Privacy Policy

Cliux is operated by its founder as a sole operator. The company (Cliux Teknoloji Ltd. Şti.) is in formation and is not yet registered, so no company registration, MERSIS or tax number can be given here yet. This page will name the registered entity as soon as there is one.

This policy covers the Cliux website, the console where you build and run a site, what the platform stores about the visitors of a site you publish, and what we receive when you apply for a role at Cliux or write to us about working here. It does not cover what you, as a site owner, choose to collect from your own visitors through your forms and store; for that you are the controller and you owe them a notice of your own. Where this policy says "you", it means an account holder unless it says visitor or applicant.

Things you give us:

• Your name and email address, when you create an account.
• Billing details, which go to Stripe; Cliux never sees a card number.
• Everything you put into a site: pages, images, files, products, posts, form settings.
• Messages you send through the contact form.
• An application you make on a role's LinkedIn job: what LinkedIn passes to us, such as your profile, your CV and your answers.
• A question you send to the careers address: your message and your contact details.
• What you write in the help chat, and the email address you leave there when you want an answer by email.
• The holder details for a domain you buy through Cliux: name, postal address, phone number, email address and, if you give one, a company.

Things the platform records on its own:

• Server logs with the IP address, browser and page of each request, kept for operating and securing the service.
• Console actions that other people on your account can see in the activity log (who published, who invited whom).
• A delivery record for each email the platform sends: what kind of email it was, the recipient's address with most of it hidden, when it was sent and whether the email provider accepted it. Never its subject or its content.
• On a published site: the form submissions, orders, bookings, comments and chat messages your visitors send you, stored on your behalf.

The marketing site counts no page views. For one visit in ten it measures how fast the page loaded (its timings, its path and the kind of navigation, device and connection, with no identifier), only after you allow analytics in the cookie notice. The console runs no analytics. A published site's first-party analytics counts visits and measures page speed for its owner without a cookie; see the cookie policy for exactly what is stored in a browser.

To run the service you signed up for: sign you in, save your work, publish your site, take your visitors' orders and bookings and hand them to you, send you the mail the product sends (sign-in codes, order and booking notices, notifications you switched on), charge the plan you chose, and answer you when you write.

To keep the service safe: rate limits, spam checks on forms, fraud checks on payments, and the logs above. To meet legal obligations: tax and accounting records, and lawful requests from authorities.

We do not sell personal data, we do not build advertising profiles, and we do not send marketing email.

Each use above rests on a ground the law names, under the GDPR (Article 6) and under Turkey's Law No. 6698 on the Protection of Personal Data (KVKK, Article 5):

Where a site owner collects data from their own visitors through Cliux, the site owner decides why, and we process it on their behalf (the data processing agreement sets that out).

Cliux runs on a small number of providers. Each one sees only what its job needs.

If a site owner adds a Google Analytics or Meta Pixel id to their own site, that tracker is governed by that site owner's notice and the tracker's own terms, not by this policy. Every site starts with its consent banner switched on, and while it is on, the tracker loads on the site's published pages only after a visitor accepts the banner. A site owner can switch the banner off in the site's settings; the tracker then loads without asking, and that is the site owner's decision as the controller.

When you ask Cliux to translate your site by machine, the texts you chose to translate, and the language, are sent to Google Cloud Translation in the European Union, which returns the translation; nothing about your account or your visitors is sent. Google processes them for Cliux as our processor and does not use them to train its models. For someone in Turkey, sending them to the European Union is a transfer of personal data abroad, which matters only where a text you translate names a person.

When you use Generate with AI in the editor, what you typed for it (what the text is about, or the text you asked to rewrite, and any instruction you added), your site's name and description and the page's name are sent to Google's Gemini on Google Cloud's Vertex AI in the European Union, which writes the versions you choose from; nothing about your account or your visitors is sent. Google processes this for Cliux as our processor and does not use it to train its models. For someone in Turkey, sending it to the European Union is a transfer of personal data abroad, which matters only where what you write names a person.

