Privacy Policy

01 Information We Collect

From store owners (merchants)

• Name and email address (used for account creation and authentication)
• Billing information (processed securely by Stripe — we never store card details)
• Store URL and platform (WooCommerce or Shopify)
• Email outreach settings (from name, reply-to address, subject, body template)
• Widget customization settings

From end customers (shoppers)

• Instagram or TikTok handle — only if voluntarily submitted when they order
• Name and email address (from the order, used for outreach purposes)
• Publicly available follower count and public/private profile status (retrieved from third-party social data providers using the submitted handle)
• Order value metrics (used for lead scoring)

Submission of a social handle is entirely optional. Customers who do not submit a handle are not affected by this service in any way.

02 How We Use Information

• To operate and provide the Checkout Clout service to merchants
• To retrieve publicly available social media follower counts for submitted handles via third-party profile data providers
• To score and categorize leads for the merchant's dashboard
• To send outreach emails on behalf of merchants to customers who submitted their handle
• To process billing and manage subscriptions
• To send transactional emails (account confirmation, billing receipts)
• To improve our service and fix issues

03 Third-Party Services

We use the following third-party services to operate Checkout Clout:

• Supabase — database and authentication infrastructure. Data is stored in EU regions. Privacy policy
• Stripe — payment processing. We never store payment card details. Privacy policy
• Resend — transactional and outreach email delivery. Privacy policy
• TikAPI — TikTok profile data provider used to retrieve publicly available follower counts for submitted TikTok handles. Per their terms, TikAPI may retain and analyze request data to operate and improve their service. Privacy policy
• HikerAPI — Instagram profile data provider used to retrieve publicly available follower counts for submitted Instagram handles. HikerAPI is based in Kazakhstan and may retain log and usage data per their terms. Privacy policy
• Vercel — hosting and serverless infrastructure. Privacy policy

04 Data Sharing

We do not sell, rent, or share personal data with third parties for marketing purposes. Data is shared only with the third-party services listed above as necessary to operate the service, and with the merchant whose store processed the original order.

05 Data Retention

Merchant account data is retained for the duration of the account and deleted upon request. Lead data (customer handles, follower counts, email addresses) is stored on behalf of the merchant and deleted when the merchant deletes a lead or closes their account.

06 Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right to access — you can request a copy of the data we hold about you
• Right to rectification — you can request correction of inaccurate data
• Right to erasure — you can request deletion of your personal data
• Right to object — you can object to processing of your personal data
• Right to portability — you can request your data in a portable format

To exercise any of these rights, contact us at hi@checkoutclout.com. We will respond within 30 days.

07 International Data Transfers

To retrieve public follower counts, submitted social handles are sent to third-party profile data providers that may process data outside the European Economic Area (EEA). In particular, our Instagram data provider (HikerAPI) is based in Kazakhstan, and our TikTok data provider (TikAPI) may process data outside the EEA. Only the submitted handle and platform are sent to these providers — never a customer's name, email, or order details. Where required, we rely on each provider's own safeguards and terms for the protection of transferred data. If you would prefer your handle not be processed in this way, simply do not submit a handle — submission is always optional.

08 Cookies

The Checkout Clout dashboard uses session cookies for authentication. No tracking or advertising cookies are used. The capture widget embedded on merchant stores does not set any cookies on end customers.

09 Email Tracking

Outreach emails sent via Checkout Clout may include a tracking pixel to detect when an email is opened. This is disclosed to merchants during setup. Recipients who prefer not to be tracked can disable image loading in their email client.

10 Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, and row-level security on our database. API keys are generated with cryptographic randomness and should be kept confidential by merchants.

11 Children's Privacy

Checkout Clout is not directed at children under the age of 16. We do not knowingly collect personal data from children.

12 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of significant changes by email. Continued use of the service after changes constitutes acceptance of the updated policy.

13 Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

Oderweb d.o.o.
Email: hi@checkoutclout.com
Website: checkoutclout.com