Privacy Policy

1. Introduction

Grandline, Denmark, operates ClickLab and acts as controller for the personal data described in this policy.

This policy covers the website, desktop application, AI services, accounts, and payments.

Contact: [email protected]

2. Information We Collect

We may collect and process the following types of information:

• Account Information: such as email address and login details
• User Content: prompts, generated thumbnails, and related inputs/outputs
• Usage Data: interactions with our website and features
• Technical Data: IP address, browser type, device information
• Analytics Data: collected through GrandLine, Google Analytics, and optional PostHog pageview and paywall analytics
• Desktop Analytics: optional setup events, Studio connection outcomes, task outcomes, timings, approvals, credit blocks, and app settings
• Paywall Test Data: browser identifiers, test assignments, plan choices, billing periods, checkout starts, and confirmed subscription payment amounts

3. Legal Basis for Processing

Where applicable under GDPR, we rely on the following legal bases:

• Contractual Necessity: to provide access to our services
• Legitimate Interests: to improve our platform, enhance user experience, ensure security, and support marketing efforts
• Consent: where required (e.g., certain cookies or tracking technologies)

Legitimate Interest Explanation: We process certain data (such as usage patterns and analytics) to understand how users interact with ClickLab, improve performance, develop new features, and promote our services. These activities are conducted in a way that minimizes impact on user privacy and do not override your rights.

PostHog analytics relies on your consent. It remains off unless you allow it through our analytics preferences.

4. How We Use Your Information

We use collected data to:

• Operate and maintain the service
• Generate thumbnails and related assets
• Process payments via Stripe
• Analyze usage and improve performance
• Compare plan popup designs and monthly or annual billing defaults using consented paywall and payment events
• Improve desktop setup, Studio connections, coding reliability, and repeat use through optional desktop analytics
• Provide customer support
• Communicate important service updates

We do not sell personal data.

5. Data Sharing and Disclosure

We may share information with trusted third parties, including:

• Payment processors: such as Stripe
• Analytics providers: GrandLine, Google Analytics, and PostHog for optional pageview, paywall, and subscription payment analytics
• PostHog also receives optional desktop product analytics in its EU hosting region
• Infrastructure providers: hosting and cloud services
• Legal authorities: when required by law

These parties process data only on our behalf and under appropriate safeguards.

6. AI Training and Generated Content

We may use prompts and usage data to improve our services and models. Where possible, data is aggregated or de-identified before use.

We do not intentionally use personally identifiable information for training without safeguards.

7. International Data Transfers

Your information may be processed in countries outside your own. Where required, we implement safeguards such as standard contractual clauses to protect your data.

Our PostHog project uses its EU hosting region. Stripe separately processes checkout records that contain paywall test attribution.

8. Data Security

We implement technical and organizational measures to protect your information. However, no system can be guaranteed to be completely secure.

9. Data Retention

We retain personal data only as long as necessary to:

• Provide our services
• Maintain account history
• Evaluate paywall tests and review their results
• Evaluate desktop setup, coding reliability, and repeat use after consent
• Comply with legal obligations

We retain paywall analytics for historical comparisons of plan choices, popup performance, and subscription revenue. We use the longest history our analytics plan provides while those comparisons require visitor-level records. We review this need annually. We delete or anonymize records when we no longer need them. We also act on valid deletion requests.

We can retain summary results without a fixed limit if they cannot identify visitors. Our analytics plan limits how far back events can be queried. This limit does not guarantee automatic deletion.

The PostHog browser identifier remains until consent withdrawal or browser storage removal. Payment attribution receipts expire after 30 days. A withdrawal token stays in browser storage until our server confirms withdrawal or the receipt expires.

Desktop analytics uses a separate random identifier stored on your device until you withdraw consent or remove app data. We review the need for desktop event records annually. We delete or anonymize records when their purpose no longer requires them. Valid deletion requests also apply. Withdrawal stops future collection; it does not automatically delete events already received.

Data already received follows these retention and deletion rules. You can request deletion using the contact details in section 13.

10. Your Privacy Rights

Depending on your location, you may have rights to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Withdraw consent for optional analytics at any time
• Complain to your local data protection authority where applicable

To exercise your rights, use the contact details in section 13. We respond within the time required by applicable law.

11. Cookies, Browser Storage, and Tracking

We use cookies, browser storage, and similar technologies to:

• Maintain essential site functionality
• Measure cookieless pageviews and product usage through GrandLine
• Analyze usage through optional GrandLine and Google Analytics cookies after consent
• Keep PostHog paywall test assignments stable across visits after separate consent

GrandLine is installed through first-party ClickLab proxy routes. By default, ClickLab loads the cookieless GrandLine script from /js/grandline.js and sends pageview events through /api/grandline/pageview and goal events through /api/grandline/goal. These events may include page URL, referrer, browser and device information, user agent, IP-derived request information, event names, event parameters, and country headers provided by our hosting or network providers.

If you accept analytics cookies, ClickLab may load the cookie-enabled GrandLine script from /js/grandline.cookies.js and Google Analytics may be initialized. These optional analytics tools help us understand site usage, improve product performance, and prioritize fixes and features.

PostHog analytics starts only after you allow it. We measure page visits using the site origin and route template. Route templates replace project identifiers and other dynamic route values. We compare plan popup designs and monthly or annual billing defaults. We measure paywall views, plan choices, checkout starts, and completed subscription payments.