If a site owner installs a plugin made by another company, that company receives what the plugin's page listed when it was installed: identifiers for the site and for the person using the plugin that are different for every plugin (never a name or an email address), the site's name and address only if the plugin asked for them, and whatever the plugin's own screens collect. A paid plugin's developer also receives the payer's email address and payment details, through Stripe, because they are the seller. Each developer is responsible for that data under the privacy policy linked on the plugin's page. A plugin that measures visitors follows the same banner: while it is on, the plugin loads on a published page only after the visitor accepts, and when the site owner has switched it off, the plugin loads without asking.

Every one of these providers is outside Turkey, and some are outside the European Union. For data from the European Union, a transfer to a provider outside the EU rests on that provider's data processing terms, which include the EU standard contractual clauses or, for a certified US provider, the EU-US Data Privacy Framework. For someone in Turkey, sending data to any of them is a transfer of personal data abroad.

• Account and site data: for as long as the account exists. A site you move to the trash is kept 90 days, so you can restore it, and is then deleted with everything in it.
• Form submissions: for as long as the site owner sets per form; a form with a retention window deletes older submissions once a day.
• Server logs: fourteen days, rotated daily.
• Site analytics (the page views and visits a site owner sees): 26 months, then deleted by a daily job. Without the visitor's consent they carry no visitor id, only a daily hash that cannot be linked to another day.
• A site member's sign-in session: 30 days after it ended.
• Applications: read on LinkedIn and not copied out of it; if you are not hired, our notes on it are deleted by hand six months after the decision.
• Messages to the careers address: six months after they arrived. A CV sent there is deleted when we find it, without being considered.
• Help chat conversations: twelve months after the chat closes, then deleted with everything in them.
• Domain holder details: only until the registrar has them. They are deleted when the registration completes or fails, and within an hour of a hold on a name lapsing unpaid.
• Email delivery records: thirty days.
• Page-speed measurements (timings, a page's path and the kind of navigation, device and connection, no identifier): ninety days.
• Backups: the database is backed up nightly; the last fourteen nightly copies are kept on the server and an encrypted copy of each is kept off the server for up to ninety days, and uploaded files are mirrored off the server weekly. A deletion is complete when the copies holding the row or the file have aged out.
• Invoices and payment records: as long as tax and commercial law requires (ten years in Turkey), even after the account is deleted.

You can move a site to the trash from the console yourself: it is deleted for good 90 days later, or at once when you choose Delete forever in the trash. You can also delete a whole agency and everything under it.

You can delete your account yourself, under Manage account and then Delete account. When you do, the plan of every site that goes to the trash ends at once and no renewal is charged for it, but the workspace plan of an agency you own is not ended and keeps renewing each year, so stop its renewal on the agency's Billing page first if the agency is not to carry on without you; every site you own goes to the trash, off the web at once and deleted for good 90 days later; an agency you own passes to the admin whose Cliux account is the oldest among its admins who own no agency of their own, or, with no such admin, its sites go to the trash too; your help chats, notifications and access to other people's sites are deleted; and the name and email address on your account are removed at once. Your email address stays in records made under it, such as the record of a plan you paid for or a discount you claimed, and in the audit log, which cannot be changed; a message you sent through the contact form keeps the name and email address you gave in it. What the law makes us keep, such as invoices, is kept for as long as it says. You can also write to [email protected], or use the contact form, and we do it for you.

If you want a copy of your sites or your data first, say so; there is no self-service export of a whole site yet, and we send you one within a month.

Cliux takes applications in one place, the role's LinkedIn job, and not through this website: there is no application form and no file upload on the site, and the careers page keeps nothing about you beyond the server log every page request leaves. [email protected] is for questions about a role or about working here, not for applications. Please do not send a CV to it: a CV that arrives there is deleted when we find it, without being considered, and we reply pointing you to LinkedIn.

• On LinkedIn, your application is handled under LinkedIn's own terms and privacy policy, with LinkedIn as a separate controller. What reaches us is what you chose to send there: your profile, your CV and your answers. We read them on LinkedIn and do not copy them out of it; the copy LinkedIn keeps follows LinkedIn's own retention.
• At [email protected], your message is received on Cliux's mail server, which Hetzner Online GmbH hosts in Nuremberg, Germany and processes on our behalf. For someone writing from Turkey, sending it there is a transfer of personal data abroad.

