In plain terms: We collect only what we need to run the service. We don't sell your data. Your respondents' data belongs to you. We use EU-based infrastructure and comply with GDPR.
Cletica ("Cletica", "we", "us", or "our") is a survey and research platform operated by [Legal Entity Name] ("Company"), registered at [Company Address].
We act as the data controller for the personal data of our customers (users who create accounts on Cletica). For the personal data of survey respondents collected through surveys created by our customers, we act as a data processor — our customers are the data controllers for their respondents' data.
Questions about this policy: [email protected]
When you register or sign in, we collect:
When you create an organization on Cletica, we store the organization name, slug (subdomain identifier), plan, and branding settings (colors, logo, custom CSS).
We store the surveys you create, including question text, settings, and logic rules. We also store the responses submitted by your respondents, including:
This data is created and controlled by you as our customer. We process it on your behalf.
Anonymous public surveys: When a survey is completed via a public link (not a personal link tied to a specific contact), responses are stored without any identifier linking them to a natural person. Cletica has no means to identify the respondent from the response data alone, and therefore cannot fulfill deletion or access requests for anonymous responses on behalf of a respondent who contacts us directly. If a respondent submits a data subject request, they should contact the organization that created the survey, as that organization is the data controller for the survey data.
If you use the Contacts feature, we store contact records you import or create: name, email, phone, external ID, tags, and custom attributes. You are the controller of this data.
We automatically collect:
We do not store your payment card details. Payments are processed by Paddle (our Merchant of Record). We receive only non-sensitive transaction metadata (plan purchased, amount, transaction ID).
If you submit your email on our waitlist form, we store your email address, the language you used, and your IP address. This data is used solely to notify you when registration opens.
| Purpose | Data used |
|---|---|
| Provide and operate the Cletica platform | Account data, survey data, response data |
| Authentication and account security | Email, password hash, Google ID, IP address |
| Send transactional emails (verification, password reset, invitations) | Email address |
| Process subscription payments | Account data, billing metadata from Paddle |
| Prevent fraud and abuse | IP address, usage logs |
| Improve the platform | Aggregated, anonymized usage data |
| Respond to support requests | Account data, information you provide |
| Send product announcements | Email address (with opt-out available) |
| Waitlist notification | Email address from waitlist form |
If you are located in the European Economic Area (EEA), our legal basis for processing your data is:
We do not sell your personal data. We share data only with the service providers listed below, under data processing agreements, strictly to operate the platform:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting (EC2), database (RDS PostgreSQL), file storage (S3), email delivery (SES) | EU (Frankfurt, eu-central-1) |
| Cloudflare | CDN, DDoS protection, bot protection (Turnstile CAPTCHA) | Global (EU servers available) |
| OAuth sign-in (if you use "Sign in with Google") | Global | |
| Paddle | Payment processing and subscription management (Merchant of Record) | UK / Global |
We may disclose data to law enforcement or government authorities if required by applicable law, or to protect the rights, property, or safety of Cletica, our users, or the public.
Our primary infrastructure is located in the EU (AWS Frankfurt). Some of our service providers (such as Cloudflare and Google) process data in other regions.
Where we transfer data outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.
| Data type | Retention period |
|---|---|
| Account and organization data | Until account deletion, then 30 days before permanent deletion |
| Survey and response data | Until deleted by the customer or account deletion |
| Contact CRM data | Until deleted by the customer or account deletion |
| Usage and server logs | 30 days rolling |
| Billing records | 7 years (legal requirement) |
| Waitlist emails | Until registration opens or upon unsubscribe request |
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.
We use the following cookies and browser storage:
access_token, refresh_token) — JWT tokens stored as HttpOnly cookies. These are strictly necessary for the service to function and cannot be read by JavaScript.csrf_token) — a short-lived token stored in a non-HttpOnly cookie, read by the browser to protect against cross-site request forgery.localStorage.__cf_bm).We do not use third-party advertising or tracking cookies. We do not share cookie data with advertisers.
The Cletica platform is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
If you use Cletica to conduct surveys involving minors, you are solely responsible for obtaining any required parental or guardian consent in accordance with applicable law (COPPA, GDPR Article 8, etc.).
We take appropriate technical and organizational measures to protect your data:
No system is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant authorities as required by law.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. For material changes, we will notify you by email (if you have an account) or by posting a notice on our website. Your continued use of Cletica after the effective date of any changes constitutes acceptance of the updated policy.
For privacy-related questions, data requests, or complaints:
We aim to respond to all inquiries within 30 days.