Privacy Policy

This policy explains what personal data ClickCMT ("we", "us") handles, why, and the choices you have. ClickCMT is operated by ClickCMT. It covers our website (clickcmt.com), the ClickCMT application, and our tracking domain.

1. Who this policy is about

• Customers — people and businesses who create a ClickCMT account.
• Website visitors — people who browse our own website.
• Our customers' visitors — people who visit a customer's website, ads or links that use ClickCMT tracking. For this data our customer decides what is collected and why; we process it on their behalf (see section 7).

2. Data we collect from customers

• Account details: name, email address, username, password (stored only as a secure hash), time zone and settings.
• Billing details: plan, payment history and invoices. Card details are entered on Stripe's secure page and never reach our servers (see section 9).
• Security and usage data: sign-in times, IP addresses and browser details of account activity, kept to protect your account and investigate problems.
• Support messages: what you send us by email or our contact form.
• Data from connected ad platforms, only when you connect them (section 5).

3. How we use customer data

• to provide the service: tracking, reports, integrations and support;
• to bill you and send receipts, renewal and account emails;
• to keep accounts and systems secure, prevent fraud and abuse, and enforce our Terms and Fair Use Policy;
• to improve the service using aggregated, de-identified statistics;
• to tell you about product updates — you can unsubscribe from non-essential emails at any time.

We do not sell personal data, and we do not use customer or visitor data to advertise to anyone.

4. Data on our own website

Our website uses a small number of cookies needed for sign-in and security, and may record which pages are visited to understand interest in ClickCMT. See our Cookie Policy.

5. Data from Google, Meta and other ad platforms

You can connect ad accounts (Google Ads, Meta/Facebook, Microsoft Advertising, TikTok) by signing in with that platform and granting permission. We then:

• read the list of ad accounts you can access (including client accounts under a Google Ads manager account), their names, currencies and time zones;
• read daily ad performance data — cost, clicks, impressions and conversions for each ad — to show your real ad spend and profit in your reports;
• read your conversion actions or goals, so you can choose where to send conversions;
• send your conversions (and, if you enable it, hashed visitor details such as email or phone) to that platform, only when you turn on AudienceSync.

We use this data only to provide these features to you. We do not use it for advertising, we do not sell it, we do not share it with anyone else except as needed to provide the feature you asked for, and we do not use it to train general-purpose AI or machine-learning models. Access tokens are stored encrypted. You can disconnect an integration at any time in Account › Integrations, which deletes its stored tokens; you can also revoke access from your Google, Meta, Microsoft or TikTok account settings.

Google user data: ClickCMT's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received through the Google Ads API is used only to show your own ad costs and performance inside ClickCMT and to upload conversions you choose to send to Google Ads; people at ClickCMT do not read it unless you ask us to help with your account, it is needed for security, or the law requires it.

6. Data about our customers' visitors

When a customer adds ClickCMT tracking to their website, ads or links, we record for that customer: the visit time, page and referring URLs, UTM and ad-platform click identifiers (such as gclid or fbclid), IP address, approximate country, device and browser type, and a random visitor ID stored in a first-party cookie on the customer's own website. If the customer turns it on, we may also record details the visitor enters on the customer's forms (such as name, email or phone) and their purchases or sign-ups.

We use this data only to provide tracking, attribution, fraud protection and reports to that customer. IP addresses help detect bots and duplicate clicks. Customers can delete clicks, conversions and visitor details in their account at any time.

7. Customers as data controllers

For their visitors' data, our customer is the data controller and ClickCMT is the data processor (a "service provider" under the CCPA). Customers are responsible for telling their visitors about tracking in their own privacy policy and for obtaining any consent their laws require, such as through a cookie banner. Our Data Processing Addendum describes how we process this data. If you are a visitor of one of our customers, please contact that business first; we will help them respond.

8. Who we share data with

We share personal data only with service providers that help us run ClickCMT, under contracts that require them to protect it and use it only for us:

• our hosting and infrastructure providers, which store and run the service;
• Stripe, for payments (section 9);
• our email delivery provider, for account and support emails;
• the ad platforms you connect, only to send the data you choose to send them.

We may also disclose data if the law requires it, to respond to valid legal process, to protect the rights, property or safety of our users or the public, or as part of a merger or sale of our business (in which case this policy will continue to apply).

9. Payments

Payments are processed by Stripe. Your card number and billing address go directly to Stripe and are handled under Stripe's Privacy Policy; we receive only the payment status, amount, invoice and the last details Stripe shares for receipts.

10. How long we keep data

• Clicks, conversions and visitor data are kept for the period included in the customer's plan (for example 6 months or 1 year) and then deleted automatically, or sooner if the customer deletes them.
• Account data is kept while the account is open. When you delete your account, your account and tracking data are permanently deleted within 30 days, except records we must keep by law (such as invoices).
• Security logs are kept for a limited period and then deleted.

11. Security

We use encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, encrypted storage of integration tokens, access controls and monitoring. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you without undue delay.

12. Your rights and choices

You can view and update your account details in Account › Profile, download your data from your reports and exports, and delete your account at any time in Account › Profile (see Data Deletion). Depending on where you live — for example under India's Digital Personal Data Protection Act, the EU/UK GDPR or California law — you may also have the right to access, correct, delete or port your data, to withdraw consent, to object to certain uses, and to complain to a data protection authority. To exercise these rights, email [email protected]. We will not discriminate against you for using them.

13. International transfers

We and our providers may process data in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses.

14. Children

ClickCMT is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children; if we learn we have, we will delete it.

15. Changes

We may update this policy as the service changes. We will post the new version here with a new date, and tell customers by email or in the app about significant changes.

16. Contact and Grievance Officer

For privacy questions or requests, contact ClickCMT at [email protected].

In line with India's Information Technology Act, 2000 and its rules, the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023, you can raise any complaint about ClickCMT or how we handle your personal data with our Grievance Officer:

• Name: ClickCMT
• Email: [email protected]

We acknowledge every complaint within 48 hours and aim to resolve it within 30 days. If you are in India and are not satisfied with our response, you may then complain to the Data Protection Board of India.