Legal
GDPR
For people in the EU and the EEA: the roles, the legal bases, your rights, and where data goes.
Last updated 2 min read
Scope and roles
This page supplements the privacy policy for people in the European Union and the European Economic Area.
For your account and for the platform's own records, Cliux is the controller. For the content of a site you publish, and for what your visitors send that site (form submissions, orders, bookings, comments, chat), you are the controller and Cliux is your processor: we store and serve it on your instructions and do nothing else with it.
Legal bases
- Performance of a contract: providing the Service you signed up for.
- Legitimate interests: keeping the service secure, preventing abuse and fraud, and improving the product from how it is used in aggregate.
- Legal obligation: tax and accounting records, and lawful requests from authorities.
- Consent: where a site owner adds a third-party tracker to their published site, the visitor's consent to it is asked for before it loads.
Cliux sends no marketing email, so no consent is asked for one.
Your rights
- Access: a copy of the personal data we hold about you.
- Rectification: correction of what is wrong.
- Erasure: deletion, subject to what we must keep for tax and accounting.
- Restriction and objection: to stop or narrow processing that rests on legitimate interests.
- Portability: your account data in a machine-readable form.
- Withdrawal of consent, without affecting what was lawful before.
- A complaint to your supervisory authority.
Use the contact form for any of these and we answer within a month. If you are a visitor of a site built with Cliux, the site's owner is the controller of what you gave that site; write to them first, and to us if they do not answer.
Where data goes
| Provider | What it does for you | What reaches it |
|---|---|---|
| Clerk | Sign-in and account security for the console | Your name, email address and sign-in events |
| Stripe | Payments: your plan, and what your visitors pay you through your own Stripe account | Billing details and card numbers, which never reach Cliux |
| Uploadthing | Storage for the images and files you upload | The files themselves |
| Resend | Transactional email: sign-in codes, order and booking mail, notifications you switch on | The recipient address and the message |
| Hostinger | The server the platform and your published sites run on | Everything the platform stores |
| Backblaze B2 | Off-site copies of the nightly database backup, and a weekly mirror of the uploaded files | The whole database, encrypted before it leaves the server, and copies of your files |
| Sentry | Error reports from the platform | Stack traces, which can carry the page address and your account id |
Some of these providers process data in the United States and in other countries outside the EU/EEA. We rely on the transfer terms in each provider's own data processing agreement. Cliux has not signed its own Standard Contractual Clauses with them, because Cliux is not yet an incorporated company able to sign one.
Who is responsible
Cliux has not appointed a Data Protection Officer and, at this size, is not required to. The person responsible is the operator named in the privacy policy, reached through the contact form.