Privacy Policy

Clickk Inc. is a Delaware corporation operating an interactive video engagement platform that synchronizes polls, quizzes, lead capture forms, and interactive elements with long-form video and audio content. Clickk acts as data controller for information collected directly through the Platform. When Creators deploy Clickk tools to collect Viewer data, the Creator acts as an independent data controller while Clickk functions as both data processor and co-owner of interaction data (Section 5).

Contact: legal@clickk.com

2.1 Information You Provide — Creators

Creator account registration collects: name, contact information (email, phone), business name, website URL, account credentials (encrypted password), billing/payment information (processed by Stripe), profile information, account preferences, created content (polls, quizzes, images, gallery media, lead form configurations), and communications sent to Clickk.

2.2 Information Collected from Viewers

Viewer engagement data includes: identity information from SSO authentication (name, email, profile picture from identity providers like Google or LinkedIn), interaction data (poll responses, quiz answers, gallery engagement, form submissions), timestamp and session data, device and browser information, IP address, and general geographic location. Identity data is collected only upon active SSO authentication with clear consent notice and opt-in checkbox.

2.3 Information Collected from Website Visitors

Visitor data collected from clickk.com includes: pages visited, time on site, referral source, browser type, device type, operating system, IP address, and cookie/tracking data (Section 7).

2.4 Automatically Collected Platform Data

Automatic collection includes: log data (access times, features used, error reports, activity), performance and analytics data (engagement rates, viewer conversion, lead capture activity), and integration activity with connected third-party platforms (YouTube, Vimeo, Twitch, SoundCloud, others).

3.1 To Provide and Operate the Service

Uses include: creating and managing Creator accounts, processing subscriptions and payments via Stripe, enabling synchronization of interactive elements with supported video platforms, authenticating Viewer identities via SSO, facilitating lead capture, delivering analytics and engagement reporting to Creators, and providing customer support.

3.2 To Improve and Develop the Platform

Uses include: analyzing usage patterns and interaction data to improve features, developing new functionality including AI-powered suggestions and engagement optimization tools, conducting internal research, benchmarking and performance analysis, and training machine learning models.

3.3 For Commercial and Business Purposes

Uses include: utilizing aggregated and identifiable interaction data co-owned by Clickk for commercial analytics, product positioning, and business development, communicating with Creators about product updates, new features, pricing changes, and promotional offers, and enforcing Terms of Service and policies.

3.4 To Comply with Legal Obligations

Uses include: responding to lawful requests from government authorities or law enforcement, complying with privacy laws (GDPR, CCPA, CAN-SPAM, COPPA), and investigating/preventing fraud, abuse, and security incidents.

Clickk commits to full GDPR (EU 2016/679) and UK GDPR compliance. For EEA, UK, Switzerland, or equivalent jurisdiction users, processing occurs under Article 6 GDPR lawful bases:

• Article 6(1)(b) — Contract performance: Processing necessary for account creation, subscription management, payment processing, and core Platform functionality.
• Article 6(1)(f) — Legitimate interests: Processing for platform security, fraud prevention, product analytics, and business development where assessed interests aren't overridden by fundamental rights. Clickk maintains a Legitimate Interests Assessment (LIA) available to EEA/UK users upon request.
• Article 6(1)(a) — Consent: Processing based on freely given, specific, informed, unambiguous consent including Viewer SSO authentication, opt-in lead capture, and marketing communications. Consent may be withdrawn anytime without affecting prior processing lawfulness.
• Article 6(1)(c) — Legal obligation: Processing required by EU, UK, or Member State law including financial record-keeping, fraud reporting, and lawful authority responses.

Special category data (Article 9 GDPR) incidentally collected through Viewer interactions relies on explicit consent under Article 9(2)(a) with additional protective measures.

Controller and Processor Roles: Clickk acts as sole data controller for Creator account data. For Viewer data collected through Creator-deployed interactive elements, Clickk and Creator act as independent joint controllers under Article 26 GDPR. Creators collecting EEA/UK Viewer data must execute a DPA with Clickk (Section 17).

5.1 How Viewer Data Is Collected

When Viewers encounter Clickk-powered interactive elements in Creator video content, they may authenticate via SSO before interaction recording. Viewers receive a clear consent notice and must actively check an opt-in box acknowledging: identity information (name and email) sharing with Creator, Creator contact permission, interaction data collection and retention by both Creator and Clickk, and data subjection to both Clickk's and Creator's privacy policies. Clickk does not allow pre-checked consent boxes.

5.2 Data Ownership & Co-Ownership

Interaction and lead data generated through Clickk-powered elements is co-owned by Clickk Inc. and the generating Creator. This means:

• Clickk retains perpetual, irrevocable rights to use, store, analyze, and derive insights from all interaction and lead data for platform analytics, product development, machine learning, benchmarking, and commercial purposes in identifiable or aggregated form.
• Creators receive full rights to use captured lead data for business and marketing purposes.
• Creators bear sole responsibility for ensuring their lead data use complies with privacy laws and representations made to Viewers at consent point.

