Privacy Policy

This Privacy Policy explains what information ClientLift (operated by Elhussein T. Elsayed, Geneva Webstudio, Rue de la Prairie 17, 1202 Genève, Switzerland (UID CHE-250.661.179), contact info@clientlift.ai) collects, how we use it, and who we share it with. It applies to anyone who uses the Service, and to individuals whose contact information a ClientLift customer imports into the CRM > Audience feature (see Section 3 below — that's about your data even if you never signed up yourself).

1. Information We Collect

Account information

Your first and last name, email address and phone number, entered when you create an account. If you sign up or log in with Google, we receive your name and email address from your Google account and nothing else; we never see your Google password. Passwords for email sign-ups are handled by Firebase Authentication, and we never see or store them in readable form.

Business and brand information

Business name, business address, website URL, logo and site images, brand colors/fonts, phone number, and other details you provide or that we extract from your own website and Google Business listing when you set up a Brand Profile.

Billing information

Your plan, credits balance, and Stripe customer/subscription identifiers. Stripe processes your actual payment details (card number, etc.) directly — we never receive or store your full card number.

Content you create

Prompts, briefs, and the images/video/audio/3D assets/copy generated through the Service.

Usage data

What features you use and when, for billing (credit consumption) and reliability purposes.

2. Information From Connected Accounts

If you choose to connect a third-party account, we access only what that integration needs to do its job:

• Google — signing in with Google gives us your name and email address. If you also connect Google Search Console or Google Analytics, we access that data (read-only) for the website or property you choose, only to show you its performance inside ClientLift. Each connection asks for its own permission, and you can revoke it at any time. ClientLift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, sell it, or let people read it except as needed to provide the feature or as the law requires.
• Meta (Facebook/Instagram) — access to the Facebook Pages and Instagram Business accounts you choose. We read their names, follower and engagement figures to show you how your accounts perform, and we publish the posts you create and approve in ClientLift to them. We do nothing else with them.
• YouTube (through Google) — read-only access to the channel you choose: subscriber numbers, video views and your recent uploads, shown inside ClientLift. If you also choose to publish videos or Shorts to YouTube, we ask for a separate permission to upload videos. We upload only the video you wrote and submitted in ClientLift, to your own channel, and nothing else. YouTube may keep uploaded videos private until it has reviewed ClientLift.
• TikTok — your TikTok profile and the statistics of your videos (followers, views, likes), shown inside ClientLift. If you choose to post, we ask for separate permissions to send a video to your TikTok drafts or to post it to your account. We send only the video you wrote and submitted in ClientLift, and nothing else. Until TikTok has approved ClientLift, posts can only be private.
• LinkedIn — signing in with LinkedIn gives us your name and profile picture; if you allow it, we publish the posts you write and approve in ClientLift to your own profile.
• Pinterest — your Pinterest account's profile and the performance figures of your pins and boards, shown inside ClientLift.
• Mailchimp — read-only access to your audiences and the results of your sent campaigns, shown inside ClientLift.
• WordPress — your site address and an application password you create. We read your pages and posts to check them, and we change a title, description, image text, redirect or draft article only after you approve it. Every change can be undone from ClientLift.
• Canva — access to your Canva brand kit and designs, used to push generated assets into Canva and pull designs/assets back into ClientLift.

You can disconnect any of these at any time from Settings > Integrations, which revokes our access token. We don't use these connections for anything beyond the specific feature they power.

Community inbox and connected mailboxes

The Community feature is an inbox for the comments and messages your own customers send you. You can add a message by hand, and you can connect an email account (Gmail, Outlook, Yahoo or any other provider that supports IMAP) using an app password that you create in that account. We handle this as follows:

