Privacy Policy.

Policy text version: 9 October 2026. This policy explains our practices from publication; it is a notice, not a request for blanket consent. Where consent is needed, we ask separately.

Privacy at a glance

• If you run a business account, we use your account, billing and configuration information to operate Clientavo.
• If you use a business’s chatbot, that business receives the conversation and the contact or appointment details you choose to provide. It decides how to handle your service enquiry.
• Relevant conversation content and approved business information are processed by an AI provider to produce answers.
• A callback request is not consent to unrelated marketing. A confirmed appointment is also recorded in the business’s Clientavo calendar and may trigger service notifications.
• For privacy questions, contact support@clientavo.com. For a conversation with another business, identify that business so we can route the request correctly.

1. Controller and privacy contact

Clientavo is operated by PAGE RULES Ltd., based in Plovdiv, Bulgaria. For privacy questions and requests, contact support@clientavo.com.

2. Scope and roles

We determine how website, account, billing, support and platform security information is processed. For personal data collected through a customer's assistant to fulfil that business's purposes, the business normally acts as controller and Clientavo processes it under the DPA. Visitors should contact that business about their service requests and data rights; we assist it as required.

3. Information and sources

We receive account names, email addresses, phone numbers, company websites and settings from account users; approved company information from submitted websites and uploads; payment and subscription status, invoice details and limited payment-method information from our payment provider; and messages from people contacting support. We do not store full payment-card numbers.

Assistants process visitor messages, supplied contact details, service addresses, ZIP codes, service photos where enabled, preferred appointment times, consent and request status. The business’s Clientavo calendar records appointment times and the blocked time and notes its team adds. Technical records can include IP-related security signals, browser/session identifiers, timestamps, errors, usage and delivery events. Optional website measurement records visits and conversion events only following the applicable consent choice.

What happens when you use a customer’s assistant

The business can review its conversations, requests and appointment records in its dashboard. You may ask a question without providing a phone number. If you request a callback or appointment, we collect the details needed for that request and record the relevant confirmation. Avoid submitting passwords, payment-card details, identity documents, health information or unrelated third-party information. Service photos, where enabled, should show the service issue rather than people or private documents.

Businesses may upload documents or ask us to import website content for their assistant’s knowledge. Submitted information can contain personal data even when obtained from a public page. Businesses should provide only information they are authorized to use. A later deletion from the original website does not automatically remove a stored import; contact the business or us to address a stored copy.

4. Purposes and legal grounds

We use information to provide and administer the service, communicate about the account, collect payment, answer support requests and handle exports or deletion. Contract necessity applies where we contract with the individual; for staff representing a business, our legitimate interests include managing that business relationship. Security, abuse prevention, service troubleshooting and proportionate records for legal claims rely on legitimate interests balanced against individuals' rights. Accounting and legally required disclosures rely on legal obligations. Optional website measurement relies on consent, which can be withdrawn. We do not use a callback consent as permission for unrelated marketing.

Required registration or billing information is necessary to provide the relevant service. Without it, we may be unable to open an account or activate a subscription. A visitor may choose not to supply contact details, but the business may then be unable to return a call or arrange a visit. AI generates replies and helps route requests; Clientavo is not intended to make solely automated decisions producing legal or similarly significant effects.

5. Recipients and providers

Relevant information is shared with the customer's authorized users and the providers named in the provider table, for hosting, storage, authentication, AI, transactional email and abuse prevention. Payment information goes to Stripe. If a business user subscribes to a private phone calendar link, the calendar service that user chooses receives the names, phone numbers, service addresses and times of that business’s appointments from 30 days back to 180 days ahead. These providers may also have their own legally required or independently determined processing, as described in their policies. We may disclose information to professional advisers or authorities where necessary and lawful, or during a business transfer subject to appropriate safeguards. We do not sell personal data or share it for cross-context behavioural advertising. Access by personnel is limited to authorized service, support, security or legal purposes.

AI processing

Clientavo currently uses the OpenAI API to generate assistant responses. Requests can include your message, relevant conversation history, selected approved business information and the scheduling or contact context needed to answer. Personal data you include in those messages may therefore reach the provider. AI can produce inaccurate information; contact the business to correct a service answer or request human follow-up.

Generating an answer from company knowledge is different from training a general-purpose AI model. OpenAI states that API data is not used for model training by default unless the API customer opts in. Its provider-side retention and abuse-monitoring rules are separate from Clientavo’s retention schedule; this policy does not promise zero retention by OpenAI. See OpenAI’s API data controls. Section 6 describes the calendar and its phone calendar links.

Providers by purpose

• Render: application hosting and background processing.
• Supabase: database, authentication and configured private storage.
• OpenAI: AI response generation.
• Resend: transactional email and delivery events.
• Cloudflare Turnstile: anti-abuse challenge and verification data. See the Cloudflare Turnstile Privacy Addendum.
• Stripe: payments, invoices and subscription processing.
• Google: sign-in with Google and our business email service.

