Legal

Privacy policy

Effective and last updated 2 November 2026 (version 2026-11-02.2)

This policy explains what personal information Clickless collects, why, who receives it, how long it's kept and the choices you have. Clickless, LLC is responsible for it. It covers getclickless.ai and everything on it: agents' public pages and share cards, the brand portal, the creator studio and the developer portal. It also covers Clickless's Shopify app, the Agent API and MCP server, and the shopping agents Clickless hosts on web chat, Instagram, Facebook (Messenger and comments on a brand's Page), text message and WhatsApp. This policy took effect on the date at the top of this page.

Clickless serves people in the United States. Its agents also answer texts from Canadian phone numbers. If anything you tell an agent is about your health, the consumer health data privacy policy also applies.

The short version

An agent needs to know what you want to buy, not who you are. Clickless doesn't ask shoppers for their name, email, address or phone number, unless a creator's agent asks whether you'd like to join that creator's list and you choose to leave your email (or, where the creator asks, your number), which goes only to that creator, or you ask for a person and choose to leave a way to reach you, which goes only to that agent's brand (or creator) to reply and is deleted after 30 days.
Shoppers pay the brand on the brand's own site. Clickless never takes a shopper's payment.
Clickless doesn't sell personal information. No advertising cookie or pixel is set or read in agent chats or anywhere you talk to a Product Expert, or in the portals, and nothing from a conversation goes to Meta or any other ad platform. When you tap through from an agent, the brand's store may tell us an order was completed, using only the agent's link reference.
Some of Clickless's own marketing pages for businesses may use Meta's pixel to measure and show Clickless's ads, which shares your visits to those pages with Meta. When you ask for a website scan's report or sign up a brand there, Clickless may also send Meta a hashed (SHA-256) copy of your email address, with your IP address and browser. Never for anyone chatting with a Product Expert. "Your privacy choices" at the bottom of those pages turns both off, and Global Privacy Control is honored. Details are under the Meta pixel on marketing pages.
Agents are AI, not people. Each one's first message says whose product expert it is, and asked whether it's a person or an AI, it says plainly that it's an AI.
Conversations that touch on health stay private in Clickless's tools, even from the agent's owner, never go to an advertising or analytics tool, and what people wrote in them is deleted after 30 days. On Instagram and Facebook, the account or Page you message still sees the thread in its own inbox.
To see, correct or delete your information, email info@getclickless.ai.

Shoppers: chatting with an agent

When you chat with an agent, on its web page, by Instagram direct message, in Facebook Messenger, by text or on WhatsApp, Clickless keeps the items below. Some ids are kept only as a keyed hash: a code made from the id with a secret key, which can't be turned back into the id.

your messages (up to 500 characters each) and the agent's replies, so the agent can continue the conversation and its owner can see how it's going;
for web chat, a random id from a cookie in your browser, stored only as a keyed hash, so the conversation picks up where it left off;
for Instagram, your Instagram-scoped id: an id Instagram gives you for that one account, not your username;
for Facebook Messenger, your Page-scoped id: an id Facebook gives you for that one Page, not your name or profile;
for texts, your phone number only as a keyed hash: Clickless uses the number to reply and doesn't store it;
for WhatsApp, your number or WhatsApp id only as a keyed hash, in the same way;
where the conversation started (an ad, a comment, a bio link, a share card or a direct visit, with the campaign, ad and tracking labels on the link), which offers the agent showed you and which ones you tapped.

When you send a creator's keyword (a word like GUIDE in a comment, a DM or their web chat), their agent may ask whether you'd like to join that creator's list, before or after it sends what you asked for. Whatever you answer, you get what you asked for. If you reply with your email (or, where the creator asks, your phone number), Clickless keeps it for that creator, with the words you were asked, when, the keyword and where you sent it, and replies with a link to unsubscribe. The creator can see and export the list, and can have Clickless pass each new address, and each unsubscribe, to the email tool they use (Klaviyo, Mailchimp or their own system); from there the creator's own privacy policy applies. Clickless itself sends nothing to the list, never sells it, never sends it to an advertising or analytics tool and never gives it to an AI model, and your address isn't kept in the chat's transcript. Unsubscribe with the link, by replying STOP in that chat, or by asking the creator or info@getclickless.ai. A conversation that touches on health, and a keyword for a regulated brand's products, never ask. Separately, where a creator's agent has its own number, it may ask for your number to get their next drop by text; Clickless keeps that number only as a keyed hash, as described under text messages.

When you ask for a person in web chat or by text, the agent may ask for the best email or phone number to reach you. If you send one, Clickless keeps it encrypted, with the words you were asked and when, and shows it only to the brand whose agent you're chatting with (for a creator's agent, the creator; for a Clickless agent, Clickless's team), so they can reply to you. If you've left the chat when they reply in it, Clickless emails their reply to the address you left, from "{the brand} via Clickless", with a link that reopens that chat for 7 days; every such email lets you stop them. It isn't used for marketing, isn't shared with anyone else, isn't kept in the chat's transcript (the message keeps its other words) and is deleted 30 days after you sent it. A health-related chat, and a regulated brand's agent, never ask. When a person from the brand (or the creator, or Clickless's team) replies to you in web chat, their message shows under their first name, and Clickless keeps which of their team sent it.

In web chat, Clickless uses your IP address only in memory, to limit how fast messages can be sent, and doesn't store it. Product pictures in a chat load directly from wherever the brand or its affiliate network hosts them (for example Shopify's image servers). Like any web image, those servers see your IP address and browser, and which picture loaded, but not your messages.

On Instagram, Clickless reads comments on the posts of an account connected to an agent. It reads them to decide whether to send the person who wrote one a single private reply (to the agent's trigger word, or a question about buying). It doesn't keep the comment's words; it keeps the post's id, as where the conversation started.