Applying is voluntary, and without an application we cannot consider you. Please leave health, religion and similar details, and a photo, out of a CV: we do not need them.

We use your application only to consider you for the role you applied for and to reply to you. Considering it is a step towards a contract you asked for (GDPR Article 6(1)(b); KVKK Article 5(2)(c)). If you are not hired, our notes on it are deleted by hand six months after the decision; until then we keep them only to answer a complaint or a claim about that decision (GDPR Article 6(1)(f); KVKK Article 5(2)(e)). If you are hired, it becomes part of your employment record. A message to [email protected] is kept six months after it arrived, to answer it and anything that follows from it. None of this is used for anything else, and no decision about you is made by software.

You can ask for a copy, a correction or an earlier deletion at [email protected], and you can object to our keeping it for those six months. Under KVKK Article 11 you may also ask whether your data is processed, why, and to whom it has been sent; ask that a correction or a deletion be passed on to them; object to a result reached only by automated analysis; and claim compensation for damage from unlawful processing. If we do not answer within thirty days, or you disagree with the answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

The help chat on the Cliux website and in the console answers first with an AI model, Google's Gemini, run on Google Cloud's Vertex AI in the European Union. It reads the help centre pages our own search finds for your question and writes the answer from them; the chat labels every answer it writes as AI, and it can be wrong. The model is sent what you write in the chat, with email addresses, phone numbers and card numbers removed, the last few lines of the chat, and those pages. It is never sent your account, your email address or anything about your sites that you have not written in the chat yourself, so please write nothing there you would not want read. A question the chat recognises as about a payment, a refund, signing in, deleting an account, your data, security or the law is not sent to the model: the help centre answers it and a person from the support team takes over. A question it recognises as about Cliux's own prices, plans, terms, privacy or security is answered with the pages themselves, not by the model. The model is told never to state such things, and an answer that names a price, a percentage or a plan, or makes a commitment the pages it cites do not make, is withheld. To check the model, the support team may read a small random sample of its answers, each with the question it answered, including in chats nobody handed to a person; every such read is recorded, and a record of the help centre pages the model read is kept with each answer for as long as the chat is. Google processes this for Cliux as our processor and does not use it to train its models. It may hold a question in memory for up to a day to answer faster, and keeps one its automated abuse checks flag for up to 90 days, in the European Union. For someone writing from Turkey, sending the question to the European Union is a transfer of personal data abroad. When you start a chat without being signed in, Cloudflare Turnstile first checks that you are not a program, and sees your IP address and browser signals to do so; a chat whose check does not pass is answered by the help centre alone.

What we keep: what you write, the answers the chat gave, the page you were on, whether you were on a phone or a computer, your browser's language, and the rating you give a chat the support team answered, if you give one. When you are signed in, the chat is tied to your account, and to the site or agency you wrote from if you can open it. Card numbers, Turkish ID numbers and IBANs typed into the chat are masked before anything is saved; please do not send them.

The chat that the site editor's Help opens is never handed to a person: only the help centre, and the AI model where one answers, reply in it. Anywhere else, when you ask for a person, or the help centre cannot answer, the conversation goes to the Cliux support team, who read it in Cliux's own admin console. Who opened a chat, and when, is recorded (opening the same chat again within a few minutes counts once), and a chat whose opening cannot be recorded is not shown. If somebody is available, they join the chat; if nobody is, the team is told by email that a chat is waiting (the email carries a link, not what you wrote) and answers when they can. When you are not in the chat when an answer comes, we also email it to you, through Resend, the email provider in the table above: to the address on your account, or to the one you leave in the chat when you are not signed in. For someone writing from Turkey, that email is a transfer of personal data abroad.