Payment receipts, account-security messages and requested service notifications are operational communications. Requesting service does not subscribe a visitor to a marketing list. A business’s separate follow-up communications are governed by its own notice and obligations.

6. Clientavo Custom Calendar and phone calendar links

Appointments booked through the assistant or added by the business, and time the business blocks, are kept in Clientavo Custom Calendar, the calendar built into Clientavo. The business’s authorized users see them in the Client Dashboard. Notes on blocked time are written by the business’s team.

An authorized user can create a private phone calendar link. A calendar app or service that subscribes to the link receives that business’s appointments from 30 days back to 180 days ahead, including customer names, phone numbers, service addresses and times, and updates them when it refreshes the link. The user chooses that service, and its own privacy terms apply. The link is a secret: anyone who has it can read these details. A user can turn the link off or create a new one in the Client Dashboard, and the link stops working when the user’s access to the business ends.

7. International processing

Some providers may process data in the United States or other countries. Transfers subject to European transfer restrictions require an applicable adequacy decision or valid safeguards such as Standard Contractual Clauses and any necessary supplementary measures. Contact us for the mechanism, recipient and safeguards applicable to your data, and a copy subject to lawful redactions. The provider and transfer arrangements must be verified before production processing begins.

8. Retention and deletion

We keep account and company configuration while needed to provide the account and any agreed continued access. Cancellation of renewal does not automatically delete retained business records. You can request export or deletion in the account privacy settings or through support. Billing and accounting records are retained for applicable statutory periods. Support correspondence is retained while needed to resolve the request and handle related disputes, then deleted or minimized. A legal hold or unresolved transaction may require restricted retention.

The service's scheduled retention rules target conversation text, summaries, collected chat fields and service photos for removal after 180 days from the later of last activity or closure, subject to legal holds. Eligible inactive conversation records are removed after 365 days; necessary lead and appointment records may remain where the applicable retention conditions require them. These are scheduled cleanup thresholds, not a promise of deletion at an exact second. Security audit logs normally have a 365-day threshold; temporary tool execution records and completed notification payloads have a 30-day threshold. Public demo workspaces expire after seven days. Earlier verified deletion requests are handled separately. Limited backup copies follow backup rotation and are not used as an active archive.

9. Your rights and requests

Subject to applicable law, you can request access, correction, erasure, restriction, portability and information about recipients, object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. We may need proportionate verification of identity or authority. For requests governed by the GDPR, we respond without undue delay and normally within one month of receipt. Where legally permitted because of complexity or the number of requests, we may extend by up to two further months and explain the extension within the first month. Other applicable laws may set different deadlines. We explain any lawful refusal and available complaint rights. Requests are ordinarily free; any exception must be permitted by law. Contact support@clientavo.com. If your data belongs to a business's assistant, contact that business first; we will direct or assist the request appropriately.

You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority, including where you live or work. Where US state privacy laws apply, eligible residents may exercise applicable access, correction, deletion, portability, opt-out or appeal rights without unlawful discrimination; contact us using the same address. These rights depend on the applicable law and our role.

Do not send your password, authenticator code or full payment-card number with a privacy request. Tell us the account email or the business and approximate conversation date. An authorized representative may contact us; we may ask for evidence of authority and proportionate identity verification. Where applicable US law provides an appeal, reply to our decision asking for a privacy appeal and we will explain the review and complaint route.

10. Cookies, browser storage and measurement

Necessary cookies and browser storage support authentication, session continuity, security and preferences. They are distinct from optional website analytics. Optional measurement follows your consent setting; you can change that choice through the site's privacy controls. Declining measurement does not prevent the core service. Public demo workspace identification uses a necessary HttpOnly cookie. Technical data needed to protect the service may still be processed when optional analytics is declined.

11. Public demos and children

Use fictional data in public demos. A demo stores conversations and test records in a browser-scoped workspace and sends relevant text to the AI provider. Demo privacy controls allow export or deletion. Clientavo business accounts are not intended for children. Do not knowingly submit children's or sensitive personal information; contact us if it has been supplied so it can be addressed.

12. Security and external services

Our safeguards include protected network transport, authenticated access, company-scoped access checks and encrypted calendar credentials. No online system can guarantee absolute security. Contact support promptly if you suspect unauthorized access; do not include authentication secrets in the report. Connections and links to third-party services remain subject to their own privacy notices. Disconnecting an integration stops future authorized use through that connection but does not necessarily erase records already lawfully held by the other service.

13. Changes and contact

We will identify updated policy versions and notify account holders of material changes as appropriate. A new purpose requiring consent will not be justified merely by changing this policy. Questions and requests: support@clientavo.com.