On Facebook, Clickless reads comments on the posts and ads of a Page connected to an agent, in the same way: to decide whether to send the person who wrote one a single private message in Messenger (to the agent's trigger word, or a question about buying). Where the brand allows it, the Page also posts one short public reply under that comment, a fixed line such as "Just sent you a message with the details." that says nothing about what was asked; a regulated brand's agent never does, and neither does any agent under a comment that mentions a health matter. Clickless doesn't keep the comment's words. It keeps the post's id, as where the conversation started, and keyed hashes of your Page-scoped id, so you get at most one private message every 7 days and one public reply per post. It never hides, edits or deletes comments. Comments that don't ask about buying are left for the Page's team.

When a new Instagram or Messenger message isn't clearly about shopping, Clickless may send its first 300 characters to Anthropic to decide whether the agent should answer or leave it to the account's owner. A message in which Clickless's health check finds a health word is never sent; it's left to the owner. When a message is left to the owner, Clickless keeps none of its words, only your Instagram-scoped id and the time, so the thread shows as left for the owner and the agent stays out of it. When the account's owner writes to you in the Instagram app, or the Page's team in its Facebook inbox, Clickless notes that a person wrote, and when, with your Instagram-scoped id, so the agent stays out of the thread for a while. It doesn't keep what they wrote.

Instagram, Facebook Messenger and WhatsApp messages, and Facebook comments and replies, travel through Meta, and texts through Twilio, and each keeps its own records under its own policy. On Instagram and Messenger, the account or Page you message sees the whole thread in its own inbox, as with any message, and a public reply under a Facebook comment is public, like the comment. Twilio keeps records of texts, including the phone numbers and the words, under its own retention settings. On request, Clickless can ask Twilio to delete a person's texts.

Conversations about health

Clickless's code, not an AI model, checks each message against a list of words about symptoms, conditions, medicines, pregnancy, fertility, sexual health and other health matters. The list can miss words, and Clickless adds to it when it does. A conversation with such words, or one where the agent shows a health-regulated offer such as a telehealth consult, is marked as touching on health, and stays marked.
Health questions get fixed answers. You get product options under a note that the agent isn't a doctor and the answer isn't medical advice, or a suggestion to check with your doctor first. For an emergency or self-harm, you get where to get help, with no products.
Later in that conversation, an AI model may write the agent's replies about products and everyday topics. Clickless's code checks every line it writes, and replaces with fixed words any line that names a condition, a medicine or a crisis, or says a product does something for a health matter. A health-regulated brand's own agent uses fixed words only.
The agent's owner sees that the conversation touched on health and how it ended, never its words. It can't be shared. Its words never reach Clickless's internal alerts or any advertising or analytics tool, and brands never see its search words next to their orders.
To find products, the words of the request are still sent, with contact details removed, to Anthropic for search. From then on, none of the conversation's words go to Voyage AI. In later messages, Anthropic may read the conversation's recent messages to tell what you're asking for, and to write the agent's reply.
The consumer health data privacy policy explains this in full, with your rights over it.

Tapping a recommendation and buying

A tap goes through a Clickless link, which records the tap (which link, and when) against your conversation, and nothing about your device. It then takes you to the brand's site, or to an affiliate network's link that leads there.
When Clickless builds an affiliate network's link, it adds a random code so the network can report the sale back. The code doesn't identify you. Links that a creator or Clickless added by hand go out as they are, with whatever tracking they already carry. Once you leave Clickless, the network and the brand's site may set their own cookies and track your visit, across other sites too, under their own privacy policies.
When you buy, the brand's store or the network tells Clickless about the order: its number, amounts, dates, status, and the Clickless code or discount code on it. Clickless keeps a network's report as it arrives. It can include whether you were a new customer, the device used, and the city, region or country the network has on file for the buyer.
When you tap through from a Clickless agent to a brand's store, the store can tell Clickless when an order is completed, using only the agent's link reference — never your name, email or payment details.
If you start checking out on a brand's Shopify store from its own Product Expert's chat and don't finish, the store tells Clickless the checkout started and what's in the cart (the products and quantities, never your name, email, phone number, address or payment details). The brand's Product Expert may then follow up once in that same chat, with a link back to your cart. It never does this for a creator's, developer's or Clickless's agent, a health-regulated brand, or a conversation that touched on health, and never by text or email.
Clickless doesn't ask stores or networks for your name, email, phone number or address. For Shopify stores, Clickless keeps a keyed hash of the store's customer number, to spot repeated or fraudulent orders. A brand without an automatic connection sends a list of the orders that used its Clickless codes, which Clickless enters.
The brand and the agent's owner see each order's chain: where the conversation started, the search, the offers shown, the tap, the order and how the commission was split. The search shows only the words that also appear in the product's own title, description or category. It shows none when the conversation, the product or the brand touches on health, or when the words name a health matter Clickless's health check recognizes.
If the agent belongs to a performance affiliate, Clickless can send the affiliate's own tracking tool the click id from the affiliate's link, the commission, an order reference and its status.

In web chat you can share one of an agent's answers as a card with a public link. The card shows the agent, its picks and, unless you leave it out, your question (up to 200 characters, with contact details removed). Anyone with the link can open it, and chats started from it are counted for the agent's owner. Answers from a conversation that touches on health can't be shared, and a card stops showing if its conversation later touches on health. To have a card deleted, email Clickless with its link.

Agents built by developers

Developers' own agents and apps use Clickless through its Agent API and MCP server. They send Clickless your shopping request and where it ships (Clickless keeps only the country and region, not a postal code). Sometimes they also send an id that doesn't name you, which Clickless stores only as a keyed hash. Developers are told never to send names, emails, phone numbers or addresses, and Clickless removes contact details from search words before storing them or sending them to its search providers. What the developer's app itself collects from you is covered by the developer's own privacy policy.

