Privacy Policy

Proxyclinch is operated by [COMPANY LEGAL NAME], a company registered in Nigeria under RC number [RC NUMBER], with its registered office at [REGISTERED ADDRESS] ("Proxyclinch", "we", "us", or "our").

For most of what's described in this policy, we're the data controller: we decide why and how your account data is processed. Where we process data about your customers on your behalf as a Tenant — for example, the content of an Instagram conversation — we act only as a data processor on your instructions, and your business is the controller for that data. "What we collect" below explains that distinction in more detail.

Our Data Protection Officer can be reached at [DPO EMAIL] for any question about this policy or how we handle personal data.

Tenant account data

Information you give us directly: your name, email address, phone number, business details, team members' contact information, and billing details, along with anything else you provide when you sign up, invite a teammate, publish knowledge-base content, or contact support. We're the data controller for this data.

End-customer / contact data processed on your behalf

Once you connect an Instagram account, we process the content of the DMs, comments, and story-mention replies that flow through it, along with your contacts' Instagram identifiers — strictly on your instructions, to provide the Service to you. This data reflects your business's relationship with its own customers, not ours; we act only as your data processor for it, and you remain the controller responsible for your own legal basis to collect and use it.

Site analytics & cookies

If you accept our cookie banner on this marketing site, we collect anonymized analytics about how visitors use it. Nothing is tracked before you accept — see "Cookies" below.

Where Proxyclinch is the data controller, we rely on:

• Contract — processing your account data is necessary to provide the Service you signed up for.
• Legitimate interests — securing the Service, preventing fraud and abuse, and understanding aggregated, de-identified usage patterns to improve the product.
• Consent — marketing-site analytics cookies (which we don't load until you accept them) and any optional marketing communications you opt into.
• Legal obligation — retaining certain records, such as billing records, where Nigerian law requires it.

For data we process on your behalf as your data processor — your customers' conversation and contact data — your business determines the legal basis for collecting and using it; we don't set that basis and only act on your instructions.

We use the data described above to:

• Provide, operate, and maintain the Service — hosting your account, running your automations, and keeping your inbox in sync.
• Generate AI assistant replies. To produce a specific reply, the relevant conversation content and the published knowledge-base material needed to answer it are sent to Anthropic, our AI provider — never more of your data than that one reply requires, and never anything you haven't actually published.
• Provide customer support and respond to requests you send us.
• Send service communications and security alerts, and — only if you've opted in — product or marketing updates.
• Process subscription payments through Paystack.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations, including Nigerian tax and company-law recordkeeping.

We don't sell your data or your customers' data, to anyone, ever.

We rely on a small, named set of sub-processors to run the Service — each one sees only what its role requires:

• Cloud infrastructure host — Runs the application, database, and encrypted backups.
• Meta / Instagram — The messaging channel itself — DMs, comments, and story replies.
• Anthropic — Powers the AI sales assistant's replies.
• Paystack — Processes subscription payments.
• Email / SMS provider — Delivers notifications, alerts, and one-time codes.

The full sub-processor register, including exactly what data each one sees, is published on our Security page.

Some of the sub-processors above may process data outside Nigeria. Where that happens, we put appropriate safeguards in place — including contractual data-protection terms with each sub-processor — consistent with the cross-border transfer requirements of the Nigeria Data Protection Act 2023, so your data receives an equivalent standard of protection wherever it's processed.

We keep your Tenant account data for as long as your account is active, and for a limited period afterward to meet legal, tax, and accounting obligations.

Retention for conversation and audit-log data processed on your behalf is configurable per your plan, visible in your account's data settings, rather than fixed in this policy. Once a record passes its retention window, it's automatically and permanently removed from the live system.

Encrypted backups are retained for a limited, documented period after live deletion before they age out on their own schedule — this is why a deletion can take a short time to clear from backup storage after it's already gone from the product.

Every connection to Proxyclinch runs over TLS, and data is encrypted at rest. Instagram channel access tokens and other credentials are stored KMS-encrypted, never as plain text. Passwords are hashed with argon2. Two-factor authentication is mandatory for platform admin access and available — mandatory for Owners on eligible plans — for your team. Every tenant is isolated at the database query layer, with an automated cross-tenant isolation test in CI for every tenant-scoped table. Sensitive actions are written to an append-only audit log that nobody can edit. We never store your customers' card numbers — Paystack tokenizes payment data directly on its own systems.

For more detail on any of this, see our full Security page.

Under the Nigeria Data Protection Act 2023, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, to receive a copy of it in a portable format, and to withdraw consent at any time where we rely on consent.

For your own account data

Most of this is available directly in your account settings. For anything that isn't — or to submit a formal request — contact us at [DPO EMAIL]. We'll respond within the timeframe required by law.

For your customers' data

If you're a contact of one of our Tenants and want to exercise a right over your own data, please contact that business directly — as the data controller, they're responsible for fulfilling your request, and the Service gives them dedicated tools to do so. We assist our Tenants in meeting these requests but don't handle them directly ourselves.

If you're unsatisfied with how we've handled a request, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

This marketing site uses Google Analytics to understand which pages are useful to visitors — but the analytics script doesn't load, and no analytics cookie is set, until you accept the cookie banner. If you reject or dismiss it, nothing is tracked.

We also use a small amount of browser local storage — not a cookie — to remember your light/dark theme choice and your response to the cookie banner. Neither is used to track you across sites, and neither requires consent.

You can withdraw analytics consent at any time by clearing this site's data in your browser; we'll ask again on your next visit.

The Service is intended for businesses and individuals at least 18 years old. We don't knowingly collect personal data from children. If we learn that we've collected personal data from a child, we'll delete it.

We may update this policy from time to time — to reflect changes to the Service, legal requirements, or our business. If a change is material, we'll notify you by email or an in-product notice before it takes effect. The "last updated" date at the top of this page always reflects the date this policy last changed.

Questions about this policy or your data? Reach us at:

support@proxyclinch.com