Privacy Policy

The controller of your personal data is Lumi sp. z o.o. (LUMI SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ), Al. Solidarności 68 lok. 121, 00-240 Warszawa, Poland, KRS 0001208216, NIP 5253070074 (“Kliqo”, “we”). For any privacy question or request, write to [email protected] or to our postal address. We have not appointed a data protection officer.

Account and workspace data

Your name, email address and, if you sign in with Google, your Google profile name and picture; your workspaces, role, invitations you send (the invitee’s email), and the answers you give during setup (such as your role and how you found us). For security we store your sessions with the IP address and browser they came from.

Your workspace content

The projects, brand and competitor names, website domains, topics, prompts, tags, notes, settings and recommendations you create, and the results we produce for them: the AI answers collected for your prompts, the sources they cite and the metrics we calculate. To set up a project and check crawlability we read public pages and the robots.txt file of the websites you add. AI answers can mention people (for example a company founder); we store them as the engines returned them.

Crawl insights (optional)

If you connect Crawl insights, we store your Cloudflare API token encrypted, and the Worker in your Cloudflare account reports requests to your site made by AI crawlers and visits that come from AI assistants: time, page, user agent, status code, response time and whether the crawler was verified. The visitor’s IP address is stored only as a salted hash; visits from AI assistants are stored only as daily counts per page, without IP addresses. See section 4.

Billing data

Stripe collects your card and billing details (name, address, email, VAT number). We receive and keep your Stripe customer and subscription identifiers, plan, billing status, and the card’s fingerprint so that each card gets one free trial. We never receive your full card number.

Communication

Messages you send us and our replies.

Technical, security and error data

Our servers and Cloudflare process IP addresses, browser details and requested addresses to deliver and protect the service. At sign-in, Cloudflare Turnstile checks that you are not a bot, and we check whether your email domain is a disposable one. When the app breaks, Sentry receives an error report (what failed, page address, browser) configured without personal data such as names, emails or IP addresses, and without session recordings.

Usage analytics

We use PostHog (EU Cloud) to count visits and steps such as clicks on “Start free trial”, sign-up, onboarding steps and starting a trial, together with the page address, referrer, campaign parameters in the link (such as utm_source) and the plan you chose. It runs without cookies or browser storage, so it cannot recognise you on a later visit; it records no session recordings, no keystrokes and no form contents, and IP addresses are not stored. It does not run at all if your browser sends Do Not Track or Global Privacy Control.

• Creating your account, providing the service, running scans, support and billing. Contract, Art. 6(1)(b) GDPR.
• Keeping accounting and tax records and answering lawful requests from authorities. Legal obligation, Art. 6(1)(c).
• Security, fraud and abuse prevention (sessions, Turnstile, disposable-email checks, one trial per card), error monitoring, and establishing or defending legal claims. Legitimate interests, Art. 6(1)(f).
• Cookieless usage analytics to understand which pages and steps work and to improve the product. Legitimate interests, Art. 6(1)(f).
• Service emails about your account, trial, billing and important changes. Contract, and legitimate interests.

We do not sell personal data, do not use it for advertising, and do not make decisions with legal or similarly significant effects about you by automated means alone.

You need to give us your email address to have an account; without it we cannot provide the service. Everything else is optional or follows from how you use the service.

For data in a customer’s workspace that relates to other people, in particular the Crawl insights visit data of the customer’s own website, the customer is the controller and we process it on their behalf as a processor under Article 28 GDPR. Visitors of such websites should contact the website owner; we will help the customer answer their requests.

We share personal data only with providers that help us run Kliqo, under data processing agreements, and only as far as they need it:

Hetzner Online GmbH

Hosting of the app, API and databaseGermany (EU)

Cloudflare, Inc.

Network, security and content delivery; Turnstile bot check at sign-in; delivery of sign-in and account emailsGlobal network; USA

Stripe Payments Europe, Ltd. and Stripe, Inc.

Payments, subscriptions, invoices and tax; fraud preventionIreland (EU); USA

Google (Google Cloud EMEA Ltd. / Google LLC)

Gemini API: reading AI answers, brand research and suggestions; Google sign-in if you choose itEU and USA

Bright Data Ltd.

Collecting answers from the AI engines you track, for your promptsIsrael

Functional Software, Inc. (Sentry)

Error monitoring, EU data regionGermany (EU); company in USA

PostHog Inc.

Cookieless product analytics, EU CloudGermany (EU); company in USA

Bright Data and the AI engines receive your prompts and the country and language settings of your project, not your account data. Stripe also acts as an independent controller for its own legal and fraud-prevention purposes, and Google acts as an independent controller when you choose to sign in with Google. We may disclose data to authorities when the law requires it, and to a buyer or successor if our business is transferred.

Some providers are based in, or may access data from, countries outside the European Economic Area, mainly the USA. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses with additional safeguards. Transfers to Israel rely on the Commission’s adequacy decision. Ask us for a copy of the relevant safeguards.

• Account data: while your account exists. If you ask us to delete your account, we delete it within 30 days, except what we must keep by law.
• Workspace content: while the workspace has an active trial or subscription, and for 90 days after it is cancelled or locked; then we may delete it (Terms, section 8).
• Crawl insights: individual visits for 30 days; daily totals for 400 days, or until the customer deletes the connection’s data.
• Billing and invoice records: for the period required by Polish tax and accounting law (generally 5 years from the end of the year the tax became due).
• Support messages: up to 3 years after the conversation, to handle follow-up questions and claims.
• Error reports: up to 90 days. Usage analytics events: up to 2 years. Security logs: kept briefly, normally no longer than 30 days.
• Backups are overwritten on a rolling basis, so deleted data disappears from them within a limited time.

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have data erased, or its processing restricted, where the law provides;
• data portability for data you gave us under a contract;
• object at any time to processing based on our legitimate interests, on grounds relating to your situation;
• withdraw consent at any time where we rely on it, without affecting earlier processing.

Write to [email protected]. We answer within one month. You also have the right to lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority where you live or work.

We use only cookies and browser storage that are strictly necessary for the service you ask for. We use no advertising or analytics cookies, so there is no cookie banner.

Sign-in session

Keeps you signed in and protects your session (set when you sign in; secure, HTTP-only).

Sign-in flow

Remembers a pending email sign-in link or Google sign-in for a few minutes.

Security

Cloudflare may set short-lived cookies to tell people from bots and block attacks.

Preferences

Browser storage in the app remembers choices you make, such as filters and where you were in a tab, on your device only.

You can delete cookies in your browser; you will then need to sign in again.

Data is encrypted in transit (HTTPS) and stored with providers in the EU. Access is limited to people who need it. Cloudflare API tokens are stored encrypted. Workspace data is visible only to that workspace’s members, with permissions checked on our servers.

• Kliqo is meant for businesses and is not directed at children under 16.
• Links to other websites are governed by those websites’ privacy policies.

We update this policy when our processing changes; the date at the top shows the current version. We tell account owners by email about material changes. See also our Terms of Service.