Clickless in AI assistants

You can add Clickless to an AI assistant you use, such as Claude or ChatGPT. When your assistant asks Clickless for products, Clickless receives the words your assistant sends for that search and which assistant sent them. Clickless uses the words only to find products during that request. It doesn't store them, doesn't send them to any AI model or other company, and doesn't use them for advertising; nothing from this service goes to Meta or any other ad platform.

If you tap a product link, Clickless records which result was tapped and from which assistant, not who you are, and sends you to the brand's own website, where the brand's own privacy policy applies. If the brand works through an affiliate network, the link passes through that network's tracking link on the way; the network sees your device's IP address and may set a cookie, under its own privacy policy. If you buy, the brand or its network reports the order to Clickless (the products, the amount and, from some stores, a coded customer reference that doesn't identify you) so that Clickless is paid its commission.

If a search describes an emergency or thoughts of self-harm, Clickless answers with crisis resources and runs no search. If it mentions a health condition or a medicine, Clickless shows products under a fixed note to check with a doctor first; it never gives medical advice. Your assistant's own provider handles your conversation under its own terms; Clickless sees only what the assistant sends to it.

Brand staff, creators, managers and developers

Signing in: your email address and a user id. Clickless sends the address a sign-in link or code through Supabase, its sign-in provider, which sends email through Resend. Supabase records each sign-in, with its IP address, in its security log. Signing in records which version of the terms you accepted and which version of this policy you were shown, and when.
Where you came from, for brands: when you sign up a brand, Clickless keeps with it the campaign labels on the link that first brought you to getclickless.ai (its utm and src values, an ad platform's campaign and ad ids, and Meta's click id, fbclid), with the page that link opened and when, if it had any. A new sign-in account also keeps a copy, for as long as the account, so a sign-in link opened on another device still counts. This is so Clickless can tell which ads and posts bring brands. Clickless doesn't send them, or anything else you give it, to Meta or any other advertising platform, except that when a brand account is made Clickless may tell Meta so, with a SHA-256 hash of the account's email address, your IP address and browser, as described under the Meta pixel on marketing pages.
What you do in the portals: the brands you belong to, the agents you create, the offers you publish, and which agreements you accepted and when. For each API key, Clickless keeps only a hash and a few characters from its start and end, so you can tell keys apart.
Teammates and managers: people a brand invites see that brand's information. A creator can let a manager or agency see their earnings, sources and their agent's conversations (never ones that touch on health), approve offers and pause the agent. Clickless keeps invitation links only as hashes, and the name you give a teammate as a label.
Referrals: if you join through another creator's link, or a manager or partner brings you to Clickless, Clickless records who referred you. They see your agent's name and handle, when you joined, and what they've earned from your sales (paid from Clickless's share, not yours). You see who referred you.
Your agent's public page: your agent's name, your display name, the Instagram username you connected, its categories and its picks are public at getclickless.ai/ followed by its handle, and on its share cards. Any developer with a Clickless API key can also read them in Clickless's picks feed.
Your public profile: if you add a profile photo, a description and links to your other accounts or your website, they show beside your agent: in its chat (its header and the About panel), on its public page and share cards, and, for the photo, to brands in their list of the agents that sent them orders. Clickless staff review a photo and new links before they show; until then only you, your managers and Clickless see them. Your device's photo details (such as where and when it was taken) are removed when you upload it, and Clickless records that you confirmed the photo is of you or your brand. The photo, description and links aren't in the picks feed and never reach the agent's conversations. Clickless doesn't collect follower counts. You can remove them in Settings at any time.
Teaching your agent: you can give it websites, links, pasted text, PDFs and CSV files. Clickless fetches the websites and links, and checks them again weekly if you ask. It keeps an uploaded file until it has read it, then deletes the file; it also deletes it if you remove it first. It keeps the text it read, with contact details removed, until you remove the source. The answers drafted from it stay after that, retired, with the short excerpts they quote, so past conversations can show which answer was used. Anthropic reads the files and pages to draft answers, which you approve before your agent uses them. Don't upload other people's personal information.
Your own links: creators can add links of their own, Amazon links included. Clickless counts taps on them against the conversation they were in, and records nothing about the device. It may send a tap on a plain link through an affiliate network, with its random code, as described under tapping a recommendation. Amazon links go straight to Amazon, so Clickless doesn't see those taps.
Getting paid: if you set up payouts, Clickless gives Stripe your sign-in email and user id, and Stripe collects your identity, bank and tax details. Clickless receives your Stripe account's id, its country and status, and which details Stripe still needs, never your bank details. Stripe also uses that information for its own compliance and fraud checks, under Stripe's privacy policy.
Paying Clickless, for brands: brands pay Clickless's fees from a US bank account through Stripe, or through Shopify's billing for stores on Clickless's Shopify app. Stripe or Shopify holds the account numbers. Clickless keeps Stripe's customer and payment method ids and the bank's name with the account's last four digits, or, for Shopify billing, Shopify's subscription id and the usage it charged.
Paying Clickless, for creators: creators who subscribe to a paid plan enter their email and payment details in Stripe's checkout. Clickless keeps only Stripe's customer and subscription ids.
Developers asking for live access: when you asked, and your acceptance of the publisher agreement.
Email lists creators bring in: a creator can bring in an email list they collected for their own marketing, such as their ManyChat subscribers. Clickless keeps only the people on it marked as opted in to email, and for each one the email address, the creator's own labels for them from that list, and when it was brought in. It also records that the creator confirmed each person agreed to hear from them, which wording they confirmed, and when. Clickless only stores the list for the creator: it sends nothing to it, never markets to it, never sells or shares it, never sends it to an advertising or analytics tool, and never gives it to an AI model. The creator is responsible for having each person's consent and for honoring their opt-outs. If you're on a creator's list and want to be removed, ask the creator or email info@getclickless.ai, and Clickless deletes your entry.

