Privacy Policy
Effective date: 4 November 2026
ClientKickoff is operated by Elegra Suit Ventures, a business registered in Ghana (No. BN114890226), of 11 Nii Akuboye Street, East Legon, Accra, Ghana ("we", "us"). This policy explains what we collect, why, who we share it with, how long we keep it and what you can do about it. Questions: app.clientkickoff@gmail.com.
1. Two kinds of data, two roles
- Account data: the agencies and team members who use ClientKickoff, and the things they set up (name, email, agency, settings). For this data we are the controller.
- Client data: what an agency collects from its own clients through ClientKickoff, such as contact names, emails, files, form answers, approvals, questions and access codes. The agency is the controller of this data and we process it on the agency's behalf, only to provide the service. If you're an agency's client, please contact that agency first. We'll help them answer you.
2. What we collect
When you use ClientKickoff as an agency:
- Your account: name, email address and password. The password is stored only as a secure hash by our authentication provider.
- Two-step login: if you turn it on, the details of your authenticator app.
- Your agency: its name, timezone, logo and brand colour, your team members and their roles, and your notification choices.
- Where you came from: the campaign tags on the sign-up link you used (for example
utm_source), if any. Never anything personal. - Billing. Payments are handled by Lemon Squeezy, who act as the merchant of record.
- What Lemon Squeezy sends us: your plan, its status, renewal dates, a customer reference, and the payer's name and email in their notifications.
- What we never see: your card number.
- A trial fingerprint. When an email address starts a free trial, we keep a one-way fingerprint of it: a SHA-256 hash of the email, lower-cased and simplified. From it we can tell if the same email starts another trial, but we can't get the address back. We keep it even after an account is deleted, so that each email gets one free trial.
When an agency uses ClientKickoff to collect from its clients (client data, processed for the agency):
- Contact details: names and email addresses.
- Files the client uploads.
- Answers: form answers, approvals, ticks, comments and questions.
- Access codes, such as a store collaborator code. The agency only sees them after two-step login, and they're erased once the agency confirms the access works, or when the project is archived.
- Link activity. When a client opens their link, we record:
- which steps they open;
- the active time spent on each;
- whether they used a phone or a computer.
We use this to show the agency progress and a kickoff forecast.
For security and to prevent abuse:
- Rate limits: we keep one-way hashes of IP addresses and email addresses for a short time, to limit repeated attempts.
- Account events: we record events such as sign-ins and changes to an account.
- Server logs: our hosting and sign-in providers record standard request details, such as IP address, browser and the page asked for, and keep them for a short time.
3. Cookies and similar storage
We use only cookies that the service needs, and two that remember your display choices. We don't use advertising or analytics cookies, and our website doesn't load trackers or analytics.
| Name | What it's for | Type |
|---|---|---|
| Sign-in session cookies (set by our authentication provider) | Keeping you signed in | Necessary |
ck_portal, ck-portal-auth | Opening a client's link securely, without the link's secret staying in the address bar | Necessary |
ck_invite | Holding a team invite while you sign up | Necessary |
ck_sidebar, ck_theme | Remembering the sidebar's width and your light or dark theme | Preference |
dismiss-notice:* (browser storage) | Remembering notices you've closed | Preference |
4. How we use data
- To provide ClientKickoff: your account, your projects, your clients' links, notifications, and the emails the service needs (sign-in codes and account emails).
- To keep it secure: two-step login, preventing abuse, investigating problems.
- To bill you, through Lemon Squeezy.
- To improve the product, using totals across all agencies (for example, how many projects were sent). These totals don't contain client data.
We don't sell personal data. We don't use client data to advertise or to train AI models.
5. Legal bases (for people in the EU, UK and similar places)
- Contract: to provide the service you signed up for.
- Legitimate interests:
- keeping the service secure;
- preventing abuse and repeat free trials;
- understanding usage in aggregate;
- the link activity shown to agencies.
- Legal obligation: for example, tax records, which Lemon Squeezy keeps as merchant of record.
- Consent: where we ask for it.
6. Who we share data with
We use these providers to run ClientKickoff. Each handles data only on our instructions and under its own data-protection terms.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | United States |
| Netlify | Hosting and delivering the website and app | Global network, United States based |
| Lemon Squeezy | Payments, tax and invoices (merchant of record) | United States |
| Resend | Sending the service's emails | United States |
Others who can see data:
- The agency's team. Within an agency, team members see what their role allows.
- Authorities, where the law requires us to share data.
- A new owner, if ClientKickoff is sold or merged. Your data would move only under this policy, and we'd tell you first.
7. International transfers
Our data is stored in the United States. Where data moves from the EU, the UK or elsewhere, we rely on our providers' transfer safeguards, such as Standard Contractual Clauses.
8. How long we keep data
- Account and agency data: while the account exists.
- Deleting an agency:
- For 14 days it can be restored by signing in; nothing in it is reachable during that time.
- After that, all of its data is erased, including clients, files, answers, history and the owner's account.
- Payment records: reduced to the kind of event only.
- Deleting a team member's account: erased at once. Work they did stays with the agency.
- Archived projects: their files are deleted after 30 days on the Free plan, or 90 days on paid plans. Projects with no activity for 12 months are archived automatically.
- Access codes: erased once access works, or when the project is archived.
- Client link activity: 12 months.
- Billing notifications from Lemon Squeezy: 90 days.
- The trial fingerprint: kept, as explained in section 2.
- Backups: copies of the database made for safety are kept for up to 30 days, then deleted.
9. Security
- In transit: everything is encrypted (HTTPS).
- At rest: data is encrypted by our providers.
- Two-step login: available to everyone, and agencies can require it for their whole team.
- Access codes: shown only after two-step login.
- Who sees what: every agency's data is separated at the database level, and roles limit what each team member can see.
- Files:
- each download link stops working after about a minute;
- uploads are checked to be the file type they claim to be.
No system is perfectly secure. If a breach affects your data, we'll tell you as the law requires.
10. Your rights
Depending on where you live, you can:
- see the data we hold about you, and correct it;
- delete it, or limit how we use it;
- object to how we use it;
- get a copy of it in a portable form;
- withdraw consent you've given.
You can also complain to your data-protection authority. In Ghana, that's the Data Protection Commission.
How to use your rights:
- In the app: Settings → Profile (delete your account) and Settings → Agency (delete the agency).
- Or email app.clientkickoff@gmail.com. We answer within 30 days.
If you're an agency's client, contact the agency. They control your data, and we'll help them.
11. Children
ClientKickoff is for businesses. It isn't meant for anyone under 16, and we don't knowingly collect their data.
12. Changes
If we change this policy, we'll post the new version here with a new effective date. We'll tell agency owners by email or in the app before important changes take effect.
13. Contact
Elegra Suit Ventures (Ghana, No. BN114890226), 11 Nii Akuboye Street, East Legon, Accra, Ghana. Email: app.clientkickoff@gmail.com.