01Who is responsible for your data
The controller of your personal data is Sitio Labs Pvt Ltd, Mumbai, India (“Clikit”, “we”, “us”).
Contact for all privacy questions and requests: sales@sitiolabs.in.
Creators who run stores on Clikit receive their buyers’ details (see section 4) and are separately responsible, as independent controllers, for how they use those details.
02What we collect, why, and our legal basis
For users in the European Economic Area, the UK and Switzerland, the last column shows the ground we rely on under Article 6 of the GDPR.
| When | What we collect | Why | Legal basis |
|---|---|---|---|
| You create an account or sign in | Email address. If you use “Continue with Google”: your Google account ID, name and profile picture (received from Google). | To create your account and sign you in. We never store a password. | Contract |
| While you’re signed in | Session records: sign-in time, IP address, browser type, and the approximate location of that IP address (country and city, provided by Cloudflare). | To keep you signed in, protect your account, and spot suspicious or fraudulent accounts. | ContractLegitimate interest |
| You set up a store (creators) | Display name, username, category and goals, profile picture, store name, description, brand settings, images, products, files and links. | To run your storefront. What you publish is public. | Contract |
| You complete your seller profile (creators; required before your store can be published) | Legal name, mobile number, customer-support email, postal address with PIN code, and GSTIN (required only to sell physical products). A live selfie taken with your device’s camera, the on-screen instruction you followed in it (for example “Hold up 3 fingers”) and when it was taken. | To confirm that a real person runs each store and to prevent fraud and spam. Indian e-commerce law (Consumer Protection (E-Commerce) Rules, 2020) also requires sellers of goods to show buyers who they are and how to reach them. The selfie is looked at by a person on our team; we don’t use it for automated face recognition or matching. | ContractLegal obligationLegitimate interest |
| You connect Instagram (optional) | Instagram username, name, bio, website, follower and post counts, profile picture and recent posts (received from Meta). | To show your Instagram content on your store. | Consent you can disconnect at any time |
| You use Clio, the AI launch assistant (optional, where enabled) | Messages you write, the assistant’s replies, and launch details you approve. | To help you plan and set up your store. | Contract |
| You visit a store or product page | The page, the website that sent you, any campaign tags in the link (utm_…), and a visitor code that changes every day. The code is a one-way hash of your IP address and browser type; neither is stored. | To show the creator how many people visit, which pages they view and where visitors come from. No cookies; you can’t be followed across days or stores. | Legitimate interest |
| You buy, book or get a free product from a store | Email, name, what you ordered or booked, price and time, delivery address for shipped items. When paid checkout is live: payment status and the payment provider’s reference IDs. | To complete your order and let the creator fulfil it. | ContractLegal obligation |
| You pay for a Clikit plan | Your plan, subscription status, billing dates and invoices, and the payment provider’s reference IDs. Card details go to Razorpay, never to us. | To bill you, keep your plan active and meet tax and accounting rules. | ContractLegal obligation |
| You join a creator’s email list | Your email address, the store you joined, and the exact consent sentence you agreed to, with the date. | So the creator can email you. We send their welcome email on their behalf; every email has an unsubscribe link. | Consent unsubscribe any time |
| You delete your account | The reason you chose and any comment you wrote, stored without your name or email. | To understand why people leave and improve Clikit. | Legitimate interest |
| You join the waitlist | Email, which button you used, the notice you agreed to, and a one-way hash of your IP address (not the IP itself). | To tell you when Clikit opens, and to prevent abuse. | ConsentLegitimate interest |
| You contact us | Your message and contact details. | To reply and handle your request. | Legitimate interestLegal obligation |
| Any visit | Technical logs: time, page requested, result, IP address. | To keep the service running, secure and free of abuse. | Legitimate interest |
What’s required
An email address is needed to create an account or place an order; without it we can’t provide the service. Creators must complete the seller profile and the live selfie before they can publish a store, and must add a GSTIN before selling physical products. Everything marked optional is up to you.