The waitlist

While sign-up is invite-only, anyone can join the waitlist at getclickless.ai/waitlist.

What you give: your email address; what you are (a brand, a creator or influencer, an agency or manager, a developer or a media buyer); your brand's website or your main social handle; and a note, if you add one. Clickless also records when you joined and how many times you sent the form. Sending it again updates your answers; you stay on the list once.
Where you came from: the campaign labels on the link that first brought you to getclickless.ai (its utm and src values, an ad platform's campaign and ad ids, and Meta's click id, fbclid), if it had any, so Clickless can tell which ads and posts bring people to the waitlist. They're kept with your answers, for as long as your answers are. Clickless doesn't send them, your address or anything else you give it to Meta or any other advertising platform.
Why: to decide who to invite and when, and to send you your invite. Clickless staff read them. They aren't shown to brands or creators, and aren't used for advertising.
Emails: one email to say you're on the list, then your invite, through Resend. If you tick the box for a few short notes (it starts unticked), Clickless also sends a few short notes about what Clickless does while you wait, each with a way to unsubscribe; it keeps the words you agreed to, their version and when you ticked the box.
To come off the list, reply to any of these emails or write to info@getclickless.ai.

Instagram accounts connected to an agent

When you connect an Instagram professional account to an agent, you do it through Instagram's own login, where you approve each permission. Clickless asks for three:

instagram_business_basic: the account's id and username;
instagram_business_manage_messages: to read and answer direct messages;
instagram_business_manage_comments: to read comments and send one private reply.

Clickless keeps:

the account's Instagram id, the id Instagram gives it for Clickless's app, and its username, to show you which account is connected and to know which agent answers it;
the account's access token, encrypted with a key kept apart from the database and renewed before it expires, so the agent can reply from the account.

Clickless checks that the account is a professional one and doesn't keep its account type. Instagram then sends Clickless the account's direct messages, comments on its posts, taps on its ads and links that open a conversation, and copies of the messages the account sends. Clickless reads only the text of messages: photos, videos, voice notes and reactions are dropped without being kept. It uses the messages to answer as the agent, to stay out of threads a person is answering, and to credit and pay for the sales its conversations lead to. Of the messages the account sends, Clickless keeps only the ids, and a fingerprint (a hash) of the text of its own replies, to tell them apart from a person's. It removes them about three days later, as new replies go out.

Clickless doesn't sell Instagram data, use it for advertising, or give it to data brokers.

If you disconnect the account in Clickless, or remove Clickless in Instagram's settings, the agent stops answering there at once and Clickless deletes the access token. When you disconnect in Clickless, it also asks Instagram to stop sending the account's messages and comments. Past conversations stay, so you can read them, as described under how long Clickless keeps information.
You can ask for the account's data to be deleted through Instagram or Meta, or by email. Clickless then deletes the connection, the words of every message in your agent's Instagram conversations, the Instagram ids of the people in them and its records of the messages it sent. Records of sales stay. How to ask, and how to check a request: getclickless.ai/legal/data-deletion.

Facebook Pages connected to an agent

A brand can connect its Facebook Page to its agent, through Facebook's own login, where it approves each permission and picks the Page. Clickless asks for six:

pages_show_list: the Pages the login can manage, so you can pick one;
pages_messaging: to read and answer the Page's Messenger messages, and to send one private message to someone who commented;
pages_manage_metadata: to have Facebook send the Page's messages and comments to Clickless, and to stop that when you disconnect;
pages_read_engagement and pages_read_user_content: to read comments on the Page's posts and ads;
pages_manage_engagement: to post the one short public reply under a comment the agent answered.

Clickless keeps:

the Page's id and name, to show you which Page is connected and to know which agent answers it;
the Facebook id Facebook gives the person who connected the Page for Clickless's app, to act on a removal or deletion request from them;
the permissions the login granted;
the Page's access token, encrypted with a key kept apart from the database, so the agent can reply as the Page.

Facebook then sends Clickless the Page's Messenger messages, taps on its buttons, taps on its ads that open a conversation, copies of the messages the Page sends, and comments on its posts and ads. Clickless reads only the text of messages: photos, videos, voice notes and reactions are dropped without being kept. It uses them, as on Instagram, to answer as the agent, to stay out of threads the Page's team is answering, and to credit and pay for the sales its conversations lead to. It reads a comment only to decide whether to answer it, and doesn't keep its words. Of the messages the Page sends, Clickless keeps only the ids, and a fingerprint (a hash) of the text of its own replies, and removes them about three days later. The public replies are fixed lines; Clickless keeps only that one was posted, as a keyed hash.

Clickless doesn't sell Facebook data, use it for advertising, or give it to data brokers. Nothing from a conversation goes to Meta beyond what it needs to deliver the agent's reply.

If you disconnect the Page in Clickless, or remove Clickless in Facebook's settings, the agent stops answering there at once and Clickless deletes the access token. When you disconnect in Clickless, it also asks Facebook to stop sending the Page's messages and comments. Past conversations stay, so you can read them.
You can ask for the data to be deleted through Facebook or Meta, or by email. Clickless then deletes the connection of every Page you connected, the words of every message in those agents' Messenger conversations, the Page-scoped ids of the people in them, its records of the messages it sent and the keys that limited private and public replies. Records of sales stay. How to ask, and how to check a request: getclickless.ai/legal/data-deletion.