If you are not signed in, your first message sets one cookie, __Host-cliux_help, so the conversation follows you from page to page. Once the support team has your chat, your browser also keeps one item in local storage, cliux.helpChat.withTeam, so the chat button can show a reply while the chat is closed; it is removed when the chat closes. Opening the chat on the website or from a console's header keeps another item in local storage, cliux.helpChat.greeted, so the website's greeting is not offered again during that visit, and muting the chat's sound keeps cliux.helpChat.muted. The cookie policy lists them all.

A chat nobody writes in for a day is closed, and one waiting for us is closed after two weeks. Every chat is deleted twelve months after it closes, with everything in it.

We use the chat to answer you; to count, as totals, how many chats the help centre settled without a person and how the support team did; and to read the questions the help centre could not answer, so we can write the answers it is missing. The support team reads those questions in the admin console, and who opened the list, and when, is recorded. Answering an account holder is part of the service they signed up for (GDPR Article 6(1)(b); KVKK Article 5(2)(c)). Answering a visitor who is not signed in, and keeping the chat long enough to follow up, is our legitimate interest (GDPR Article 6(1)(f); KVKK Article 5(2)(f)), and so is reading the questions the help centre could not answer, to write the answers it is missing, counting how the chat and the team did, and, when an AI model answers, checking a sample of its answers (the same articles). You can ask for a copy of a chat, or for it to be deleted sooner, at [email protected].

A domain bought through Cliux is registered in your name, and the registry for its ending has to know who holds it. Before a registration we ask for the holder's name, postal address, phone number, email address and, if you give one, a company. You accept the registrar's registration agreement at the same step, where ICANN's statement of a registrant's rights and responsibilities is shown beside it.

We send those details to our registrar, Namecheap, Inc., in the United States, which registers the domain and passes them to the registry for the domain's ending, as ICANN's rules require. The registrar and the registry hold them as controllers in their own right, under their own privacy policies. The registrar emails the holder once to confirm the address, and a domain whose address is not confirmed can be suspended. WHOIS privacy is switched on for every domain we register, so the public WHOIS record shows the registrar's privacy service and not you. For someone in Turkey or in the European Union, sending the details to the United States is a transfer of personal data abroad.

Cliux keeps the holder details only until the registrar has them. They are deleted from our database when the registration completes or fails, and within an hour of a hold on a name lapsing unpaid; a hold lasts at most seven days. What we keep is the domain itself, what was paid for it and when, and when you accepted the registration agreement, for as long as the domain is on your account.

Registering a domain you ordered is part of the service you asked for (GDPR Article 6(1)(b); KVKK Article 5(2)(c)). To see or correct the holder details of a registered domain, or to have it moved to another registrar, write to [email protected].

Traffic is encrypted in transit. Your console sign-in is handled by Clerk; the passwords your site's members and shared-preview visitors set are hashed with argon2id. Every action that touches a site's data passes an authorisation check, and an automated scan of the codebase refuses a change that skips one. The security page says the rest, including what we do not have.

Depending on where you live you may have the right to:

• see the personal data we hold about you and get a copy;
• have it corrected or deleted;
• object to or restrict how it is processed;
• withdraw a consent you gave;
• complain to your data protection authority.

Under the KVKK (Article 11) you may also ask whether we process your data and for what, learn who in Turkey and abroad it is passed to, have the people it was passed to told of a correction or deletion, object to a result reached solely by automated processing that goes against you, and ask for your damage to be compensated if it was processed unlawfully. You may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) after writing to us first.

If you are in the EU or the EEA, the GDPR page sets these out in full. To exercise any of them, write to [email protected], or use the contact form and choose "Help with my site".

Cliux is a service for adults building websites, and an account is for people aged 18 or over. We do not knowingly collect data from children. A site owner who builds a site meant for children is responsible for the consent the law asks for before collecting their data through it. If you believe a child has given us personal data, write to [email protected] and we delete it.

Privacy questions and requests go to [email protected], or through the contact form. There is no separate data protection office and no postal address to give yet: Cliux is one person, and both reach them directly. We answer within a month.

When this policy changes, the date at the top changes. If a change reduces your rights, it is published before it takes effect, and the page shows the day it does.