Legitimate interest and consent
Where we rely on legitimate interest, it is to keep Clikit secure and working, and to give creators basic, privacy-friendly statistics. We’ve balanced it against your rights, and you can object (see section 7). Where we rely on consent, you can withdraw it at any time; this doesn’t affect processing done before you withdrew.
We do not sell your personal data, use it for advertising, use third-party analytics or advertising trackers, or make decisions about you based solely on automated processing that have legal or similarly significant effects. The AI assistant only makes suggestions; nothing is published unless you approve it.
05International transfers
We are based in India, and our providers store and process data in Singapore, India, the United States and other countries. When personal data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK and Swiss equivalents) in our providers’ data processing agreements, or on another safeguard permitted by law. You can ask us for a copy of the relevant safeguards.
06How long we keep it
| Data | How long |
|---|---|
| Account, store and AI assistant data | While your account is open. When you delete your account, or ask us to, we delete it within 60 days. |
| Seller profile and selfie | While your account is open. Retaking your selfie deletes the old one straight away. When you delete your account, both are deleted within 60 days. |
| Sign-in sessions | Until they expire or you sign out, and in any case no longer than your account. |
| Instagram data | Until you disconnect Instagram or delete your account, then deleted within 60 days. |
| Order records | For as long as tax and accounting law requires (up to 8 years under Indian law), then deleted or anonymised. Delivery addresses are anonymised once an order is complete. |
| Waitlist | Until we tell you Clikit has opened, or until you withdraw consent. |
| Creator email lists | Until you unsubscribe or the creator removes you. After you unsubscribe, your address stays on the list marked “unsubscribed” so you aren’t emailed again. |
| Store visit statistics | Up to 13 months, then deleted. |
| Technical logs | Up to 60 days. |
07Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you and get a copy
- Correct inaccurate or incomplete data
- Delete your data (“right to be forgotten”)
- Restrict how we use your data
- Data portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another provider
- Object to processing based on legitimate interest
- Withdraw consent at any time, where we rely on consent
- Complain to a data protection authority
To use any of these rights, email sales@sitiolabs.in from the address on your account. It’s free. We respond within 30 days; for complex requests we may extend this by up to two further months, and we’ll tell you if we do. We may need to confirm your identity, and we may keep data the law requires us to keep (for example, order records).
EUEurope, UK and Switzerland
You can complain to the data protection authority where you live or work, or where you think an infringement happened. We’d appreciate the chance to resolve your concern first.
INIndia
Under the Digital Personal Data Protection Act, 2023, you may nominate another person to exercise your rights if you die or become incapable, and raise a grievance with us. If you’re not satisfied, you may complain to the Data Protection Board of India.
USUnited States
Depending on your state (for example California), you may have rights to know, delete and correct your personal information, and not to be discriminated against for using them. We do not sell or “share” personal information for cross-context behavioural advertising.
08Children
Clikit is not for children. You must be at least the minimum age below to use it:
| Where you live | Minimum age |
|---|---|
| India | 18 |
| European Union, UK and everywhere else (including the US) | 16 |
| Selling on Clikit or receiving payouts (all countries) | 18 |
We do not knowingly collect personal data from anyone younger; if we learn that we have, we will delete it. Parents or guardians can contact us at sales@sitiolabs.in.
09Security
We use HTTPS everywhere, encrypt sensitive tokens, rate-limit sign-in and forms, and limit access to production systems. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant authorities and, where required, you, within the time limits the law sets.
10Changes to this policy
We’ll update this page before we start collecting new kinds of data or using data for new purposes, and change the date at the top. If a change is significant, we’ll tell signed-in users by email or in the app before it takes effect.
11Contact us
Mumbai, India · sales@sitiolabs.in
Registered office: BLG-08, Patani Commercial Complex, Washim 444505, Maharashtra, India
CIN: U62011MH2025OPC449219
See also our Terms of Service.