Brands that connect a Shopify store

When a brand connects its store, through Clickless's Shopify app or its own custom app, Clickless keeps:

the store's name, its myshopify.com address and primary domain, its Shopify id, its currency and whether it's a development store;
the store's published products (titles, descriptions, prices, images, variants and stock), so agents answer from the current catalog;
each product's average star rating and number of reviews, from the rating fields the store's review app writes, never the reviews' words or who wrote them;
the discount codes Clickless creates in the store for agents' offers;
the store's access tokens, encrypted with a key kept apart from the database;
the store's orders that carry a Clickless code or token, as described above. Clickless doesn't ask Shopify for customers' names, emails, phone numbers or addresses, and doesn't store them. For every new order it keeps a short mark (the order's id, and whether it carried a Clickless code) for 120 days, then deletes it.

When staff accept the brand agreement inside Shopify, Clickless records a keyed hash of the store and their Shopify user id, not the id itself.

When a store uninstalls Clickless:

its access tokens are deleted at once, and its offers stop;
two days later Shopify asks Clickless to delete the store's data. Clickless deletes the stored Shopify messages and the customer-linked parts of order records. It cuts each product it copied down to its title, price and category, and takes it out of search. Records of sales stay, and point at those products.

When Shopify asks Clickless to delete a customer's data, Clickless removes the hash of their customer number. When a store asks for a customer's data, Clickless sends the store what it holds about that customer's orders within 30 days.

The AI visibility scan

The website you scan. To check it, Clickless fetches its public pages the way any visitor could: the home page, robots.txt, llms.txt, the sitemap and, for a Shopify store, its public product list.
To get your report, the email address you give us. Clickless keeps it as a lead, with the website and brand name you scanned, when you asked, how your scan went, the line shown under the email field and its version, and where you came from: the campaign labels on the link you followed (its utm and src values, an ad platform's campaign and ad ids, and Meta's click id, fbclid), and the first page that link opened on getclickless.ai and when. It keeps the address even if the scan doesn't run. It isn't a sign-in: no account is made.
Clickless emails you your report, then a few short notes about what Clickless does for brands, through Resend. The line under the email field says so: "We'll email your report and occasional updates. Unsubscribe anytime." Every one of these emails has an unsubscribe link and a one-click unsubscribe; unsubscribing stops them for that address, whichever stores it scanned. Clickless doesn't send the website you scanned, your brand's name or your report to Meta or any other advertising platform. When you ask for a report, Clickless may tell Meta a report was requested, with a SHA-256 hash of your email address (never the address itself), your IP address and browser, as described under the Meta pixel on marketing pages.
Your report opens in the browser that asked for it (a cookie holds its private key) and from the link in your report email.
If you were already signed in to Clickless with a work email at that website's domain, the scan runs without asking for an email and is kept with your account.
A keyed hash of your IP address, kept with the scan and used only to limit how many scans one place can run.
The scan sends your website's public text (its title, description, headings and product names, prices and descriptions) to Anthropic, to work out what you sell and to write a preview of your brand's own agent. The AI assistants it measures (those of Anthropic, OpenAI, Google, Perplexity and xAI, but only the ones Clickless has set up) receive only general shopping questions, never your email or other personal information.
Your report is shown only to you (the browser that asked and your report email's link), to people signed in with an email at the same website's domain, to members of that brand on Clickless, and to Clickless staff.

Text messages and WhatsApp

You start a conversation by texting an agent's number. That's your request for replies: the agent texts you only to answer your messages, and Clickless sends no marketing texts. Message and data rates may apply.
Reply STOP (or STOPALL, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE) and that number stops texting you at once; reply START to opt back in. Reply HELP for who is texting, how to reach Clickless and how to stop.
Clickless keeps a record of your consent: your number as a keyed hash, how and when you last opted in, when you last opted out, and when you were last told how to stop. A new opt-in replaces the earlier dates. Clickless doesn't delete these records on a schedule.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are not shared with any third party.
On WhatsApp, the agent only answers your messages and never writes first. Reply STOP or UNSUBSCRIBE and it confirms, then sends nothing more unless you write to it again.

Emails

Clickless sends sign-in emails (a link and a code) through Supabase, delivered by Resend: to sign in, and to open a report a signed-in scan finished after you left the page.
Clickless also emails creators about their plan: when their agent has answered 80% and all of the people their plan includes in a month; a notice before creator plans start; and, once they start, a plan confirmation, the free trial's last days and failed payments. These go through Resend, which receives your email address for each one; Clickless looks the address up from your sign-in each time.
After you sign up (as a brand, a creator, a developer or a manager), Clickless sends a short series of emails that shows how each part of Clickless works, at most one a day. If you run the AI visibility scan with your email, Clickless emails you your report and a few short notes about what Clickless does for brands, as described under the AI visibility scan, and keeps the line you were shown and its version. These go through Resend, which receives your email address for each one; Clickless looks the address up from your sign-in (or, for the scan, the lead it kept) each time. Resend tells Clickless when one is opened, clicked, bounces or is marked as spam, which Clickless keeps with the email it was about.
Every one of these emails has an unsubscribe link and a one-click unsubscribe, and an email preferences page where you can turn each kind off. Clickless honors it at once. Sign-in, billing, payout and plan emails are about your account and still send.
If you join the waitlist, Clickless emails you to say you're on the list and later sends your invite, and, only if you ticked the box for them, a few short notes, as described under the waitlist.
Clickless doesn't sell or rent email addresses.