• What we read. Only the inbox of the connected account, and only to copy new messages into ClientLift: the sender's name and address, the subject, the text, and the date. We do not delete, move, change or mark anything in your mailbox. Newsletters and automatic mail are skipped.
• What we keep. The copied messages, any reply you write or send, and a short label and summary added when you ask ClientLift to read them. They stay in your business account until you delete them or the business is deleted (see Section 6).
• Replies. A reply is sent from your own email address through your own provider's outgoing mail server, only when you press Send and confirm, and only to the person who wrote to you. ClientLift never sends mail on its own, and never sends to anyone else through your account.
• Your app password. We store it on our servers, in a part of our database that is not readable from your browser or by other customers, only so that we can sign in to your mailbox for you. It is never shown again in the page. Disconnecting the mailbox deletes it at once. You can also revoke it in your email account at any time.
• Automated reading and drafting. When you ask ClientLift to read new messages or to draft a reply, the text of those messages and your business details are sent to our AI provider (Anthropic) to produce the label and the draft. This happens only when you press the button, and you decide what is sent as a reply.
• The people who write to you. Their messages are their words, sent to you. We process them on your behalf, as a processor, and you are responsible for answering them lawfully. If you want a message of yours removed from a business's inbox, see our Data Deletion Instructions.

3. CRM > Audience Data (Third-Party Contacts)

A ClientLift customer can import a contact list (name, email, phone, notes, and free-form tags) via CSV upload for their own outreach and segmentation. This data belongs to that customer, who is responsible for having a lawful basis to hold and use it — we act as a processor of this data on their behalf, not as the party who decided to collect it. If you believe your information was imported this way and want it deleted, see our Data Deletion Instructions.

4. Third Parties We Share Data With

We don't sell your data. We share it only with the service providers below, each acting as a processor for the specific purpose listed — never with data brokers or advertisers.

• Anthropic (Claude) — brand/business text you provide, and the text of messages you ask us to read or reply to, to generate strategy content, prompts, copy, labels and draft replies.
• fal.ai — a hosting layer for several generation models (including ElevenLabs for audio, Meshy for 3D, Google's Gemini-based image models, and others) — receives your generation prompts and any reference images you attach.
• Stripe — billing and payment details, to process subscriptions and credit purchases.
• Google — the Gemini API (image generation and text), the Places API (looking up your public business listing), and Sign in with Google.
• Meta — only the Pages and Instagram accounts you connect, to publish the posts you approve.
• TikTok, LinkedIn, Pinterest, Mailchimp — only the accounts you connect, for the figures and posting described in Section 2.
• Your email provider and your WordPress site — when you connect a mailbox or a website, we sign in to it with the credential you gave us; we do not share your data with them beyond what that sign-in and your actions require.
• Resend — the email address of someone you invite to your team, to deliver the invite email.
• Firebase / Google Cloud — our infrastructure provider for authentication, database, and file storage. All of your data is stored here.

None of these providers receive your CRM > Audience contact list — that data stays within ClientLift's own infrastructure (Firebase) unless you explicitly export or sync it yourself.

5. Platform Support Access

Authorized ClientLift staff (support/operations) can access a customer's business account directly, without needing to be invited as a team member, in order to provide technical support. Every time this happens, we record who accessed which business and when, in an internal access log — this is never invisible, and it's never used for anything beyond providing support.

6. Data Retention

We keep your data for as long as your account is active. If a subscription ends, the account becomes read-only and your work stays available so you can resubscribe. If you remove a business from your account, it is hidden immediately and permanently deleted after 30 days. You can also ask us to delete everything at any time (see Section 8). Messages copied into your Community inbox stay until you delete them or the business is deleted; disconnecting a mailbox deletes its app password immediately but leaves the messages already copied. We keep billing records where the law requires it, and data in routine backups until they cycle out.

7. Cookies

We use only the essential session/authentication cookies needed to keep you signed in — no advertising or third-party tracking cookies, and no analytics pixels on this site today.

8. Your Rights and Data Deletion

Depending on where you're located, you may have rights to access, correct, or delete your personal data. See our Data Deletion Instructions for how to request deletion, or email info@clientlift.ai for any other request.

9. Data Security

We rely on Firebase Authentication and Firestore's access-control rules to restrict who can read or write your data, and access is scoped per business. No system is perfectly secure, but we take reasonable technical measures to protect your information. Credentials such as application passwords and access tokens are kept on the server side only and are never sent back to your browser.

10. Children's Privacy

ClientLift is a business tool and isn't directed at, or knowingly used by, children.

11. International Data Transfers

Our infrastructure and service providers may process data outside your own country. Where required, we rely on appropriate safeguards for these transfers.

12. Changes to This Policy

We'll post any changes here with an updated "Last updated" date. If a change is material, we'll make reasonable efforts to let you know directly.

13. Contact

Questions about this policy? Reach us at info@clientlift.ai.