How We Collect, Use and Protect Your Data

1. Who We Are

ClexTech is based at Prashant Layout, Swami Vivekanand Road, in front of NVT Okais, Whitefield, Bengaluru, Karnataka 560066, India. For personal data about our own visitors, users and account holders, ClexTech is the data fiduciary (controller).

When a business uses ThreadLine to manage conversations with its own customers, that business decides what data is uploaded and how it is used. In that case the business is the data fiduciary (controller) and ClexTech processes the data on its behalf as a data processor.

2. Information We Collect

Account information

Your name, email address, phone number, company name, password (stored only in hashed form) and account settings.

Billing information

Your plan, billing cycle, invoices and GST details. Payments are processed by Razorpay. We do not store your full card, UPI or bank account details.

Customer content

Content you or your team add to or receive through ThreadLine, such as emails, messages, attachments, contacts and leads, conversation history, notes, templates, prompts and labels.

Connected account data

When you connect an email or messaging account (for example Gmail, Microsoft Outlook, WhatsApp, Telegram, Facebook or Instagram), we receive the data needed to send and receive messages on your behalf, along with authorisation tokens for that account. See Section 4 for Google user data.

Usage and device data

IP address, browser type, device information, pages visited, timestamps, error logs and similar diagnostic data collected automatically when you use the Services.

Cookies

We use essential cookies to keep you signed in and secure your session, and functional cookies to remember your preferences. You can block cookies in your browser, but parts of the Services may then stop working.

3. How We Use Information

• To provide, operate and maintain the Services, including sending, receiving, organising and displaying your messages.
• To create and manage your account and process payments and subscriptions.
• To provide the AI features you choose to use, such as drafting emails and suggesting replies.
• To provide customer support and respond to your requests.
• To send service messages such as security alerts, billing notices and product updates.
• To send marketing emails, only where permitted by law. You can unsubscribe at any time.
• To keep the Services secure, prevent fraud and abuse, and fix problems.
• To comply with legal obligations and enforce our terms.

We do not sell personal data, and we do not use customer content or connected account data for advertising.

4. Google User Data

When you connect a Google account to ThreadLine, we ask for your permission through Google's OAuth consent screen. With that permission ThreadLine may access:

• Basic profile information (name, email address and profile picture), to identify your account and sign you in.
• Gmail messages and metadata, through the https://mail.google.com/ scope. We use it to read incoming emails into your ThreadLine inbox, send the emails and replies you or your team write from ThreadLine, and keep your conversation threads in sync.

How we use it. We use Google user data only to provide and improve the user-facing features of ThreadLine that you have chosen to use. We send AI providers Gmail content only when you use an AI feature on that content, only to produce that result for you, and under terms that do not let the provider train its models on it.

Sharing. We do not sell Google user data, and we do not transfer it to third parties except as needed to provide or improve the features you use, to comply with the law, or as part of a merger or acquisition with your notice.

Human access. People at ClexTech do not read your Google user data unless you give us permission for a specific message (for example to resolve a support request), it is needed for security purposes such as investigating abuse, or the law requires it.

No advertising or model training. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalised or non-personalised AI/ML models.

Storage and deletion. Tokens and imported messages are stored encrypted on our servers. You can disconnect your Google account at any time from ThreadLine inbox settings or at myaccount.google.com/permissions. When you delete the inbox or your account, we delete the related Google user data as described in Section 7.

ThreadLine's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. AI Features

ThreadLine offers optional AI features such as email drafting and reply suggestions. When you use them, the relevant content (for example the conversation, contact details and your prompt) is sent to our AI providers (OpenAI, Anthropic and/or Google Gemini) through their business APIs to produce the result. These providers process the data on our behalf and, under their API terms, do not use it to train their models. AI output can be inaccurate, so review it before sending.

6. How We Share Information

We share personal data only in the following cases:

• Service providers that help us run the Services: cloud hosting and storage, Razorpay (payments), AI providers (OpenAI, Anthropic, Google), email delivery, and error monitoring. They may use the data only to provide services to us.
• Platforms you connect, such as Google, Microsoft, Meta (WhatsApp, Facebook, Instagram) and Telegram, so that we can send and receive messages for you. Their own privacy policies govern their use of that data.
• Your organisation: admins and teammates in your ThreadLine account can see the conversations and contacts shared within that account.
• Legal reasons: to comply with law, a court order or a valid government request, or to protect the rights, safety or property of ClexTech, our users or others.
• Business transfers: as part of a merger, acquisition or sale of assets. We will notify you before your data becomes subject to a different privacy policy.
• With your consent, for any other purpose.

7. Data Retention and Deletion

• Account and customer content is kept while your account is active. If you close your account, we delete it within 30 days, apart from what we must keep by law.
• Connected account data, including Google user data, is deleted within 30 days after you disconnect the inbox or delete your account. The authorisation tokens are revoked immediately.
• Billing records are kept for as long as Indian tax and accounting laws require (generally 8 years).
• Logs and usage data are kept for up to 12 months for security and troubleshooting.
• Backups are encrypted and deleted on a rolling basis within 30 days.

8. Security

We use industry-standard measures to protect personal data. These include TLS encryption in transit, encryption of stored credentials and OAuth tokens, role-based access controls, optional multi-factor authentication, and restricted staff access. No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

9. Where Data Is Processed

Our primary servers are located in India. Some of our service providers, such as the AI providers, may process data in other countries. When that happens, we rely on contractual safeguards and transfer data only as permitted by applicable law.

10. Your Rights

Under the Digital Personal Data Protection Act, 2023 and other applicable laws, you may have the right to:

• access a summary of the personal data we hold about you;
• correct or update inaccurate data;
• request that we delete your data;
• withdraw consent you have given (this does not affect processing that took place before);
• nominate another person to exercise your rights if you die or become incapacitated; and
• raise a grievance with us, and escalate it to the Data Protection Board of India.

Most account data can be updated or deleted in ThreadLine settings. For anything else, email contact@clextech.com. We respond within 30 days. If your data was uploaded by a business that uses ThreadLine, please contact that business first; we will help it respond to your request.

11. Children

The Services are meant for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. If we make a material change, we will tell you by email or through a notice in the Services before it takes effect, and we will update the "Last updated" date above.

13. Contact and Grievance Officer

For questions, requests or complaints about this policy or your personal data, contact our Grievance Officer:

ClexTech
Prashant Layout, Swami Vivekanand Road, in front of NVT Okais
Whitefield, Bengaluru, Karnataka 560066, India
Email: contact@clextech.com
Phone: +91 74895 93340

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.