Privacy Policy

Clikta, Lda. ("Clikta", "we", "us", or "our") is the data controller for personal data processed through the Clikta platform, located at Lisbon, Portugal, Portugal. We are registered in Portugal and operate under Portuguese and European Union law.

For all privacy-related questions, you can contact our Data Protection contact at: [email protected]

We collect the following categories of personal data:

Account data

• Full name and email address (when you register)
• Password (stored as a one-way bcrypt hash — we cannot recover your password)
• Company / workspace name
• Role within your organisation

Usage data

• Pages you visit on clikta.com
• Features you use within the app
• Recording metadata (names, timestamps, step counts) — not the content of your recordings
• IP address and approximate geolocation (country level)
• Browser type and operating system

Content data

• Screenshots captured during recording sessions (stored encrypted in our EU databases)
• Text you enter as guide objectives or step descriptions
• Published demos and their viewing statistics

Communication data

• Emails you send us via our contact form
• Support tickets and their content

We rely on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to provide you the Clikta service under our Terms of Service.
• Legitimate interests (Art. 6(1)(f)): analytics to improve the product, security monitoring, fraud prevention.
• Consent (Art. 6(1)(a)): marketing communications and non-essential cookies — only when you have opted in.
• Legal obligation (Art. 6(1)(c)): when required by EU or Portuguese law (e.g. invoicing records).

• To create and manage your account and workspace
• To provide the AI guide, interactive demo, and video generation service
• To send transactional emails (registration confirmation, password reset)
• To send product updates and marketing communications (with your consent — you can unsubscribe at any time)
• To analyse usage patterns and improve the product (using privacy-first analytics — see section 7)
• To respond to your support requests
• To prevent fraud, abuse, and security incidents
• To comply with legal and regulatory obligations

All Clikta data is stored exclusively within the European Union. We use EU-region infrastructure providers (including Hetzner in Germany and/or equivalent EU-based cloud providers). We do not transfer personal data to the United States or to countries without an adequate level of data protection, unless you explicitly instruct us to do so and we have appropriate safeguards in place (e.g. Standard Contractual Clauses).

Screenshots and media files captured by the Chrome extension are stored encrypted at rest using AES-256 encryption and transmitted over TLS 1.2+.

• Account data: retained for the duration of your account plus 90 days after deletion (to allow recovery).
• Recording content and demos: deleted immediately upon your request or account closure.
• Billing records: retained for 10 years as required by Portuguese commercial law.
• Server logs: automatically deleted after 30 days.
• Analytics data: aggregated and anonymised — no personal data retained after 13 months.

Clikta uses Plausible Analytics, a privacy-first, EU-hosted analytics tool that does not use cookies, does not collect personally identifiable information, and does not require consent under GDPR. Plausible data is stored on servers in the European Union.

We do not use Google Analytics, Facebook Pixel, or any other third-party tracker that processes personal data without explicit consent.

We use a minimal number of cookies. For full details, see our Cookie Policy.

• Essential cookies: session authentication (clikta_session). Required for the service to function. No consent needed.
• Preference cookies: remember your UI preferences. Require consent.
• Analytics: Plausible is cookieless. No consent needed.
• Marketing/advertising: we do not use advertising cookies.

We share data only with processors who provide appropriate guarantees under GDPR:

As a data subject in the EU/EEA, you have the following rights:

• Right of access (Art. 15): request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure / 'right to be forgotten' (Art. 17): delete your account and all associated data.
• Right to restriction of processing (Art. 18): limit how we use your data.
• Right to data portability (Art. 20): receive your data in a machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: at any time for any processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days as required by GDPR.

You also have the right to lodge a complaint with the Portuguese data protection authority: CNPD (Comissão Nacional de Proteção de Dados) at cnpd.pt.

Clikta is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with their data, please contact us at [email protected] and we will delete it promptly.

We implement appropriate technical and organisational measures to protect your personal data, including: TLS 1.2+ encryption in transit, AES-256 encryption at rest, access controls and audit logs, regular security reviews, and bcrypt hashing for all passwords.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Art. 33, and will notify affected users where required under Art. 34.

We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address associated with your account) and by updating the "Last updated" date above. Continued use of Clikta after such notice constitutes acceptance of the updated policy.

For privacy questions: [email protected]

Business customers who require a Data Processing Agreement (DPA) may download and request our standard DPA at /dpa.