Legal
GDPR
For people in the EU and the EEA: the roles, the legal bases, your rights, and where data goes.
Last updated 5 min read
Scope and roles
This page supplements the privacy policy for people in the European Union and the European Economic Area.
For your account, for the platform's own records and for an application you make for a role at Cliux, Cliux is the controller. For the content of a site you publish, and for what your visitors send that site (form submissions, orders, bookings, comments, chat), you are the controller and Cliux is your processor: we store and serve it on your instructions and do nothing else with it. The data processing agreement, part of the Terms of Service, sets out what we owe you as your processor.
Legal bases
- Performance of a contract: providing the Service you signed up for, including answering you in the help chat and registering a domain you order, whose holder details go to the registrar and the registry as the privacy policy describes.
- Legitimate interests: keeping the service secure, preventing abuse and fraud, improving the product from how it is used in aggregate, answering somebody who writes in the help chat without an account, reading the help chat questions the help centre could not answer, to write the missing answers, checking a sample of the help chat's AI answers for accuracy (see the privacy policy), and keeping our notes on a declined application for six months to answer a complaint or a claim about the decision.
- Legal obligation: tax and accounting records, and lawful requests from authorities.
- Steps before a contract: considering an application you make for a role at Cliux, as the privacy policy describes.
- Consent: where a site owner adds a third-party tracker to their published site, the site's consent banner asks the visitor before it loads, unless the owner has switched the banner off, which is the owner's decision as the controller.
Cliux sends no marketing email, so no consent is asked for one.
Your rights
- Access: a copy of the personal data we hold about you.
- Rectification: correction of what is wrong.
- Erasure: deletion, subject to what we must keep for tax and accounting.
- Restriction and objection: to stop or narrow processing that rests on legitimate interests.
- Portability: your account data in a machine-readable form.
- Withdrawal of consent, without affecting what was lawful before.
- A complaint to your supervisory authority.
Write to [email protected], or use the contact form, for any of these and we answer within a month. If you are a visitor of a site built with Cliux, the site's owner is the controller of what you gave that site; write to them first, and to us if they do not answer.
Where data goes
| Provider | What it does for you | What reaches it |
|---|---|---|
| Clerk | Sign-in and account security for the console | Your name, email address and sign-in events |
| Stripe | Payments: your plan, and what your visitors pay you through your own Stripe account | Billing details and card numbers; the card numbers never reach Cliux |
| Uploadthing | Storage for the images and files you upload | The files themselves |
| Resend | Transactional email: sign-in codes, order and booking mail, notifications you switch on, and the support team's answer to a help chat you have left | The recipient address and the message |
| Amazon Web Services | The server the platform and your published sites run on, in Stockholm, Sweden | Everything the platform stores |
| PayPal, Square, Mollie or Adyen | Payments a site owner takes through their own account with one of these providers, when they have connected it | What the buyer pays, and their payment details, which never reach Cliux |
| Hetzner | The mail server that receives mail sent to a cliux.com address, in Nuremberg, Germany | Your message and anything attached to it, such as a CV |
| Backblaze B2 | Off-site copies of the nightly database backup, and a weekly mirror of the uploaded files | The whole database, encrypted before it leaves the server, and copies of your files |
| Google Cloud (Vertex AI) | The AI model that writes the first answer in the help chat, and writes text in the editor when you use Generate with AI, run in the European Union | Your help chat question with email addresses, phone and card numbers removed, the chat's recent lines, and the help centre pages it answers from; never your account, name or sites. For Generate with AI, what you type for it or ask it to rewrite, and your site's and page's names and description; never your account or your visitors |
| Google Cloud (Cloud Translation) | Machine translation of a site, when its owner asks for it, run in the European Union | The texts of your site you chose to translate, and the language; never your account, your visitors or anything else |
| Cloudflare Turnstile | Spam checks on forms, and on the first message of a help chat an AI model answers | The IP address and browser signals of whoever submits a form or starts that chat |
| Cloudflare | The network every request to cliux.com, a cliux.site address or a site's own domain passes through, which also issues a connected domain's certificate | The requests visitors make, with their IP addresses |
| Sentry | Error reports from the platform | Stack traces, the page address without its query string, and your account id |
Some of these providers process data in the United States and in other countries outside the EU/EEA. For those providers we rely on the transfer terms in their own data processing agreements: the EU Standard Contractual Clauses, or the EU-US Data Privacy Framework for a certified US provider. Cliux itself operates from Turkey, which has no EU adequacy decision; for the data of a site you publish, the data processing agreement includes the Standard Contractual Clauses (module two, controller to processor).
Who is responsible
Cliux has not appointed a Data Protection Officer: its core activities do not consist of regular and systematic monitoring of people on a large scale, or of processing special categories of data on a large scale, which is when Article 37 requires one. The person responsible is the operator named in the privacy policy, reached at [email protected] or through the contact form.
Cliux is established outside the EU and has not yet appointed a representative in the Union under Article 27. Until it does, any request or complaint goes to [email protected], and you may always complain to the data protection authority where you live.