Privacy Policy

Clocsy is built to help businesses find relevant buyers, prepare outreach, send messages through controlled infrastructure, manage replies, and follow up responsibly. This Privacy Policy explains what data we collect, how we use it, how we protect it, and how you can delete or control it.

1. Who We Are

Clocsy is operated by Nwudu Inc, a company incorporated in Maryland, United States, with branch operations through MustKnack Digital & Internet Services (Lagos, Nigeria) and Black Elite Marketing & Events (Sheikh Zayed Road, Dubai). In this policy, "Clocsy," "we," "us," and "our" refer to Nwudu Inc and its operating branches.

Clocsy is a business-to-business platform. We do not design the service for children, consumer spam, or bulk blasting. Our systems are built around relevance, sender controls, suppression, opt-out handling, and account-level accountability.

2. Information We Collect

2.1 Account and Identity Data

• Email address, display name, profile photo, and authentication metadata.
• Login and session data managed through our authentication provider.
• Workspace, project, subscription, trial, and account-status records.
• Support conversations, admin notes, and issue investigation records when you request help.

2.2 Seller Profile, Product Details, and Message Tone

To make the Sales Engine useful, you may provide business and selling information, including:

• Your company name, website, industry, location, target buyers, value proposition, sales materials, and product details.
• Your preferred message tone, sample emails, subject-line direction, CTA style, signature, and writing preferences.
• Sender settings, sending window, reply handling preferences, and suppression preferences.

We use this information to configure your Clocsy engine, generate drafts, personalize outreach, and apply your approved business facts. User tone can shape writing style, but it does not override factuality, opt-out, sender safety, suppression, or compliance controls.

2.3 Sales Engine and Buyer Data

The Sales Engine may process business contact and company data so it can source, enrich, verify, draft, queue, send, and follow up with relevant business prospects. This may include:

• Company names, websites, industries, countries, cities, and public business information.
• Business contact names, job roles, professional email addresses, phone numbers where available, LinkedIn/profile references where available, and source metadata.
• Lead allocation state, enrichment status, email verification result, suppression state, duplicate-recipient checks, outreach message state, follow-up schedule, replies, bounces, and opt-outs.
• Sales Engine ledger records used to prove whether a paid project has sourced, enriched, drafted, queued, sent, replaced, or blocked a lead for a specific sales date.

Clocsy is not a free-for-all contact scraping tool. We use buyer data to operate controlled B2B outreach, enforce suppression, avoid duplicate sending, replace unusable leads, and maintain records needed to run and audit the service.

2.4 Sender, Inbox, and Communication Data

If you connect or use sending infrastructure, we may process:

• Sender account identifiers, sender status, domain and deliverability health, OAuth/token metadata, and sending-window configuration.
• Email drafts, queued messages, sent messages, follow-ups, replies, bounces, unsubscribe events, and dispatch logs.
• Compliance footer and opt-out link metadata used to honor future suppression requests.

We use this data to send on your behalf only within the Platform rules, enforce unsubscribe and suppression controls, support your account, and troubleshoot delivery or reply issues.

2.5 Managed Infrastructure Data

For certain accounts, Clocsy may provision and manage account-specific infrastructure, including AWS EC2 instances, databases, queues, logs, and related services, at our cost or as part of your plan. We use this infrastructure to operate your Sales Engine, isolate workloads, run background jobs, process drafts, manage queues, and maintain operational reliability.

Infrastructure logs may include system events, queue events, request metadata, error messages, and job state. We do not use this access to sell your data or expose your confidential business information.

2.6 Payments, Subscriptions, and Trials

• Plan, subscription, trial, billing status, invoice, and payment metadata.
• Payment processor identifiers and transaction records.
• Wallet, payout, affiliate, or marketplace records where applicable.

We do not store full card numbers, bank account numbers, or sensitive payment credentials on our own servers.

2.7 Website, SDK, and Analytics Data

• Standard server logs such as IP address, browser type, device type, referrer, pages viewed, and access time.
• Cookie consent, authentication state, and application usage events.
• If you install the Clocsy SDK, events you choose to send to us, such as page URLs, campaign parameters, conversion events, or identifiers you explicitly pass.

