Privacy Policy

1. Data Controller

The data controller is Clear data, s.r.o., ID: 19420439, Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic, registered at the Municipal Court in Prague under file no. C 384880.

Contact: info@cleardata.cz

2. What Data We Process

ClearData is an analytics tool for e-shop owners and marketing agencies. We process the following categories of data:

• Login credentials: email address and hashed password for authentication.
• Account data: name, organization name and user role.
• Meta (Facebook) Marketing API data: advertising results (spend, impressions, clicks, conversions, purchase value) at the campaign and adset level.
• Google Ads API data: campaign and ad group results (spend, impressions, clicks, conversions).
• Integration metadata: ad account identifier, connection date and access token (stored encrypted using AES-256-GCM).
• E-shop data: orders, revenue and other business metrics loaded from the client's database.
• Usage data: pages visited, features used, session duration, clicks and interactions within the application.
• Session recordings: visual recordings of your interactions with the application (mouse movements, clicks, scrolling) for the purpose of improving user experience.
• Technical data: browser type, operating system, screen resolution, IP address.

3. Purpose and Legal Basis

• Providing the service (Art. 6(1)(b) GDPR) — displaying marketing and business dashboards.
• Analytics and service improvement (Art. 6(1)(f) GDPR) — we use PostHog (EU servers) to understand how users interact with the application, identify issues and improve the product.
• Session recordings (Art. 6(1)(f) GDPR) — used to diagnose usability issues and improve the user experience.
• Consent (Art. 6(1)(a) GDPR) — connecting Meta and Google Ads accounts via OAuth 2.0.
• Security and fraud prevention (Art. 6(1)(f) GDPR) — application security, error and sync logging.

4. Analytics and Tracking

We use PostHog, a product analytics platform, to collect usage data. PostHog processes data on servers within the European Union (Frankfurt, Germany).

Data collected by PostHog includes: pages visited, clicks and interactions, session duration, browser and device information, and session recordings.

Your account is linked to your analytics data so we can provide better support and understand how different user roles interact with the application. We do not use this data for advertising or share it with third parties for marketing purposes.

PostHog sets cookies on your device to distinguish sessions and users. These cookies are necessary for the analytics functionality of the service.

5. Data Sharing

We do not process data for advertising or commercial purposes of third parties. We access the Meta Marketing API and Google Ads API solely to retrieve data that the user has explicitly granted access to. This data is not shared with any third parties outside the ClearData platform.

Processing takes place on infrastructure within the EU. We use the following sub-processors:

• Vercel Inc. — application hosting (EU region)
• Amazon Web Services (AWS) — database hosting (eu-central-1, Frankfurt)
• PostHog Inc. — product analytics (EU servers, Frankfurt)
• Resend Inc. — transactional email delivery

6. Access Tokens (OAuth)

When connecting a Meta or Google Ads account, we receive an access token. The token is stored in the database in encrypted form (AES-256-GCM). You can disconnect the integration at any time in Settings → Integrations, which immediately deletes the token from our database.

7. Data Retention

• Advertising data (Meta, Google Ads) — for the duration of the integration + 30 days after disconnection.
• Login credentials — for the duration of the account.
• Sync logs — last 90 days.
• Analytics data (page views, session recordings) — up to 12 months.

8. Your Rights

Under GDPR, you have the right to:

• access your personal data,
• rectify inaccurate data,
• erase your data ("right to be forgotten"),
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time without affecting prior processing.

Send requests to info@cleardata.cz. You also have the right to lodge a complaint with the Office for Personal Data Protection (uoou.cz).

9. Security

We implement appropriate technical and organizational measures to protect your data, including: encryption of data in transit (TLS) and at rest, AES-256-GCM encryption for third-party access tokens, role-based access control, and regular security reviews.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or a notice in the application.

11. Contact