Events include a random browser identifier, test assignment, selected plan, billing period, workspace type, and browser or device information. Payment events include the paid amount, currency, monthly equivalent, and whether Stripe reports a live payment.

The browser identifier links visits and payments. We do not send your account ID, name, email address, or card details to PostHog. The identifier stays in local storage to keep test assignments stable across visits. Network requests also provide technical connection data to the receiving provider. Our PostHog project has IP anonymization enabled.

Stripe supplies confirmed payment amounts. We attach the browser identifier and test assignment to Stripe checkout records to match payments with tests. This link is not fully anonymous because checkout records relate to your billing account.

We disable PostHog session recording, automatic page tracking, automatic form capture, surveys, and person profiles. ClickLab sends pageviews after consent on page load and navigation. Pageviews exclude URL parameters, fragments, URL credentials, dynamic route values, referrers, and page titles. We exclude form text and URL parameters from our PostHog paywall events.

You can change this consent in account settings. Withdrawal stops browser tracking immediately and resets the local tracking identifier. Our server checks consent before sending checkout or payment analytics. This check includes payments from earlier checkouts. When the server confirms withdrawal, it blocks further analytics using that consent receipt.

If a privacy update cannot reach our server, we keep the withdrawal pending. We retry when you reconnect. A notice shows when payment analytics withdrawal is still pending. Events already sent before confirmation can still arrive. Withdrawal does not cancel your payment or subscription.

A limited consent record connects the browser identifier to a secure receipt and its validity or withdrawal state. The browser stores the receipt token, and the server stores only its hash. Stripe checkout attribution includes the hash. These receipts do not provide account access.

Rejecting optional analytics does not affect core ClickLab features. You can change or withdraw your choices from account settings.

11A. Optional Desktop Analytics

Desktop analytics is off by default. Installing ClickLab or accepting its terms does not enable analytics. Website analytics choices do not enable desktop analytics.

The first-use screen offers a separate, unchecked analytics choice. You can also choose analytics in Settings → Terms and privacy. Refusal does not limit core features. You can withdraw consent through the same settings control.

After consent, ClickLab sends app openings, sign-in completion, project selection categories, and Studio connection attempts and outcomes. It sends task starts, completions, failures, user stops, first-response times, and task durations. Events include counts of confirmed changes, tool failures, and successful playtest controls. Playtest controls do not prove that a game test passed. Events also include approval requests, approval choices, and requests blocked by insufficient credits.

Event properties include app version, operating system category, model identifier, Turbo setting, and permission mode. A release category separates development builds from installed releases. We use these events to find setup problems, improve reliability, and measure return use.

A random device identifier connects events across app openings. It is not your account identifier and is not fully anonymous. Shared devices can represent more than one person. We do not link this identifier to website analytics or payment records.

Desktop analytics excludes prompts, chat content, code, file names, file paths, project names, and screenshots. It excludes account identifiers, names, emails, credentials, balances, payment details, raw errors, and tool arguments or results. Session recording, automatic interaction capture, person profiles, and AI content capture remain off.

Events go directly to PostHog's EU ingestion service. Network requests also provide technical connection data to PostHog. Our project enables IP anonymization. Desktop events also disable IP-based location enrichment.

The app stores the consent choice, notice version, choice time, and enabled identifier locally. These consent records do not grant account or project access. Analytics requests do not include ClickLab authentication cookies or tokens.

Withdrawal clears the local analytics identifier, drops queued events, and cancels active analytics requests. Requests already sent can still arrive. A later grant creates a new identifier. We do not send historical activity from before consent. Delivery failures do not affect coding tasks or credit accounting.

The retention and deletion rules in section 9 apply to desktop analytics. You can request deletion through [email protected].

12. Children's Privacy

Our service is not intended for children under 13, and we do not knowingly collect personal data from children.

13. Contact Information

Grandline, Denmark, operates ClickLab.

For privacy questions or data rights requests, contact [email protected].

14. Desktop Projects, Files, and AI Requests

The desktop keeps project metadata, chat history, settings, and native AI session data on your computer.

Local chat and project data are separated by ClickLab account and backend address.

The desktop sends necessary conversation context, selected file contents, attached references, and requested Studio captures for AI processing.

ClickLab processes these requests with AI service providers. Processing can occur outside Denmark and the European Economic Area.

Desktop AI provider requests disable response storage and disallow provider data collection through supported request settings.

The general service improvement section does not authorize training on desktop project files or chat content.

The service records account, security, billing, and limited operational data needed to provide and protect the service.

Local settings and permissions control project and Studio access. Full access permits automatic changes within the displayed permissions.

Only attach content you are authorized to share. Review files for secrets and personal data before submission.

Deleting a local chat removes its saved desktop transcript and related local session data.

Account, payment, and legally required records follow the retention rules above. Uninstalling does not delete your online account.

15. Desktop Agreement Records

The desktop stores agreement versions, document hashes, acceptance times, and application versions on your computer.

The current desktop does not send these agreement records to ClickLab servers.

These records support the local agreement screen. They do not create an account or authorize optional analytics.

Optional analytics choices remain separate. You can change applicable website analytics choices in account settings.