AI and automated agents

Agents are AI software, not people. Each one's first message says whose product expert it is. Asked whether it's a person or an AI, it says plainly that it's an AI, and it never claims to be a person. It says it's an AI again if it picks up a thread after a person replied. On Instagram and Facebook, an agent's owner may sometimes answer you themselves, from their own inbox.
Anthropic's Claude models decide how to answer messages, write some of the agents' replies and recommendation lines, sort new Instagram and Messenger messages, rank search results, read owners' sources and run the visibility scan. Voyage AI receives search words, with contact details removed first and no id attached, and turns them into a form Clickless's search uses to find matching products. Search words in which Clickless's health check finds a health word, and every search in a conversation that touches on health, don't go to Voyage AI. OpenAI, Google, Perplexity and xAI (each only when Clickless has set it up) receive only general shopping questions, for the visibility scan.
Clickless doesn't train AI models on your personal information. Under their published terms, Anthropic and OpenAI don't train their models on what is sent through their APIs by default. The scan sends Google, Perplexity and xAI only general shopping questions, with nothing about you. Voyage AI's terms let it keep what it receives and use it to train its models unless the customer opts out.
Clickless makes no decisions about you that have legal or similarly significant effects. Agents recommend products; you decide.
Agents can be wrong. Their answers aren't medical, legal or financial advice; check with the brand before you buy.

How Clickless uses personal information

To run the service: conversations, search, recommendations, checkout links, attribution, commissions, payouts and billing.
To keep it safe: fraud checks, limits on abuse, and security.
To support you and answer requests.
To show owners and brands how their agents and offers perform (counts, costs, conversions), and to improve the service.
To send the emails described under emails, including the report and the few notes about Clickless that people who ran the scan get (marketing to businesses, which they can stop any time).
To meet legal, tax and accounting obligations, and to enforce Clickless's terms.
To measure and show Clickless's own ads to businesses, through Meta's pixel on some of its marketing pages, as described under the Meta pixel on marketing pages.

Clickless doesn't use shoppers' personal information for advertising, and doesn't build profiles of shoppers. The only personal information used for advertising is what Meta's pixel collects on Clickless's own marketing pages, and the hashed email address, IP address and browser sent with a website scan request or a brand sign-up there, for Clickless's own ads.

Who receives personal information

Service providers, which process it on Clickless's behalf under their terms of service and, where Clickless has accepted them, their data processing terms:

Supabase (database and sign-in), Vercel (website), Fly.io (API, MCP server and background worker) and Inngest (background jobs; queued messages reach it only encrypted). Like any host, they keep request logs, which include IP addresses.
Anthropic, OpenAI, Google, Perplexity and xAI, as described under AI and automated agents.
Twilio (text messages), Resend (emails) and Google (Clickless's email inbox).

Telegram carries Clickless's internal alerts to its staff. The alerts name brands, stores and agents and link to records in Clickless's admin. They never carry the words of a message or anyone's contact details.

Voyage AI receives search words, as described under AI and automated agents, and handles them under its own terms.

Platforms you or a business use with Clickless, which also use information under their own privacy policies:

Meta, which carries Instagram, Facebook Messenger and WhatsApp messages, and Facebook comments and replies.
Stripe, for payouts and payments.
Shopify, for store connections and billing.

Meta, as an advertising partner: where Meta's pixel runs on Clickless's marketing pages, Meta receives the visits and events described under the Meta pixel on marketing pages, and, for a website scan request or a brand sign-up, a hashed email address, IP address and browser from Clickless's servers. It uses them under its own terms.

Others:

Brands see the orders their offers produced, which agent earned on each (its public name and approved photo), how each was attributed, and how its commission was split: the agent's share, any referrer's override and Clickless's.
An agent's owner, and the teammates and managers they invite, see the agent's conversations (except ones that touch on health) and its earnings.
A creator sees and can export the list their keywords built (the emails and numbers people chose to leave, with the words they agreed to and when), and Clickless passes each new one, and each unsubscribe, to the email tool the creator connects (Klaviyo, Mailchimp or the creator's own system), which use them under the creator's account and the creator's own privacy policy.
Affiliate networks receive Clickless's random code on their links, and performance affiliates' tracking tools the details described above.
Anyone can see agents' public pages, chat headers and share cards, with a creator's approved photo, description and links, and any developer with a Clickless API key can read the picks feed.
Authorities or others, when the law requires it, or to protect people's safety or Clickless's rights. A company that buys or merges with Clickless would receive the information, under this policy.

Clickless doesn't sell personal information, and it doesn't share it with others for their own direct marketing. The only sharing for cross-context behavioral advertising, or use for targeted advertising, is Meta's pixel on Clickless's own marketing pages, described below, which you can turn off. Nothing anyone tells an agent is ever shared for advertising.

The Meta pixel on marketing pages

Clickless may use Meta's pixel, a script from Meta, on some of its own marketing pages, to measure and show Clickless's own ads to businesses on Facebook and Instagram.

Where it can run: only on these pages of getclickless.ai: the home page, /brands, /media-buyers, /pricing, /how-it-works, /creators, /agent-developers, /managers, /affiliates, the /compare pages, /waitlist, the website scan's form at /scan (not the reports it opens), the sign-in page when it's headed to the brand portal, and /welcome, which a new brand account passes through on its first sign-in.
Where it never runs: in agent chats (getclickless.ai/a/…), on agents' public pages and share cards, in the brand portal, the creator studio, the developer portal or Clickless's admin, on email preference and unsubscribe pages, on these legal pages, in the Shopify app, on claim pages and scan reports, or on any link that hands a shopper to a brand's checkout. Nothing anyone writes to an agent, about health or anything else, is ever sent to Meta or any other advertising platform.
What it tells Meta: that one of those pages was visited, with the page's address and the page you came from; that a website scan's report was requested, or that the brand sign-up was opened from one of Clickless's ads ("Lead"); and that a brand account was made ("CompleteRegistration"). Each carries a random id and nothing else from the page: never your email address, name or phone number, the website you scanned, or anything you typed. Clickless doesn't use Meta's automatic advanced matching, and sends Meta no customer lists.
From Clickless's servers, for the same two events only: when you ask for a website scan's report or make a brand account on Clickless's own site, Clickless may send Meta that event with the same random id, a SHA-256 hash of the email address you gave (trimmed and lowercased; Meta gets the hash, never the address), your IP address, your browser, and Meta's own cookie ids if your browser has them, so Meta can measure Clickless's own ads. Never your name, phone number, the website you scanned or anything else, never page views, and never for anyone chatting with a Product Expert, in the portals or about a brand's customers. "Your privacy choices" and Global Privacy Control stop this too.
What Meta gets on its own: like any script from another company, the pixel gives Meta your IP address, your browser and device details and its own cookies (listed under cookies), and reads Meta's click id from the link if you came from a Meta ad. Meta uses this under its own terms and privacy policy, and may connect it to a Facebook or Instagram account you have.
Why: to count how Clickless's ads to businesses do, and to show them to businesses likely to want Clickless. State privacy laws may call this "sharing" personal information for cross-context behavioral advertising (ads based on what you do on other companies' sites and apps), or "targeted advertising".
Your choice: "Your privacy choices" at the bottom of those pages turns Meta's pixel, and the server's copy of its events, off in that browser, and a Clickless cookie remembers it for a year. If your browser sends Global Privacy Control, the pixel never loads and the server sends nothing. You can also email info@getclickless.ai.

