Privacy notice

This notice says what personal data ClickNote holds, why, who else handles it and what you can ask us to do with it.

1. Who is responsible

ClickNote is operated by Peak Digital Ltd, a company registered in England and Wales with company number 13589737, whose registered office is at Old Smithy Cottage, Sellicks Green, Taunton, TA3 7SA. You can reach us about anything in this notice at hello@clicknote.io.

There are two kinds of people whose data ClickNote holds, and our role is different for each:

• Agencies and their team members, who have a ClickNote workspace. For their account data we are the controller.
• Reviewers, the agency’s clients who leave notes on a site. Their data is processed on the agency’s behalf: the agency is the controller and we are its processor.

2. What we hold

Account details

Your name, email address, agency name, team role and sign-in details, including two-factor settings if you turn them on. If you pay for a plan, Stripe (cards) or GoCardless (Direct Debit) handles the payment. We keep a record of your plan and invoices, but we do not see or store your full card number.

Notes

The words of each note and its replies, and the context recorded with it: the page URL, the CSS selector and XPath, the element’s text and HTML snippet, an automatic screenshot, the viewport size, browser, operating system and device layout, where in the element the reviewer clicked, and theme context such as the Shopify section or WordPress template.

Form field values are never captured. A screenshot shows the part of the page the reviewer was looking at, so it can include anything visible there.

Reviewer details

The reviewer’s email address, which they confirm with a one-time code or a link in their invite email, and the notes and replies they write.

If you ask for the demo

The email address you give, so that we can send you the link to your demo. We may write to that address once or twice afterwards to ask how it went; each of those emails has a link that stops them with one click. We keep the address, and whether the demo was opened, for up to a year.

Messages you send us

If you write to us, by email or through the contact form on this site, we keep your name, your email address and what you wrote, so that we can reply and follow it up.

Technical records

The service keeps a request log: the time, the address requested, the result and the IP address of each request. The log is capped in size, so older entries drop off, and it is cleared whenever we release a new version. When you sign in, the IP address and browser of that session are kept with it until the session ends.

3. Cookies, browser storage and our own ads

• This website, clicknote.io, sets no cookies and loads nothing from third parties: no analytics, no advertising scripts and no external fonts. It keeps one thing in your browser’s storage, and only if you close the bar that announces an offer: a note that you closed it, so it stays closed on the next page. The note says nothing about you, is never sent to us and is gone when you close the tab.
• If you arrive from one of our Google ads, the address you land on carries a click reference that Google added to it. We pass that reference along in the links on this site, so that if you start a trial or the demo we can tell Google that its ad worked. In the UK, the EEA and Switzerland we ask you first, and if you say no the reference is dropped. If you did not come from an ad, none of this applies to you.
• The ClickNote app uses only what it needs to keep you signed in.
• On a client’s site, the ClickNote snippet does nothing for normal visitors. For a reviewer who has opened a review link, it keeps their review session in that browser’s local storage so they stay signed in.

4. What we use it for

• To run ClickNote: showing notes to the people entitled to see them, and keeping pins attached to the right element.
• To send the emails the service depends on: sign-in codes, invites, replies, mentions and round updates.
• To send you the demo you asked for and, unless you stop them, one or two follow-up emails about it.
• To take payment and keep accounting records.
• To keep the service secure and to fix faults.
• To answer you when you ask for help.

We do not sell personal data. The only use we make of anything for advertising is the one in section 3: telling Google which of its ad clicks led to a demo, a sign-up or a first payment. Google receives the click reference, the time, which of those three it was and, for a payment, the price of the plan. It does not receive your name, your email address or anything in your workspace, and we do not build advertising audiences from our customers.

Our legal bases under UK data protection law are our contract with you, our legitimate interest in running and protecting the service and in knowing whether our advertising works, your consent where we ask for it (section 3), and our legal obligations, for example to keep tax records.

5. Who else handles it

• Stripe, for card payments, and GoCardless, for Direct Debit payments.
• Resend, for sending email.
• Vultr, for the server the service runs on, in London, United Kingdom.
• Cloudflare, which sits in front of the service to protect it and deliver it.
• Google, for our own mailbox and for measuring our own ads as section 3 describes, and Google or Apple for signing in, only if you choose to sign in with them.

An agency can choose to have the emails that go out under its name sent through its own account with an email service (Resend, Postmark, SendGrid or Mailgun) or through a mail server it names, and not through ours. Those are the invites, sign-in codes, replies, mentions and round updates sent to its reviewers and its own team. They then pass through the service the agency chose, under the agency’s own agreement with that service, and that service’s privacy notice applies to them.

An agency can also choose to be told about a project’s new notes, replies and finished rounds in a channel of its own in Slack, Microsoft Teams, Discord or Google Chat, or at a web address it names. What is sent there says which project it is, who left the note or the reply (their name and email address), what they wrote and the page it is about. It then passes through the service the agency chose, under the agency’s own agreement with that service, and that service’s privacy notice applies to it.

If you connect an AI agent through the MCP endpoint, or paste a Copy for AI agent brief into another tool, the notes you ask for go to that tool. That is your choice, and that provider’s terms and privacy notice apply.

6. If you are a reviewer

You were invited by an agency, and the widget and emails you see carry that agency’s name. Your notes are visible to that agency and, if the agency has turned sharing on for the project, to your own colleagues on the same project. The agency may also have them sent on to the chat service or other tool its team works in (see section 5).

The emails you get about a project are sent by us or, if the agency has set one up, through the agency’s own email service (see section 5). The agency can tell you which.

If you want to see, correct or delete your data, ask the agency first, because it decides what happens to it. If you cannot reach them, write to us and we will pass your request on.

7. Where it is stored

Workspaces, notes and screenshots are stored on a server in London, United Kingdom. Some of the providers listed above are based outside the UK or handle data there. Where one of them does, it is under the safeguards UK law provides for: adequacy regulations, or the standard contractual clauses in that provider’s data processing terms.

8. How long we keep it

• Workspace content is kept while the workspace is open, unless the agency deletes it sooner. When its owner deletes the workspace, the content is deleted from the service at once and drops out of our backups within 90 days.
• An owner or an admin of a workspace can delete one project. Its notes, replies, screenshots, the list of people and their sign-ins are then deleted from the service at once, and drop out of our backups within 90 days. We keep a short record that it was deleted: who deleted it, the project’s name and how many notes, screenshots and people it held. That record holds none of the notes’ words.
• If a trial ends without a plan, review links pause and the notes are kept for 90 days, so you can come back. After that the workspace and everything in it is deleted. We email the workspace’s owner a week before that happens.
• An ad click reference (section 3) is kept with the workspace it led to for at most 90 days, and is deleted with the workspace if that goes first.
• A live demo workspace and everything in it is deleted 12 hours after it is opened. The email address the demo link was sent to is kept for up to a year.
• Invoices and payment records are kept for as long as tax law requires.

9. Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to restrict or stop using it, and ask for it in a portable format. To use any of these rights, write to hello@clicknote.io.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.

10. Changes to this notice

If we change this notice in a way that matters, we will say so here and, for workspace owners, by email.