Privacy Policy

Account information: Name, email address, phone number, and professional profile data.

Usage data: Information about how you use the platform, including managed leads, scheduled appointments, and performance metrics.

Lead information: Contact and follow-up data for prospects that you or your team enter into the platform.

Integration data: Information synced from connected services such as Google Calendar and Google Ads (accessible ad accounts, campaign, ad group and ad structure, and performance metrics).

Tracking and attribution data: UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and Click IDs (fbclid from Facebook/Meta, gclid from Google Ads) for lead source attribution and conversion analysis.

Transaction data: Information about sales, payments, and commissions processed on the platform.

VoIP telephony data: Call records (metadata such as duration, origin and destination number, date and time), call recordings (when enabled by the user), assigned phone numbers, and telephony configuration.

Messaging data: Content and metadata of WhatsApp, Instagram Direct, and Telegram conversations managed from the platform (messages, attachments, conversation identifiers, and delivery statuses).

Email marketing data: Email addresses, campaigns sent, opens, clicks, unsubscribes, bounces, and spam complaints.

Public forms: Responses submitted through embedded forms, together with campaign parameters (UTM), the referring page, and advertising click identifiers.

Meetings and calls: Recordings, transcripts, and call quality analysis for phone calls and video calls when enabled by the user.

Data processed by AI: Texts, transcripts, and metrics sent to artificial intelligence providers to generate summaries, analysis, and assistant responses.

We use the information we collect to:

• Provide and maintain Clyzer's services
• Manage your account and your team members
• Process and display sales and performance metrics
• Sync appointments with external calendars
• Send notifications about appointments, leads, and goals
• Improve and optimize our platform
• Provide technical support
• Perform conversion attribution analysis to measure the effectiveness of advertising campaigns

Legal basis: We process your data based on the performance of the service contract, your explicit consent (where applicable), and our legitimate interests in improving the platform.

We implement robust security measures to protect your information:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication and role-based access control
• Data isolation between workspaces (multi-tenant architecture)
• Granular security policies at the database level
• Continuous monitoring and regular security audits
• Rate limiting to prevent abuse

We do not sell your personal information. We may share data with:

• Members of your workspace: According to the configured role permissions
• Authorized integrations: Google Calendar or other services you connect
• Configured webhooks: Data sent to external systems you configure (Zapier, Make, etc.)
• Service providers: For hosting, email, and essential functionality

We use the following third-party services (data processing sub-processors) to provide platform functionality:

Each third-party service has its own privacy policy governing how it processes information. Clyzer maintains data processing agreements with each sub-processor.

Clyzer acts in two distinct capacities with respect to the processing of personal data:

As Data Controller: For your user account data, platform usage data, and billing data. Clyzer determines the purposes and means of processing this data.

As Data Processor: For all data that you or your team enter into the platform relating to your leads, customers, contacts, conversations, call recordings, and any other third-party data. You (or your workspace) are the Data Controller for this data.

As Data Processor, Clyzer only processes your leads' and customers' data in accordance with your instructions and for the purposes of providing the contracted service. Clyzer does not use this data for its own purposes, does not sell it, and does not share it with third parties other than the sub-processors necessary to provide the service.

You are responsible for ensuring the lawfulness of processing, obtaining any necessary consents, handling data subject rights requests, and complying with applicable data protection regulations regarding the data you enter into Clyzer.

When you use Clyzer's VoIP telephony services, we process the following types of data:

• Call metadata: Origin number, destination number, duration, date/time, call status, and direction (inbound/outbound).
• Call recordings: When recording is enabled by the user, audio is stored encrypted and its retention is controlled by the user.
• Assigned phone numbers: Information about phone numbers provisioned through our telephony provider, including country, number type, and associated regulatory documentation.
• VoIP billing data: Usage records (minutes, credits) and prepaid wallet transactions.

Call recordings are stored encrypted at rest. The user is solely responsible for obtaining consent from all parties before activating recording, in accordance with applicable law in the jurisdiction of each call participant.

Our telephony provider acts as a sub-processor for all telephony data. Signaling data and call content transit through the provider's infrastructure in accordance with its privacy policy and the processing agreements in force.

