How Clask collects, uses, and stores data

This Clask Privacy Policy explains our use of personal information made available to us when you log into and use our application, knowledge materials, support channels, websites, and other services we make available (the "Platform").

Welcome

We designed the Clask Platform with privacy in mind. Clask, Inc. and our related entities ("we," "us," "our," or "Clask") respect privacy rights. This Policy describes how we and the Platform collect, use, disclose, retain, and protect information. Capitalized terms used but not defined in this Policy are defined in our Terms of Service ("Terms").

Clask helps Whatnot sellers sync their buyer and order data, segment their audiences, run direct-message (DM) campaigns, automate inbox support replies, and push segments to advertising platforms such as Meta. Clask connects to a seller's Whatnot account as an authorized support team member: we issue you a dedicated Clask support email address, and you invite it to your Whatnot account with Support access from Whatnot's Settings → Team Members. We never ask for or store your Whatnot password. Once connected, Clask operates the Service on the seller's behalf through Whatnot's interfaces and APIs, using only the access that the Support role grants. You may end that access at any time by removing the Clask support member from your Whatnot team settings.

Please read this Policy before you use the Platform. By logging into and using the Platform, you acknowledge this Policy applies to you and accept our Terms of Service. If you do not agree to this Policy and the Terms, you must not access or use the Platform.

The Basics

At the outset, you should know that:

• We collect and process limited personal information about you, such as information in your user account, profile, campaign and automation settings, message templates, support requests, and your usage of the Platform.
• We collect and process business information you or your organization provide or generate through the Platform, including buyer and order data synced from your connected Whatnot account.
• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising through the Platform.
• If you connect a Whatnot account by inviting our support member, we process the session credentials from that connection only as needed to authenticate requests and operate the Service on your behalf.
• If you connect a Meta advertising account, we process information from that connection only as needed to build and sync the custom audiences you configure. Buyer contact information used for audience matching is hashed before it is sent to Meta.

Your Data and Ours

We act as the data controller for personal information we collect directly from you to create and administer your account, process billing, communicate with you, and secure and improve the Platform.

When you use the Service to sync, segment, and message your buyers, we act as a data processor on your behalf with respect to buyer and order data. In that capacity, we process that data according to your instructions and this Policy. A Data Processing Agreement (DPA) is available upon request.

Updates to This Policy

As the Platform changes, we may update this Policy. If we materially change how we use personal information, we will provide notice before the changes take effect, typically by email, Platform notice, or other means required by law. You are responsible for reviewing the Last Updated date periodically and staying aware of the current Policy.

Contact Us

You may contact us regarding the Platform or this Policy at support@clask.ai. For data protection inquiries specifically, you may also reach us at privacy@clask.ai.

Info We Collect and How We Use It

This table describes the information we collect, how we collect it, why we use it, and general retention periods. We may also deidentify and aggregate information, which we may use to improve the Platform, develop services, operate analytics, and support business reporting.

Information Storage and Security

We use commercially reasonable security technologies and procedures to help protect personal information from unauthorized access, use, or disclosure, including encryption of sensitive data in transit and at rest, role-based access controls, and monitoring. However, no system is completely secure, and you provide information at your own risk.

We receive, store, and process information in the United States. Where we use service providers, they may process information in other locations consistent with this Policy and applicable law. In the event of a confirmed breach affecting your personal information, we will notify affected users and, where required, the relevant supervisory authority without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach.

Our Disclosures of Information

This section describes the ways Clask discloses information.

• We do not sell, trade, rent, or share personal information for cross-context behavioral advertising through the Platform.
• We may disclose personal information with your consent or at your request.
• We rely on service providers to operate the Platform. These service providers may process information only to provide services to Clask, and are contractually obligated to protect it. They include cloud infrastructure providers (such as Amazon Web Services), database and authentication providers (such as Supabase), payment providers (such as Stripe), email and messaging providers, analytics providers, and professional advisors. A complete, up-to-date list of sub-processors is available upon request.
• If you enable a connected integration, such as Whatnot or Meta, information may be exchanged through that connection only as needed to provide the integration and related features you configure.
• If you use the Platform on behalf of an organization, information in your account may be visible to that organization and its authorized users according to account settings and permissions.
• We may disclose information where required or appropriate for legal, tax, regulatory, accounting, security, anti-fraud, or rights-protection purposes, including in response to lawful requests by public authorities.
• In connection with a reorganization, merger, financing, acquisition, sale of assets, or similar transaction involving Clask, we may transfer personal information to the buyer, surviving entity, or assignee.

