In plain terms: We collect only what we need to run the service. We don't sell your data. Your respondents' data belongs to you. We use EU-based infrastructure and comply with GDPR.
Cletica ("Cletica", "we", "us", or "our") is a survey and research platform operated by Cletica LLC ("Company"), a limited liability company registered in Georgia under identification number 447018904, with its registered address at Leghva Village, 13th Street, 1st Lane, No. 6, Kobuleti District, Georgia.
We act as the data controller for the personal data of our customers (users who create accounts on Cletica). For the personal data of survey respondents collected through surveys created by our customers, we act as a data processor — our customers are the data controllers for their respondents' data.
Questions about this policy: [email protected]
When you register or sign in, we collect:
When you create an organization on Cletica, we store the organization name, slug (subdomain identifier), plan, and branding settings (colors, logo, custom CSS).
We store the surveys you create, including question text, settings, and logic rules. We also store the responses submitted by your respondents, including:
This data is created and controlled by you as our customer. We process it on your behalf.
Anonymous public surveys: When a survey is completed via a public link (not a personal link tied to a specific contact), responses are stored without any identifier linking them to a natural person. Cletica has no means to identify the respondent from the response data alone, and therefore cannot fulfill deletion or access requests for anonymous responses on behalf of a respondent who contacts us directly. If a respondent submits a data subject request, they should contact the organization that created the survey, as that organization is the data controller for the survey data.
If you use the Contacts feature, we store contact records you import or create: name, email, phone, external ID, tags, and custom attributes. You are the controller of this data.
We automatically collect:
We do not store your payment card details. Payments are processed by Paddle (our Merchant of Record). We receive only non-sensitive transaction metadata (plan purchased, amount, transaction ID).
If you submit your email on our waitlist form, we store your email address, the language you used, and your IP address. This data is used solely to send you one invitation when registration opens, in the language you used. Every invitation contains a link that deletes your address from the waitlist immediately.
| Purpose | Data used |
|---|---|
| Provide and operate the Cletica platform | Account data, survey data, response data |
| Authentication and account security | Email, password hash, Google ID, IP address |
| Send transactional emails (verification, password reset, invitations) | Email address |
| Run AI features at your request (survey and quiz generation, AI insights and reports) | Content you submit to the feature; survey, question and answer-option texts; aggregated response statistics (see AI features) |
| Process subscription payments | Account data, billing metadata from Paddle |
| Prevent fraud and abuse, including recognising accounts re-opened by people we have closed for abuse | IP address (network range), usage logs, a device identifier cookie, normalized email address, Google account ID, payment card type, last 4 digits, expiry and cardholder name (from Paddle), hashes of recipient addresses — compared as keyed hashes only |
| Improve the platform | Aggregated, anonymized usage data |
| Respond to support requests | Account data, information you provide |
| Send product announcements | Email address (with opt-out available) |
| Waitlist notification | Email address from waitlist form |
If you are located in the European Economic Area (EEA), our legal basis for processing your data is:
We do not sell your personal data. We share data only with the service providers listed below, under data processing agreements, strictly to operate the platform:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting (EC2), database (RDS PostgreSQL), file storage (S3) | EU (Frankfurt, eu-central-1) |
| Cloudflare | CDN, DDoS protection, bot protection (Turnstile CAPTCHA) | Global (EU servers available) |
| OAuth sign-in (if you use "Sign in with Google") | Global | |
| Paddle | Payment processing and subscription management (Merchant of Record) | UK / Global |
| Resend | Email delivery (account emails, invitations, survey invitations and reminders) | United States |
| Bouncer (Bouncer sp. z o.o.) | Email address verification before invitations are sent (only the email address is shared; results are deleted by Bouncer within 60 days) | EU (Frankfurt) |
| Anthropic | AI features run at your request: survey and quiz generation, AI insights and reports (Claude models) | United States |
Some features are powered by Claude models provided by Anthropic, PBC. Data is sent to Anthropic only when a user of your organization runs one of these features, never in the background:
Not sent to Anthropic: individual responses, the text of answers to open-ended questions, uploaded files, respondent contact details and IP addresses. An open-ended question is passed only as its text and the number of answers it received.
Anthropic may not use this data to train its models. Under Anthropic's current policy, inputs and outputs are deleted within 30 days, unless longer retention is required by law or the content is flagged for violating Anthropic's Usage Policy. We do not store the requests we send to Anthropic; we keep only the result — for example, the generated survey or report text — in your account.
Question texts, answer options, descriptions and lessons are written by you. Do not include personal data or special categories of data (such as health, religion or political opinions) in content you submit to AI features — for example, do not use people's names as answer options in a survey you plan to analyze with AI.
We may disclose data to law enforcement or government authorities if required by applicable law, or to protect the rights, property, or safety of Cletica, our users, or the public.
Our primary infrastructure is located in the EU (AWS Frankfurt). Some of our service providers process data outside the EEA: Anthropic and Resend in the United States, Cloudflare and Google globally.
Where we transfer data outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission. Transfers to Anthropic are covered by the Standard Contractual Clauses incorporated in Anthropic's Data Processing Addendum, including the processor-to-processor module.
| Data type | Retention period |
|---|---|
| Account and organization data | Until account deletion, then 30 days before permanent deletion |
| Survey and response data | Until deleted by the customer or account deletion |
| Contact CRM data | Until deleted by the customer or account deletion |
| Usage and server logs | 30 days rolling |
| Billing records | 7 years (legal requirement) |
| Waitlist emails | 14 days after we send you the invitation, or immediately when you remove yourself using the link in it |
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.
We use the following cookies and browser storage:
access_token, refresh_token) — JWT tokens stored as HttpOnly cookies. These are strictly necessary for the service to function and cannot be read by JavaScript.cl_dev) — a random identifier set when you sign up or sign in, with a copy in localStorage. Used only to prevent fraud and abuse; strictly necessary for keeping the platform safe for all senders.csrf_token) — a short-lived token stored in a non-HttpOnly cookie, read by the browser to protect against cross-site request forgery.localStorage.localStorage so that a reload or an accidentally closed tab does not lose their work. Removed as soon as the survey is submitted. Strictly necessary for the service the respondent asked for.localStorage so they can return to the course without digging out the email. Strictly necessary for the service the learner asked for.utm_source and similar), or the visitor arrived from another website, these are kept in sessionStorage for the duration of the visit and sent to us together with the response. They let the survey owner see where their respondents came from. They are not strictly necessary for the survey to work, they are first-party only, and they are never used to follow a visitor across other websites or to build a profile.__cf_bm).Everything above except the campaign tags is either strictly necessary for the service to function or stores a preference you set yourself. We do not use third-party advertising or tracking cookies. We do not share cookie data with advertisers. For the full list of cookies and their purposes, see our Cookie Policy.
The Cletica platform is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
If you use Cletica to conduct surveys involving minors, you are solely responsible for obtaining any required parental or guardian consent in accordance with applicable law (COPPA, GDPR Article 8, etc.).
We take appropriate technical and organizational measures to protect your data:
No system is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant authorities as required by law.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. For material changes, we will notify you by email (if you have an account) or by posting a notice on our website. Your continued use of Cletica after the effective date of any changes constitutes acceptance of the updated policy.
For privacy-related questions, data requests, or complaints:
We aim to respond to all inquiries within 30 days.