Privacy Policy

Clivly is a customer relationship manager that connects to an application you already run. It reads your application's database schema so your own records — customers, companies, deals — appear in a CRM your team works in, and it writes CRM records back to your own database. You stay the custodian of your business data; Clivly stores what it needs to present and sync it.

Account information. Your name, email address and password hash, the organisations you belong to and your role in them. If you sign in with a third-party provider we receive your name and email address from them.

Your CRM data. The contacts, companies, deals, notes, tasks, conversations and emails you or your connected application create. This is your data; we process it to provide the product.

Connected application data. When you install the Clivly SDK we receive the table and column names it reports, so the CRM can map your schema, plus the records you choose to sync. We never connect to your database directly.

Technical information. Logs needed to run and secure the service — timestamps, IP address, user agent, error traces. We keep these for a limited period for debugging, abuse investigation and security.

Billing information. Handled by Stripe. We store your plan, subscription status and usage counts. We never see or store your card number.

Clivly lets you connect your own business email account — Google Workspace or Gmail, or Microsoft 365 or Outlook — so that email you send to a contact from Clivly is sent by your own mail provider, from your own address, and is saved in your own Sent folder.

What we access. When you connect a Google account, Clivly requests a single permission, https://www.googleapis.com/auth/gmail.send, which allows Clivly to send a message on your behalf. For Microsoft accounts Clivly requests Mail.Send. These permissions allow sending only. Clivly cannot read your mailbox, cannot list or search your messages, cannot access your drafts, contacts or calendar, and cannot delete anything. We also receive your email address and display name so the app can show you which account is connected.

What we store. Your email address, your display name, and the authorisation tokens needed to send on your behalf. Tokens are encrypted at rest with a unique key per record, itself encrypted with a key held outside the database. They are never displayed in the application, never written to logs, and never shared with anyone else. We also store the emails you send from Clivly — recipient, subject, body and send status — because they form that contact's history in your CRM, which is the purpose of the product.

What we do not do. We do not read your mailbox. We do not use Google user data to develop, improve or train generalised models, including machine-learning or artificial-intelligence models. We do not sell, rent or transfer Google user data for advertising, profiling or any similar purpose. No person at Clivly reads your Google user data, except where you have specifically asked us to investigate a problem, where it is necessary to investigate abuse or a security incident, or where the law requires it.

Limited Use. Clivly's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect a mailbox at any time in Settings. Disconnecting revokes Clivly's access with your provider and deletes the stored tokens. You can also revoke access directly at myaccount.google.com/permissions for Google, or in your Microsoft account settings. Emails already sent stay in your CRM history, because they are a record of your own correspondence; email support@clivly.com if you want them deleted.

A workspace can receive email in Clivly in two ways: replies to email sent from Clivly, which come back to a reply address Clivly gives each conversation, and mail sent to one of the workspace's shared addresses (for example support@) that the workspace's own mail provider has forwarded to Clivly. Each of these is a private Clivly address, and anyone who has that address can send to it directly; such mail is treated exactly like forwarded mail. Clivly never connects to or reads anyone's mailbox to collect it.

What we process. The whole message as delivered: its sender and recipients, subject, body, attachments and technical headers, including the authentication results that say whether the sender's domain really sent it. Messages arrive through Cloudflare's email routing, and are stored in our database and, as the original message file, in private object storage. Within Clivly, members of the workspace can read its conversations, and only admins can see mail held for review. Our staff access messages only to run and support the service. When an admin tests forwarding from the setup page, the test message is recognised and discarded rather than stored, and when Gmail sends a confirmation code for a new forward, we keep that message's subject, code and link so the admin can finish the setup.

How we use it. To file each message on the right conversation and contact, and to notify the members responsible for it. When a message comes from someone new and its authentication checks pass, Clivly adds them as a contact; when the checks fail, the message waits for an admin to review it and nobody is added. We do not use this mail for advertising or to train generalised AI models.

Stopping and deleting. Remove the forward at your mail provider, or delete the shared address in Clivly, and no further forwarded mail arrives; replies to email already sent from Clivly can still arrive. Messages already received stay in the workspace's history; an admin can discard a held message, and you can email support@clivly.com to have received mail deleted.

To provide the product: to show your CRM, sync records with your connected application, send the email you ask us to send, and deliver notifications you have turned on. To bill you and meter usage against your plan. To keep the service secure and working — diagnosing faults, investigating abuse, preventing fraud. To contact you about your account, security and material changes to the service.

We do not sell your personal information, and we do not use your CRM data or your email content to train generalised AI models. Where Clivly offers AI features you switch on yourself, the relevant content is sent to the model provider only to answer that request.

Only the service providers needed to run Clivly, each handling data on our instructions: Neon (database hosting), Cloudflare (application hosting, content delivery, inbound email routing and file storage), Resend (email delivery), Stripe (payments), and Sentry (error monitoring). Where you enable an AI feature, the model provider for that feature.

We also disclose information if the law requires it, to protect our rights or someone's safety, or to a successor in a merger or acquisition — in which case this policy continues to apply, and for Google user data we will obtain your explicit prior consent.

Clivly runs on infrastructure in the United States and Europe, and our providers may process data in other countries. We keep your data for as long as your account is open. When you close your account we delete your organisation's data, including connected-mailbox tokens, within 30 days, except where we must keep records longer to meet a legal or accounting obligation. Logs and backups age out on their own schedule.

Data is encrypted in transit and at rest. Credentials and authorisation tokens are additionally encrypted at the record level. Access to production systems is limited to the people who need it. Every change to CRM records is written to an audit log you can read. No system is perfectly secure, but we take reasonable and appropriate steps to protect your data against unauthorised access, loss and disclosure.

You can view and correct your account details in the app, export or delete your CRM records, disconnect a mailbox or a connected application at any time, and turn optional notification emails off — every one carries an unsubscribe link. Depending on where you live you may also have the right to access, correct, delete or port your personal data, or to object to how we process it. Email support@clivly.com and we will respond.

If you use Clivly as part of a team, your organisation's owner administers that workspace and can see the records and activity in it.

Clivly is a business tool and is not intended for anyone under 16. We do not knowingly collect their personal information.

If we change how we handle your information we will update this page and its date. If a change is material — in particular if we ever want to access a type of data this policy does not already describe — we will tell you and, where consent is required, ask for it before the change takes effect.

Clivly — support@clivly.com.