How Long We Keep Your Information

We maintain information for the time necessary to fulfill the purpose for which it was collected, as generally described in this Policy. Longer retention may be required for legal, tax, accounting, regulatory, security, contract, or dispute purposes. Our retention determinations consider the amount, nature, and sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; and whether we can achieve the purpose for which it was collected without continuing to use the information.

Connected Whatnot session credentials are deleted upon disconnection of the linked account or termination of your Clask account. Upon request, we will securely delete or anonymize your personal data within thirty (30) days, subject to any legal obligations to retain it.

No Children

Only adults are eligible to use the Platform, as described in our Terms. We do not knowingly collect personal information about anyone under the age of 18. If we learn that we collected personal information from a child, we will promptly delete it.

How to Control Your Privacy

You have certain choices regarding how we treat personal information.

• You may review and request changes to account information by using Platform settings or contacting us.
• You may opt out of promotional marketing communications by using unsubscribe instructions or contacting us. We may still send non-promotional communications, such as messages about your account, security, billing, legal notices, or ongoing business.
• If you have rights under local privacy laws, follow the instructions below to exercise them.

International Data Transfers

We receive and process information in the United States. By providing information to us, you acknowledge that we may process it in the United States and other locations where we or our service providers operate. If we transfer personal data subject to the GDPR, UK GDPR, or similar law outside the originating jurisdiction, we use appropriate transfer mechanisms where required, including Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, as applicable. Copies of these safeguards are available upon request.

Requesting Information

To exercise any rights described in this Policy, contact us through the contact information made available in the Platform or at privacy@clask.ai. Your request should provide enough information to identify you and the law that applies to you, such as your name, email address, mailing address, or other information we maintain.

Do not include social security numbers, driver's license numbers, third-party account numbers, credit or debit card numbers, health information, or other sensitive information in a privacy request unless we specifically ask for it.

We verify requests by confirming the source of the request and matching submitted information to information we maintain. If your request is unclear or we cannot verify your identity, we may ask for more information or deny the request in whole or in part. We will respond as quickly as reasonably possible and in accordance with applicable law. We may be unable to provide or delete information where disclosure would create security risk, where retention is required or permitted by law, or where information is needed for legal, security, accounting, dispute, or contract purposes. Where applicable law provides an appeal right, you may appeal our decision by contacting us.

Information About Local Privacy Laws

The Platform operates from the United States, but this Policy applies worldwide. Your rights and choices depend in part on the law where you live. If a local privacy law applies to you, that law controls over contrary descriptions in this Policy.

Information for EU, UK, and Swiss Residents

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may have rights under applicable law regarding personal data. We process personal data when we have a legitimate interest, when processing is necessary to perform a contract, when processing is necessary to comply with law, or when you give consent. You may withdraw consent at any time where consent is the basis for processing.

Your rights may include access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You may also have the right to lodge a complaint with your local data protection authority. For UK residents, this is the Information Commissioner's Office (ICO).

Information for Users in Canada

Canadian users may have rights under applicable Canadian privacy laws, including rights to access, correct, and withdraw consent where applicable. You may exercise those rights by contacting us.

Information for Users in Certain U.S. States

If you are a resident of California, Colorado, Connecticut, Utah, Virginia, or another state with a similar privacy law, you may have additional rights that you or your authorized agent can exercise by contacting us. These rights may include the right to know, access, correct, delete, receive a copy of certain information, opt out of certain processing, appeal decisions, and not be discriminated against for exercising privacy rights.

We do not sell or share personal information as those terms are defined under California privacy law. We do not use or disclose sensitive personal information for purposes that would require a right to limit under California privacy law. We collect the categories of personal information described in this Policy for the business and commercial purposes described in this Policy. We disclose information to service providers and other recipients as described in Our Disclosures of Information, and we retain information as described in How Long We Keep Your Information.