Privacy Policy
Clerize is a software service operated by Digital Forge S.A.S. ("Digital Forge", "we", "us"), with address at Beta 114, San Nicolás de los Garza, Nuevo León, Mexico. This policy explains what personal data we handle when you visit clerize.com or use Clerize, why, and what rights you have. It follows Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). The Spanish version of this notice prevails.
1. Two different roles
Our customers' data (we are the controller). When a business signs up for Clerize, we decide how to handle the account data of that business and its team members: names, emails, passwords (stored only as hashes), billing details and usage.
Their customers' data (we are the processor). When a business connects WhatsApp, Messenger or Instagram, Clerize receives the messages that business exchanges with its own customers. For that data the business is the controller and we only process it on its instructions to provide the service. If you messaged a business that uses Clerize and want to exercise your rights, please contact that business first; we will help them respond.
2. What we collect
| Category | Examples |
|---|---|
| Account data | Business name, user names, email, phone, password hash, language, two-factor settings |
| Billing data | Plan, invoices, payment status. Card details are handled by Stripe; we never see or store full card numbers |
| Connected-channel data | Meta account and asset IDs (WhatsApp Business Account, phone numbers, Pages, Instagram accounts) and the access tokens needed to operate them, stored encrypted |
| Conversation data | Messages, images, audio, documents, contact names and phone numbers or profile IDs, tags, notes, message templates |
| Payment-link data | Amounts, concepts and payment status of links a business sends through its own Mercado Pago or Stripe account |
| Technical data | IP address, browser, device, log-in attempts, error reports (scrubbed of personal data before they leave our servers) |
We do not intentionally collect sensitive personal data. Businesses must not use Clerize to request it from their customers unless the law allows it and they have obtained the required consent.
3. Why we use it
Primary purposes (needed to provide the service)
- Create and secure accounts, authenticate users and prevent fraud or abuse.
- Connect a business's WhatsApp, Messenger and Instagram accounts and send and receive its messages.
- Show conversations to the business's team, route them and keep history.
- When the business turns it on, generate AI replies, suggestions and summaries from the conversation and the business's own instructions and files.
- Create payment links and record their status.
- Bill subscriptions, send service emails (verification, security, receipts) and provide support.
- Comply with legal obligations and respond to lawful requests.
Secondary purposes (you can refuse these)
- Send product news and offers to account users.
- Aggregate, de-identified usage statistics to improve Clerize.
To refuse secondary purposes, email privacy@digitalforge.mx or use the unsubscribe link in any marketing email. Refusing does not affect your service.
4. Data from Meta platforms
Data we receive through Meta's WhatsApp, Messenger and Instagram APIs ("Platform Data") is used only to provide Clerize to the business that connected the account. We do not sell Platform Data, use it for advertising, build profiles for third parties, or share it with other Clerize customers. We follow Meta's Platform Terms and developer policies.
5. AI features
When a business enables AI replies, the relevant conversation text, the business's instructions and its uploaded knowledge files are sent to Google's Gemini API to generate a response. They are processed only to produce that response for that business and are not used by us to train models. AI output can be wrong; businesses can review drafts before sending, or turn AI off completely.
6. Who we share it with
We use these service providers (processors), bound by contract to protect the data and use it only to serve us:
| Provider | Purpose |
|---|---|
| Meta Platforms (WhatsApp, Messenger, Instagram) | Delivering the business's messages |
| Google Cloud | Application hosting |
| Supabase | Database |
| Upstash | Sessions and cache |
| Cloudflare R2 | Storage of media files |
| Google (Gemini API) | AI replies, only when enabled |
| Stripe | Subscription billing and, if the business uses it, payment links |
| Mercado Pago | Payment links through the business's own account |
| SendGrid (Twilio) | Service emails |
| Sentry | Error monitoring, with personal data scrubbed |
Some providers are located outside Mexico (mainly the United States). Transfers to processors do not require your consent under the LFPDPPP. We will only disclose data to authorities when legally required. We do not sell personal data.
7. How long we keep it
- Account and conversation data: while the account is active. After the account is closed, workspace data is deleted within 30 days, except what we must keep by law (e.g. invoices, for the period required by Mexican tax law).
- Deleted media files: permanently removed within 30 days.
- Security logs: log-in attempts 30 days, two-factor attempts and error logs 90 days, audit events 365 days.
8. Security
Data is encrypted in transit (HTTPS/TLS). Meta access tokens are stored encrypted. Access is limited to staff who need it, accounts support two-factor authentication, and each business's data is logically separated from every other business's.
9. Your rights (ARCO)
You can Access, Rectify or Cancel (delete) your personal data, Oppose its use, revoke your consent, or limit its use or disclosure. Send a request to privacy@digitalforge.mx with your name, a way to reply, a copy of an ID (or proof of representation), the data concerned and what you are asking for. We will reply within 20 business days and, if the request is granted, carry it out within the following 15 business days, as the LFPDPPP provides. If you believe your rights were not respected, you can go to the competent Mexican data-protection authority.
10. Data deletion for Meta users
If you connected a Facebook, Instagram or WhatsApp account to Clerize and want its data deleted:
- Account owners can disconnect the channel under Channels in Clerize, and close the account from settings; or
- Email privacy@digitalforge.mx with the subject "Data deletion" and the account or page concerned; or
- Remove Clerize from your Facebook/Instagram settings (Apps and websites or Business integrations). When Meta sends us the resulting deletion request, we delete the associated data and give you a confirmation code to check its status.
If you only messaged a business that uses Clerize, ask that business to delete your conversation; we will delete it on its instruction.
11. Cookies
clerize.com and the Clerize app use cookies that are strictly necessary for logging in and keeping your session secure. We do not use advertising cookies. If we add analytics in the future, we will update this policy and, where required, ask for consent.
12. Children
Clerize is a business tool and is not directed at people under 18.
13. Changes
We will post any change on this page with a new effective date, and notify account owners by email or in the app when the change is material.
14. Contact
Digital Forge S.A.S. · Beta 114, San Nicolás de los Garza, Nuevo León, Mexico · privacy@digitalforge.mx