Privacy Policy
Last updated: May 21, 2026
This Privacy Policy explains how CliraFlow collects, uses, and protects personal data. CliraFlow is an intelligent communication platform for small businesses and entrepreneurs, operated from Chile and available to customers worldwide, including the European Union.
1. Who we are and our dual role
CliraFlow handles personal data in two distinct roles: • As a data controller, we decide how the account data of our subscribers — the people and businesses that pay for CliraFlow — is processed. This includes account email, name, and password (stored only as a secure hash). • As a data processor, we process the data of our subscribers' contacts on their behalf. These are the people our subscribers run email marketing to. Each subscriber is the data controller of their own contacts and is responsible for having a lawful basis to process them. If you are a contact of one of our subscribers and want your data corrected or removed, please contact that subscriber directly. We will assist them in fulfilling your request.
2. What data we collect
Subscriber account data: email address, name, and password (stored only as a secure hash, never in plain text). Contact data uploaded by subscribers: email addresses, names, custom fields, and any other information our subscribers choose to store about their contacts. Form submission data: when a contact submits a public form created by a subscriber, we record the submitted fields along with the IP address and browser user agent, used to prevent abuse. Email tracking data: opens and clicks on marketing emails, so subscribers can measure the performance of their campaigns. Cookies: we use only a strictly necessary cookie to keep authenticated subscribers signed in.
3. How we use this data
We use personal data to: • Provide and operate the CliraFlow service. • Authenticate subscribers and keep accounts secure. • Send marketing emails on behalf of our subscribers to their contacts. • Measure campaign performance through open and click tracking. • Prevent fraud, spam, and abuse. • Comply with legal obligations. We never sell personal data, and we never use our subscribers' contact data to train artificial intelligence models.
4. Who we share data with
We rely on a small number of trusted third-party processors to operate the service: • Supabase — database and authentication. Stores all account and contact data. • Resend — email delivery. Receives recipient email addresses and email content. • Vercel — hosting. Receives IP addresses and user agents in technical logs. Each processor is bound by its own data protection terms. We do not share personal data with any other third party except when required by law.
5. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or object to the processing of your personal data. Under the EU General Data Protection Regulation (GDPR), these rights include access, rectification, erasure, data portability, and the right to object. If you are a subscriber, you can exercise most of these rights directly from your account settings. If you are a contact of one of our subscribers, please contact that subscriber, who is the controller of your data. You may also contact us and we will help route your request.
6. Data retention
We retain account data for as long as a subscriber keeps an active account. When an account is closed, we delete or anonymize its data within a reasonable period, except where we must retain certain records to comply with legal or accounting obligations. Subscribers may delete their contacts and campaign data at any time from within the application.
7. Security
We protect personal data with industry-standard measures, including: • Row-Level Security in the database, so each organization can only access its own data. • Encryption in transit over HTTPS. • Separation of credentials and least-privilege access for internal systems. No system is completely immune to risk, but we work continuously to keep your data safe.
8. Cookies
CliraFlow uses only a strictly necessary cookie to maintain an authenticated session for signed-in subscribers. We do not use advertising or third-party tracking cookies.
9. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify subscribers. Continued use of the service after a change means you accept the updated policy.
10. How to contact us
If you have questions about this Privacy Policy or how we handle your data, contact us at [email protected].
This service is operated by CliraFlow, based in Santiago, Chile.