5.3 Viewer Rights Regarding Lead Data

Viewers who authenticated via SSO and wish to request deletion or correction may contact legal@clickk.com. Clickk processes requests per applicable law and notifies relevant Creators of deletion requests where required. Note: Clickk cannot compel Creators to delete data held independently in their systems. Viewers should contact Creators directly for such requests.

6.1 With Creators

Clickk shares Viewer interaction data and authenticated lead information with the Creator whose content generated the interaction — the Platform's core function, disclosed to Viewers at consent point.

6.2 With Service Providers

Clickk works with trusted third-party service providers assisting Platform operation. Providers access personal data only as necessary and are contractually required to protect it. Key providers include:

• Stripe — payment processing, subscription billing
• Google Analytics — website and platform usage analytics
• Cloud infrastructure providers — hosting, storage, security
• Email delivery providers — transactional and product communications

6.3 With Identity Providers (SSO)

When Viewers authenticate via SSO, Clickk receives identity information from connected identity providers (Google, LinkedIn, etc.) as authorized during authentication. The identity provider's privacy policy governs their data practices.

6.4 For Legal Compliance & Safety

Clickk may disclose personal information to law enforcement, government authorities, or other third parties when required by law, subpoena, or court order, or when reasonably believing disclosure is necessary to protect any person's safety, prevent fraud, or protect Clickk's legal rights.

6.5 Business Transfers

Upon merger, acquisition, asset sale, or similar corporate transaction, Clickk may transfer personal data to the successor entity. Users are notified via email or prominent Platform notice if such transfer materially affects this Privacy Policy.

6.6 What We Do Not Do

Clickk does not sell personal information to third-party data brokers or advertisers. Clickk doesn't share personal data with third parties for independent marketing purposes without consent.

7.1 What We Use

• Essential cookies: Required for Platform function including session management, authentication, and security.
• Analytics cookies: Used by Google Analytics to understand user interaction with website and Platform.
• Preference cookies: Remember settings and preferences across sessions.
• Marketing cookies: May measure marketing campaign effectiveness.

7.2 Your Choices

Users control cookies through browser settings. Disabling certain cookies may affect Platform functionality. Google Analytics data collection opt-out: tools.google.com/dlpage/gaoptout. For EEA/UK users, Clickk presents a cookie consent banner where required by law.

• Creator account data: Retained for active account duration plus up to 3 years following closure for legal and financial record-keeping compliance.
• Viewer interaction and lead data:Retained for associated Creator's active account duration, subject to Clickk's co-ownership rights (Section 5).
• Payment and billing records: Retained minimum 7 years per financial record-keeping requirements.
• Log and security data: Retained up to 12 months.
• Analytics data: May be retained indefinitely in aggregated, anonymized form.

Upon account deletion, Clickk deletes or anonymizes personal data within a reasonable period, except where retention is legally required or Clickk exercises co-ownership rights over interaction data in anonymized form.

Clickk implements reasonable technical and organizational measures protecting personal data against unauthorized access, disclosure, alteration, or destruction, including:

• Encrypted data transmission using HTTPS/TLS across all Platform connections
• Encryption of sensitive data at rest
• Access controls limiting data access to authorized personnel on need-to-know basis
• Regular security reviews and vulnerability assessments
• Secure infrastructure with industry-leading cloud providers

No internet transmission method is completely secure. Upon data breaches affecting rights and freedoms, Clickk notifies affected users and relevant authorities per applicable law.

The Clickk Platform is not intended for and does not knowingly collect personal information from individuals under 18. Creators may not use the Platform to deploy interactive content targeting minors or collect data from individuals under 18. If Clickk becomes aware personal information from persons under 18 has been collected without appropriate parental consent, steps are taken to promptly delete that information.

Suspected minor data collection should be reported immediately to legal@clickk.com.

11.1 Rights for All Users

Regardless of location, users have rights to: access personal information Clickk holds, request inaccurate/incomplete personal data correction, request personal data deletion (subject to Clickk's legal obligations and co-ownership rights in Section 5), and withdraw consent where processing is based on consent (not affecting pre-withdrawal processing lawfulness).

11.2 Additional Rights for California Residents (CCPA)

• Right to know what personal information Clickk collects, uses, discloses, and sells.
• Right to delete collected personal information (subject to exceptions).
• Right to opt out of personal information sales — Clickk does not sell to third-party data brokers.
• Right to non-discrimination for exercising CCPA rights.

California rights exercise: contact legal@clickk.com. Verified request responses within 45 days per law.

11.3 Additional Rights for EEA & UK Users (GDPR)

• Right of access (Article 15): Obtain confirmation of personal data processing and receive a copy with usage information.
• Right to rectification (Article 16): Request inaccurate/incomplete personal data correction without undue delay.
• Right to erasure (Article 17):Request personal data deletion where no longer necessary, consent withdrawn, or processing unlawful (subject to Clickk's legal obligations and co-ownership rights).
• Right to restriction of processing (Article 18): Request Clickk restrict data processing in certain circumstances.
• Right to data portability (Article 20): Receive personal data in structured, machine-readable format and transmit to another controller.
• Right to object (Article 21): Object anytime to legitimate interests processing including profiling. Clickk ceases processing unless demonstrating compelling legitimate grounds overriding your interests.
• Right not to be subject to solely automated decision-making (Article 22): Not subject to decisions based solely on automated processing producing legal or similarly significant effects.