When you connect messaging channels, Clyzer stores the messages, files, and metadata necessary to display conversations within the platform and to automate responses.

Meta and Telegram access tokens are stored encrypted and used only to send and receive messages on behalf of the user. They are never shared with other customers.

Incoming media files are validated and stored in private repositories, accessible only via temporary signed links.

The user, as Data Controller, decides which contacts receive messages and on what legal basis.

Email campaigns are sent through an external delivery provider. Delivery, open, click, unsubscribe, bounce, and spam complaint events are recorded to measure results and protect sending reputation.

Unsubscribes, hard bounces, and complaints are automatically added to a per-project suppression list to prevent future sends to those addresses.

Open metrics are estimates: some email clients block or pre-load tracking pixels.

When AI features are enabled, certain content (transcripts, messages, or CRM data summaries) is sent to authorized AI providers to generate analysis, responses, or suggestions. These providers act as sub-processors and do not use the data to train their models.

Phone calls and video calls may be recorded and transcribed if enabled by the user. Audio files are automatically deleted after 30 days; transcripts and analysis are retained while the account is active or until manually deleted.

AI outputs are advisory in nature, and no automated decisions with legal effects on individuals are made.

Embeddable public forms collect the data entered by the visitor, together with campaign parameters (UTM), advertising click identifiers, and the referring URL, in order to attribute the lead to the corresponding campaign.

On Clyzer's website we use referral identifiers and campaign parameters with an attribution window of up to 90 days to recognize subscriptions generated by affiliates. We only share aggregated conversion data with the affiliate, not the end customer's personal data.

Sending conversion events to advertising platforms (e.g., Meta or Google) is only done if the user configures it in their project and at their own responsibility.

Access: With the user's explicit permission (OAuth authorization using the read-only adwords scope), we access the list of accessible ad accounts, the campaign, ad group and ad structure, and daily metrics (impressions, clicks, cost and conversions).

Use: This data is used solely to display advertising performance and to attribute leads and sales to campaigns within the user's own workspace. It is never used for our own advertising or for any other purpose.

Storage: OAuth tokens are stored encrypted and metrics are stored aggregated by day on secure servers located in the European Union. We do not store personal data of Google end users.

Sharing: Data obtained from Google is not sold, rented or shared with third parties; it is only shown to authorized members of the workspace that connected the account. We comply with the Google API Services Limited Use requirements.

Revocation: Users can disconnect the account at any time from within the app — which deletes the tokens and the synced data for that account — or revoke access at myaccount.google.com/permissions.

Access: With the user's OAuth authorization, we access Google Calendar to sync appointments and check availability.

Use: Data obtained from Google APIs is used solely to provide the features requested by the user within their own workspace.

Limited Use: The use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. This data is not used to train, develop, or improve artificial intelligence or machine learning models, nor is it transferred to AI services for that purpose.

Sharing: It is not sold, rented, or shared with third parties; it is only shown to authorized members of the workspace that connected the account.

Revocation: The user can disconnect the integration from the app or revoke access at myaccount.google.com/permissions.

Your data may be transferred to and processed outside the European Economic Area (EEA), particularly in the United States, where some of our service providers are located.

When we transfer data outside the EEA, we implement appropriate safeguards to protect your information, including:

• Standard contractual clauses approved by the European Commission
• Adequacy certifications and frameworks where available
• Transfer impact assessments when necessary

We retain your information for the following periods:

After these periods, data is securely deleted or anonymized.

Under the General Data Protection Regulation, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete information
• Erasure: Request deletion of your account and data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to the processing of your data in certain cases
• Restriction: Restrict the processing of your data
• Withdraw consent: Withdraw your consent at any time

Right to lodge a complaint: If you believe that the processing of your data violates your rights, you may file a complaint with the data protection authority of your country of residence.

Important: If you are a lead or contact of a Clyzer user and wish to exercise your rights, you must contact directly the user/company that entered your data into the platform (Data Controller). Clyzer will collaborate with that Controller to address your request.

If you have questions about this privacy policy or how we handle your data, you can contact us at:

privacy@clyzer.com

Data controller: For Clyzer platform user data, the data controller is Pepper Storm Unipessoal LDA, a company with its registered office in Portugal. You can contact us at privacy@clyzer.com.