) | To create and secure your account, verify your email and phone, and sign you in |
| Company name, website, industry, size, country, city, tax ID, and the business documents you upload | To verify that the account belongs to a real business before messaging is enabled, and to issue correct tax invoices |
| Billing details: plan, invoices, GSTIN, billing address | To charge for the Service and meet tax and accounting law. Card and UPI details are handled by Razorpay; we never see or store full card numbers |
| Usage and device data: IP address, browser, pages and actions in the app, audit log of changes | To run and secure the Service, investigate abuse, and show you your workspace’s activity |
| Messages you send us and support conversations | To answer you and improve the Service |
2. Customer Data we process for brands
Depending on what a brand connects and imports, a workspace can hold its shoppers’ names, email addresses, phone numbers, locations, order and product history, browsing events from the brand’s website, message engagement (delivery, opens, clicks) and consent or unsubscribe status. We use Customer Data only to provide the Service to that brand: to store it, build the segments and journeys the brand configures, send the messages the brand requests, and report results. We do not sell it, use it for our own marketing, or combine one brand’s data with another’s.
Email opens and clicks are measured with a tracking pixel and redirected links. Every marketing email includes an unsubscribe link; an unsubscribe is recorded against that brand immediately and suppresses further marketing from it.
3. Cookies and local storage
We use one cookie, clagee_session, which keeps you signed in. It is strictly necessary, cannot be read by scripts on the page, and expires after 24 hours or when you sign out. The app also stores a few preferences in your browser (such as the workspace you last opened). We do not use advertising or third-party analytics cookies.
4. Who we share data with
We use the following service providers (“sub-processors”) to run the Service. Each receives only what it needs, under a contract that requires it to protect the data.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage and content delivery | India (Mumbai); content delivery globally |
| Google (Workspace and Firebase) | Account and billing emails from Clagee; phone-number verification at sign-up | Global |
| Razorpay | Payment processing | India |
| Anthropic | AI Copilot. When you use an AI feature, the prompt and the workspace content it needs are sent to generate the answer. It is not used to train AI models | United States |
When a brand connects its own store or its own email, SMS, WhatsApp or push provider, Customer Data flows to and from that provider at the brand’s instruction under the brand’s agreement with it.
We may also disclose data where the law requires it, to protect the rights and safety of our users or the public, or to a successor if our business is sold or merged, in which case this policy will continue to apply.
5. International transfers
Data is stored in India. Some providers listed above process data in other countries. Where we transfer personal data outside India or the European Economic Area, we do so only to countries not restricted by law and with contractual safeguards such as standard contractual clauses.
6. How long we keep data
- Account data: for as long as the account is open, then for up to 90 days to allow reactivation, except billing records, which we keep for 8 years as Indian tax law requires.
- Customer Data: for as long as the brand’s workspace exists. When a workspace is closed, the brand has 30 days to export its data, after which it is deleted from the live Service and from backups on their normal rotation.
- Security and audit logs: up to 12 months.
7. Security
Data is encrypted in transit (HTTPS/TLS). Each workspace’s data is isolated at the database level so one brand’s users cannot reach another’s. Passwords are hashed, sessions are revoked when a password changes, and access by our staff is limited to what is needed to run and support the Service. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
8. Your rights
Depending on where you live, including under India’s Digital Personal Data Protection Act, 2023 and the GDPR, you may have the right to access your personal data, correct or update it, have it erased, withdraw consent, object to or restrict certain processing, receive a copy in a portable format, and nominate another person to exercise your rights. You can update most account details yourself in My Profile. For anything else, email us at the address below. We will respond within 30 days and may need to confirm your identity first.
Shoppers whose data a brand holds in Clagee should send requests to that brand. Brands can handle access and erasure requests themselves under Settings, Privacy & Data Requests.
If you are not satisfied with our response, you may complain to the Data Protection Board of India or your local data-protection authority.
9. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect account data from children.
10. Changes to this policy
We will post any change here and update the date above. For material changes we will also tell account holders by email or in the app before they take effect.
11. Contact and Grievance Officer
Clagee
Grievance Officer:
Email:
We acknowledge grievances within 24 hours and resolve them within 15 days, as the Information Technology Rules require.