Response timeframes: Clickk responds to EEA/UK rights requests within one calendar month. Extensions by further two months for complex requests with notice. No fee charged unless requests are manifestly unfounded or excessive.

Supervisory authority: Lodge complaints with local data protection authority. EEA contacts: edpb.europa.eu. UK users contact ICO: ico.org.uk.

11.4 How to Submit a Request

Contact legal@clickk.com with subject line "Privacy Rights Request" including sufficient identity verification information. Response within applicable legal timeframes at no charge for reasonable requests.

Clickk operates from the United States. Non-US Platform access results in data transfer to, storage, and processing in the United States, which may not provide equivalent data protection as home jurisdictions.

For EEA/UK users, Clickk ensures international transfer compliance with Chapter V GDPR/UK GDPR through:

• Standard Contractual Clauses (SCCs): European Commission-approved SCCs (Decision 2021/914/EU) for EEA transfers and UK International Data Transfer Agreement (IDTA) for UK transfers.
• Adequacy decisions: Reliance on European Commission or UK Secretary of State adequacy decisions where issued for destination countries.
• Supplementary measures: Post-Schrems II guidance-required appropriate technical and organizational measures alongside SCCs.

Applicable SCC or transfer mechanism documentation copies are available upon written request at legal@clickk.com.

For Latin American users including Brazil (LGPD) and other jurisdictions with transfer restrictions, Clickk makes reasonable compliance efforts with applicable cross-border transfer requirements.

Clickk Platform integrates with third-party video and audio platforms including YouTube, Vimeo, Twitch, SoundCloud, and others. These platforms may independently collect data per their own privacy policies. Clickk isn't responsible for third-party platform privacy practices.

The Platform may contain external website/service links. Clickk doesn't control external sites and isn't responsible for their privacy practices. Third-party site privacy policies should be reviewed.

Creators using Clickk to collect Viewer data bear independent responsibility for compliance with all applicable privacy laws governing their audience, including:

• Maintaining and publishing accurate privacy policies disclosing Clickk-powered element data collection.
• Ensuring lawful collection and use basis under GDPR, CCPA, or applicable law.
• Honoring Viewer requests to access, correct, or delete data held in Creator's systems.
• Complying with CAN-SPAM, CASL, or applicable laws governing commercial email to captured leads.
• Not using captured Viewer data violating applicable law or representations made at consent point.

Clickk provides data collection infrastructure; Creators determine usage. Clickk reserves rights to suspend or terminate Creator accounts using the Platform violating applicable privacy laws or harming Viewers.

Clickk may update this Privacy Policy. Material changes trigger:

• "Last Updated" date updates at document top.
• Email notification to registered Creator accounts.
• Prominent Platform notices for reasonable periods following changes.

Continued Service use after changes constitutes acceptance of updated Privacy Policy. Material change disagreement requires service cessation and account deletion requests.

Clickk Inc.

Privacy & Legal Inquiries: legal@clickk.com

Website: www.clickk.com

Under Article 26 GDPR, two or more jointly-determining controllers must enter Joint Controller Agreements setting respective responsibilities.

Clickk and Creators deploying Clickk-powered elements collecting EEA/UK Viewer data act as joint controllers for that data. Accordingly:

• Creators with EEA/UK audiences must execute Clickk's standard DPA before deploying interactive elements collecting Viewer personal data from those regions.
• The DPA sets out each party's GDPR compliance responsibilities including data subject rights handling, breach notification obligations, and data retention.
• Clickk's standard DPA is available upon request at legal@clickk.com.

For non-EEA/UK contexts, Clickk may offer standard Data Processing Addendum upon request assisting Creator compliance.

Clickk's current scale and processing activities don't trigger mandatory DPO appointment under Article 37(1) GDPR. However, Clickk has designated a Privacy Lead overseeing data protection compliance.

EEA/UK users may direct privacy-related inquiries, including GDPR rights requests and DPA inquiries, to:

Privacy Lead, Clickk Inc.
Email: legal@clickk.com

As Clickk scales, DPO requirement re-evaluation will occur with formal DPO appointment if/when required by applicable law.

Article 30 GDPR requires controllers and processors to maintain Records of Processing Activities (ROPA). Clickk maintains internal ROPA covering:

• Clickk's name and contact details as controller and, where applicable, joint controllers (Creators).
• Processing purposes for each data category.
• Data subject and personal data category descriptions.
• Recipient categories receiving personal data disclosures.
• International transfer details and relied-upon transfer mechanisms.
• Intended data retention periods for each data category.
• General description of technical and organizational security measures.

Clickk's ROPA is maintained as living internal document, updated as processing activities change. EEA/UK supervisory authorities may request ROPA access during investigations or compliance reviews.

Creators subject to GDPR bear independent responsibility for maintaining ROPA entries covering Clickk use and downstream captured Viewer data use.