Cookies

Clickless's own cookies only run the service: none of them is an advertising or analytics cookie. Nothing in agent chats, agents' pages, share cards or the portals sets or reads an advertising or analytics cookie. The only advertising cookies are Meta's, set by its pixel on the marketing pages where it runs.

Signing in: Supabase's session cookie keeps you signed in (up to 400 days). During sign-in, cookies hold the address the code was sent to and where to go next, for an hour, and a mistyped address for a minute, so the form can show it again.
Where you came from: if the link that first brought you to getclickless.ai carried campaign labels (utm and src values, an ad platform's campaign and ad ids, Meta's click id), a cookie keeps them, with the page that link opened and when, for 30 days so a later waitlist sign-up, website scan or brand sign-up can be credited to that link. It's Clickless's own: no advertising platform reads it, and it's set only once, so a later link doesn't replace it.
The scan: the private keys of the reports this browser asked for (up to 10, for 90 days), and the address and website a report's "Start your free 7-day test" fills in on the sign-in or waitlist form, for an hour.
Web chat: a random visitor id (one year; Clickless stores it only as a hash) and the open conversation (24 hours).
The portals: the brand, agent and environment you picked (up to a year), and an invitation or referral link you followed (7 or 30 days).
Connecting Instagram, a Facebook Page or Shopify: a security code for the connection, for 10 minutes. When a Facebook login can manage several Pages, its access token, encrypted, for the same 10 minutes while you pick one.
Your privacy choices: if you turn Meta's pixel off, a cookie remembers that for a year. A new brand account's first sign-in, where the pixel runs: a random event id and where to go next, for 10 minutes.
Meta's pixel, only on the marketing pages under the Meta pixel on marketing pages: Meta's cookies _fbp, a random id for this browser, and, if you came from a Meta ad, _fbc, which holds Meta's click id, each for 90 days. Turning the pixel off removes them for this site.

Web chat also keeps, in your browser's local storage, the ids of the agent's opening lines you've seen (up to 50), so each is counted once for the agent's owner.

Brands' sites and affiliate networks set their own cookies after you tap a link, as described above.

How long Clickless keeps information

Account information: while your account is open. On request Clickless deletes it, except what it must keep, such as records of agreements, payments and sales.
Conversations: in conversations that touch on health, the words people wrote and the agent's model-written replies are deleted 30 days after they were sent. Clickless doesn't delete other conversations on a schedule yet: it keeps them until you, or the agent's owner, ask Clickless to delete them. An Instagram or Facebook data deletion request removes the words, as described above.
Instagram and Messenger threads left for the account's owner: your Instagram- or Page-scoped id and the time, with the thread, until a deletion request.
An email or phone number you left when you asked for a person: 30 days after you sent it, then deleted.
An email list a creator brought in: until the creator removes it or a person on it, the creator's account is closed, or someone on it asks Clickless to delete them. Clickless deletes that person's entry then.
A creator's list built by their keywords: each entry, with its consent record and whether you unsubscribed, until the creator removes it or their account is closed, or you ask Clickless to delete it. An unsubscribe is kept for as long as the entry is, so it keeps being honored.
Share cards: until you or the agent's owner ask Clickless to delete one.
Records of sales: order, commission and payout records, and the records behind each sale (where the conversation started, the offers shown and tapped, store and network order reports, and referral and plan records). Clickless keeps them for at least seven years, for tax and accounting. Its ledger is append-only: a correction is a new entry.
Instagram: the access token until the account is disconnected, the connection until a deletion request, and the ids and fingerprints of the agent's replies until they're removed about three days later, as new replies go out.
Facebook Pages: the same as Instagram. The keyed hashes that limit private messages and public replies per person and post: until a deletion request for the Page.
Shopify: as described above.
What you teach your agent: an uploaded file until Clickless has read it, and the text it read until you remove the source. The answers drafted from it, with their short excerpts, stay after that.
Your public profile: the photo, description and links until you remove them or ask Clickless to delete them. A photo you replace or remove, or one Clickless doesn't approve, is deleted at once, and a record of the upload without the image is deleted within two days (it lets Clickless count the day's uploads); after you remove your profile, that record no longer carries anything that identifies the photo. A removed photo can stay in browser and network caches for up to a day, and copies other people or sites saved are outside Clickless's control.
The waitlist: your answers until 30 days after you sign up with your invite, then deleted, or sooner if you ask Clickless to remove them.
Scan leads and scans: the email, website and brand name, where you came from, whether you unsubscribed, and each scan's record (its address and the hash of the IP address), until you ask Clickless to delete them. An unsubscribe is kept for as long as the address is, so it keeps being honored.
Text message consent records: Clickless doesn't delete them on a schedule.
Records of deletion requests: kept, so you can check a request's status.
Cookies and browser storage: as listed above.