The Clocsy SDK does not need to collect personal information, cookies, or fingerprints from your website visitors unless you explicitly pass that data through your implementation.

3. How We Use Information

• Operate the Sales Engine: source business leads, enrich and verify email data, create lead slots, generate drafts, queue sends, send emails, manage follow-ups, classify replies, and replace unusable leads.
• Protect sending quality: enforce suppression, unsubscribe, bounce, duplicate-recipient, sender-window, sender-health, compliance, and draft-quality controls.
• Personalize outputs: apply your seller profile, product details, message tone, approved facts, CTA preferences, and target buyer profile.
• Provide support: investigate account issues, stuck engine states, failed jobs, billing issues, data deletion requests, and product defects.
• Improve reliability: monitor logs, queues, infrastructure health, abuse patterns, failed jobs, and security events.
• Process payments and subscriptions: manage plans, trials, invoices, wallet records, payouts, and fraud prevention.
• Communicate with you: send transactional emails, account notices, support updates, legal notices, and optional marketing messages.

4. Legal Bases for Processing

Where laws such as GDPR or UK GDPR apply, we rely on the following legal bases:

• Contract performance: to provide the Platform, Sales Engine, account infrastructure, support, billing, and connected services.
• Legitimate interests: to operate a B2B sales platform, secure the service, prevent abuse, improve reliability, enforce suppression, and help customers reach relevant business buyers.
• Consent: where required for optional marketing, optional integrations, cookies, or other permission-based features.
• Legal obligation: where we must retain or disclose information to comply with law, tax, accounting, dispute, fraud, or security obligations.

Customers are responsible for ensuring they have a lawful basis for their own use of Clocsy, their target audience, their message content, and their jurisdiction-specific outreach obligations.

5. Third-Party Processors and Providers

We use service providers to operate Clocsy. These providers may process data only as needed to provide or support the service:

• Authentication: Google Firebase or equivalent identity providers.
• Cloud infrastructure: Amazon Web Services, including EC2, storage, queues, databases, and logs.
• AI processing: Third-party AI service providers for drafting, classification, support, analysis, and business intelligence.
• Data and enrichment providers: business data, company graph, email verification, and enrichment providers used to identify and verify relevant B2B contacts.
• Sending and inbox providers: email, DNS, sender infrastructure, and inbox-sync providers used to dispatch and receive messages.
• Payments: Flutterwave, PayPal, Stripe, or other payment processors used for subscriptions, wallet, and payout operations where enabled.
• Analytics and support: tools used for product analytics, support, error reporting, and operational monitoring.

We review providers based on security and operational need. Third-party providers have their own privacy and security terms. We do not authorize providers to sell your data on our behalf.

6. Data Sharing

We do not sell your personal information. We share information only in limited circumstances:

• With service providers: to operate the Platform and the Sales Engine.
• With your authorized integrations: when you connect sender, inbox, calendar, payment, or other services.
• With recipients: when the Sales Engine sends a message, the recipient receives the email content, sender details, and opt-out mechanism.
• With marketplace participants: where you choose to participate in marketplace, RFPQ, creator, affiliate, or campaign workflows.
• For legal and safety reasons: if required by law, court order, security investigation, abuse prevention, or to protect rights and safety.
• Business transfers: as part of a merger, acquisition, financing, restructuring, or sale of assets, with appropriate safeguards.

7. Anti-Spam, Suppression, and Outreach Controls

Clocsy does not tolerate spam. The Platform is designed for relevant B2B outreach, not consumer spam, deceptive marketing, illegal scraping, or high-volume blasting. We use controls such as:

• Business relevance checks and target-buyer configuration.
• Email verification and bad-lead replacement.
• Suppression lists, bounce handling, opt-out links, and unsubscribe enforcement.
• Duplicate-recipient and market-lock protections.
• Sender windows, sending limits, sender health monitoring, and follow-up controls.
• Draft quality, factuality, and compliance copy constraints.

If a recipient opts out, bounces, is suppressed, or is otherwise unsafe to contact, Clocsy blocks future sending to that contact and may replace the lead with a fresh qualified buyer where your plan allows.

