Privacy Policy
Last updated: 26 June 2026
1. Data Controller Identity
The controller responsible for personal data collected through this service is:
ClicNode — operated under the brand clicnode.com
Address: Geneva, Switzerland
Contact: privacy@clicnode.com
2. Data Collected
We collect the following categories of personal data:
- Account data: name, email address, password (hashed), preferred language, account creation date.
- Project files: AI-generated websites that you create and save within our service.
- Billing data: payment details are processed directly by Stripe. We do not store payment card numbers; we retain only your Stripe customer identifier and subscription status.
- Usage data: pages visited, actions performed in the application, technical events (errors, performance), IP address (anonymised after 24 hours).
- Technical logs: server logs retained for 90 days for security and debugging purposes.
3. Purposes and Legal Bases
| Purpose | Legal Basis (GDPR) |
|---|---|
| Service delivery (account creation, project management) | Performance of a contract — Art. 6(1)(b) |
| Billing and subscription management | Performance of a contract — Art. 6(1)(b) |
| Service improvement and anonymised statistical analytics | Legitimate interest — Art. 6(1)(f) |
| Marketing communications (newsletter, offers) | Consent — Art. 6(1)(a) |
| Legal obligations (accounting, tax retention) | Legal obligation — Art. 6(1)(c) |
4. Data Retention
- Account data: retained while your account remains active, then permanently deleted 30 days after account closure (grace period in case of reactivation).
- Project files: deleted upon account closure or upon explicit user request.
- Technical logs: retained on a rolling 90-day basis.
- Billing data: retained in accordance with mandatory Swiss accounting laws (10 years), held securely by Stripe.
5. Recipients and Sub-processors
We engage the following sub-processors, each bound by GDPR-compliant contractual safeguards (Standard Contractual Clauses or adequacy decisions):
- Supabase (database, authentication) — hosted in European Union data centres (Frankfurt, AWS eu-central-1).
- Stripe (online payments) — processes billing data in compliance with PCI-DSS certification.
- Google / Gemini AI (AI website generation) — prompts sent are anonymised; no project files or personally identifiable data are transmitted to Google without explicit consent.
- Cloudflare (CDN, DDoS protection, Workers) — may process transient IP addresses; no account data is stored at Cloudflare.
No personal data is ever sold to third parties for advertising purposes.
6. Your Rights (GDPR, Art. 15–22)
You have the following data protection rights:
- Right of access (Art. 15): obtain a copy of the personal data we hold about you.
- Right to rectification (Art. 16): correct inaccurate or incomplete data.
- Right to erasure (Art. 17): request deletion of your personal data (“right to be forgotten”).
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3)): withdraw your consent at any time without retroactive effect.
To exercise these rights, contact us at privacy@clicnode.com. We will respond within 30 days. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland or with the competent supervisory authority in your country of residence.
7. Swiss Compliance (nFADP / revDSG)
As a company established in Switzerland, we comply with the revised Swiss Federal Act on Data Protection (nFADP / nLPD / revDSG), which entered into force on 1 September 2023. The nFADP aligns Swiss law with European GDPR standards, and the rights described above apply equally under the nFADP.
8. Cookies
We use strictly necessary functional cookies (authentication session, CSRF protection) and analytics cookies solely with your consent. Please review our Cookie Policy for full details.
9. Changes to This Policy
Any material change to this policy will be notified by email to users with an active account at least 14 days prior to taking effect.