Deleted information can stay in the database provider's backups until they're replaced.

Your privacy rights

Wherever you live in the United States, you can ask Clickless:

what personal information it holds about you, including what it has inferred (such as the mark that a conversation touched on health);
where that information came from, why it's used and who received it;
for a copy you can take elsewhere;
to correct it;
to delete it;
to stop sharing it for cross-context behavioral advertising, or using it for targeted advertising. The only such sharing is Meta's pixel on Clickless's marketing pages and the server's copy of its scan and sign-up events: "Your privacy choices" at the bottom of those pages, or Global Privacy Control, turns both off, or email Clickless. Clickless doesn't sell personal information or use it for profiling.

Clickless uses sensitive personal information, such as what you say about your health, only to give you what you asked for, so there's nothing further to limit. It won't treat you differently for using any of these rights.

Your browser's Global Privacy Control signal is honored as a request to opt out of the sale and sharing of your personal information: in a browser that sends it, Meta's pixel never loads on Clickless's pages, and Clickless's servers send Meta nothing for a scan request or sign-up made from it. Clickless doesn't sell personal information.

How to ask

Email info@getclickless.ai, saying what you'd like.

If you have an account, write from the email address you sign in with. Clickless may confirm by email before acting.
If you chatted with an agent, Clickless doesn't know who you are, so it asks for something that finds your conversation and shows it's yours. On Instagram, Messenger, texts or WhatsApp, it gives you a short code to send to the agent from the same account or number. On web chat, tell Clickless the agent, when you chatted and what you asked about. Clickless deletes a conversation it can match with reasonable confidence, but sends a copy only when it can be sure it's yours. If it can't match your request, it tells you why. It uses what you send only for the request.
Someone you authorize can ask for you, with your signed permission. Clickless may still confirm with you directly.

Clickless confirms it received your request within 10 business days, and answers within 45 days. If it needs longer, it tells you why, and takes at most 45 more days. Requests are free.

Appeals

If Clickless turns down your request, fully or partly, reply to its answer and say you're appealing. Clickless will answer in writing within 45 days, explaining its decision. If it still says no, you can contact your state's attorney general; Clickless's answer will say how.

Categories of personal information

These are the categories state privacy laws use, with where each comes from and who receives it. Clickless's purposes are those under how Clickless uses personal information, and how long it keeps each is under how long Clickless keeps information.

Identifiers: email addresses, user ids, hashed visitor, phone, customer and IP address ids, Instagram- and Page-scoped ids, connected Instagram account ids and usernames, connected Facebook Page ids and names, and Stripe ids. From you, Meta, Shopify and Stripe. Received by service providers, and, for a connected account's username, anyone. On the marketing pages where Meta's pixel runs, Meta's cookie ids and your IP address, and, for a website scan request or a brand sign-up, a SHA-256 hash of the email address given, received by Meta.
Customer records: your email address, and for a brand the bank's name with the account's last four digits. From you and Stripe. Received by service providers and Stripe.
Commercial information: offers shown and tapped, orders, commissions, payouts, plans and fees. From you, brands, affiliate networks, Shopify and Stripe. Received by service providers, the brand and the agent's owner.
Internet activity: messages to agents, taps on links, and how you use the portals. From you. Received by service providers, Voyage AI (search words only, never from a conversation that touches on health), and the agent's owner (except conversations that touch on health). On the marketing pages where Meta's pixel runs, the pages visited and the two events described there, received by Meta; never messages to agents.
Approximate location: the country and region an order ships to, from developers' agents, and the city, region or country in an affiliate network's order report. From developers and affiliate networks. Received by service providers, and, for where an order ships, the brand and the agent's owner.
Professional information: your role at a brand, the brands you work with, and your agent's public profile, including the photo, description and links you add. From you. Received by service providers, your teammates and managers, brands your agent sold for (the photo), and, for public profiles, anyone.
Inferences: the mark that a conversation touched on health, and fraud-review signals about an agent's sales. Made by Clickless. Received by service providers, and, for the health mark, the agent's owner and the people they invite (the mark only, never the words).
Sensitive personal information: health-related messages, and the mark that a conversation touched on health. From you, and inferred by Clickless. The messages are received by service providers only; the mark is also shown to the agent's owner and the people they invite.

Clickless hasn't sold personal information. The only personal information it shares, or may share, for cross-context behavioral advertising is the identifiers and internet activity Meta's pixel collects on Clickless's own marketing pages, and the hashed email address, IP address and browser sent with a website scan request or a brand sign-up there, received by Meta.

Children

Clickless isn't meant for children under 13, and accounts are for people 18 and older. If Clickless learns it holds personal information from a child under 13, it deletes it; email info@getclickless.ai if you think it does. Agents Clickless hosts never show age-restricted offers; developers' agents can show them only when they tell Clickless they've verified the person's age.

Security

Information is encrypted in transit, and the database is encrypted at rest.
Store and messaging access tokens are encrypted with keys kept apart from the database, and messages waiting for the background worker are encrypted too.
Visitor ids, phone numbers and customer numbers are stored only as keyed hashes, and API keys and invitation links as hashes.
Clickless's own logs record ids and counts, never message words or contact details.
Access to Clickless's admin is limited to named staff.

No system is perfectly secure. If a breach affects your personal information, Clickless will tell you as the law requires.

Where information is stored

Clickless's database and servers are in the United States: the database in Oregon and the servers in California and Oregon. Clickless doesn't offer its service in the European Union or the United Kingdom.

Changes

This policy took effect on the date at the top of this page. Clickless posts each new version here, and emails account holders about material changes before they take effect. It won't use information it already holds in a materially different way without asking you first.

Contact

Clickless, LLC, 4979 MT HWY 1, Hall, MT 59837. Email info@getclickless.ai.