8. AI Processing and Human Review

Clocsy uses AI to analyze business information, classify replies, draft first-touch emails, draft follow-ups, support users, and investigate engine states. AI outputs are generated from your approved inputs, public business data, recipient context, and operational state.

We may allow authorized Clocsy personnel to access account, support, message, and engine data when needed to operate the service, resolve support issues, investigate abuse, improve safety, debug failures, or comply with law. Internal access is limited by role and need.

We do not use your confidential business data to train public AI models without your permission. We may use aggregated, anonymized, or de-identified operational metrics to improve the service.

9. Data Retention

• Account data: retained while your account is active and deleted or anonymized after account deletion, subject to legal and operational retention needs.
• Sales Engine records: lead slots, dispatch logs, suppression records, replies, bounces, and audit logs are retained as needed to prove sending state, honor opt-outs, prevent duplicate outreach, support disputes, and maintain compliance controls.
• Suppression and opt-out records: retained as long as necessary to honor opt-out requests and prevent future unwanted contact.
• Payment and transaction records: retained as required for tax, accounting, fraud prevention, and legal compliance.
• Server and infrastructure logs: generally retained for a limited period for security, debugging, and reliability, unless needed longer for investigation or legal reasons.
• SDK analytics: raw event data may be retained for a limited period; aggregated analytics may be retained longer.

10. Account Deletion and Data Removal

You can request deletion of your account, projects, seller profile, message tone, connected sender records, and related profile data by contacting us or using available in-product controls. When an account is deleted, we disable active sending, stop future engine activity, remove or anonymize account data where practical, and retain only records required for legal, accounting, security, dispute, suppression, or compliance purposes.

If deletion would make it impossible to honor an opt-out or suppression request, we may retain a minimal hashed or limited suppression record so the contact is not emailed again.

11. Your Rights

Depending on your location, you may have the right to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account or request deletion of personal data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications.
• Opt out of sale or sharing where applicable. Clocsy does not sell personal information.
• Lodge a complaint with a data protection authority where applicable.

To exercise your rights, contact privacy@clocsy.com. We may need to verify your identity before completing a request.

12. Cookies and Tracking

Clocsy uses cookies and similar technologies for authentication, security, preferences, analytics, and product improvement. Where consent is required, we request it through our cookie notice. You can control cookies through your browser settings or available in-product controls.

We do not rely on hidden tracking to bypass user choice. If we introduce advertising pixels or session replay, we will disclose them and use consent controls where required.

13. Security Measures

We protect data through technical, organizational, and operational safeguards, including:

• HTTPS encryption for data in transit.
• Encrypted storage and managed cloud infrastructure where supported.
• Role-based internal access and least-privilege operations.
• Secure authentication and token handling.
• Webhook signature verification and provider security controls.
• Queue, job, and infrastructure monitoring.
• Suppression, unsubscribe, bounce, and sender-safety controls.
• Operational logging for security, debugging, and incident response.

No internet service can guarantee absolute security, but we work to protect customer and buyer data with practical controls and fast incident response.

14. Data Breach Response

If we discover a personal data breach, we will investigate, contain, remediate, and document the incident. Where a breach creates a legal notification obligation or a high risk to affected individuals or businesses, we will notify affected parties and regulators as required by applicable law.

Our notification may include the nature of the incident, categories of data affected, likely consequences, steps taken, recommended protective actions, and a contact point for questions.

15. International Transfers

Your information may be processed in the United States, Nigeria, the United Arab Emirates, or other countries where we or our service providers operate. Where required, we use appropriate safeguards for international transfers, such as contractual protections and provider security commitments.

16. Children's Privacy

Clocsy is a B2B platform and is not intended for people under 18. We do not knowingly collect personal data from children. If we learn that a child has provided personal data, we will delete it promptly.

17. Changes to This Policy

We may update this Privacy Policy as the product, law, or our vendors change. Material changes will be communicated through the Platform, email, or another appropriate notice. Continued use of Clocsy after the effective date means you accept the updated policy.

18. Contact Us

• Privacy: privacy@clocsy.com
• Legal: legal@clocsy.com
• Security: security@clocsy.com
• Entity: Nwudu Inc, Maryland, United States