Privacy Policy

Effective Date: May 22, 2026

1. About This Policy

This Privacy Policy explains how Clinket collects, uses, shares, stores and protects personal data in India. It applies to the Clinket customer and provider websites and mobile apps, the AI Assistant phone service, Outbound calls, Ask Clinket, Clinket messages and emails, and every other Clinket service that links to this Policy (together, the "Platform").

It applies to everyone whose personal data we handle: customers who look for and book services; providers (businesses that offer services) and the people who run them; team members invited to a provider's business; people who phone a business's AI Assistant line; contacts a business calls through Outbound calls; people whose business we list from public information; and visitors to our websites and apps.

For most of the processing in this Policy, Clinket is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"): we decide why and how your personal data is processed. When a business uses Clinket to keep its own contacts, call them, store its documents or keep records about its own customers, the business decides why that data is used, and Clinket processes it on the business's behalf as a Data Processor (see Section 17).

We follow the DPDP Act and DPDP Rules as their provisions come into force, and until then the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, together with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020 where they apply. This Policy is available in English, Hindi and Gujarati. If you need it in another language listed in the Eighth Schedule to the Constitution of India, write to legal@clinket.com.

2. The Short Version

We collect the personal data needed to run the Platform: your account details, the bookings, quotes, messages and invoices you create, and, for businesses, their profile, team and calls.
When a business turns on the AI Assistant, calls to its Clinket number can be answered by an AI, recorded, transcribed and summarised. Callers hear a notice at the start. Recordings, transcripts and summaries are kept for 90 days.
We do not sell personal data. We do not use your messages or documents to train AI models. We use call recordings, transcripts and summaries to improve our AI only when the business that received or made the call allows it, and our AI provider does not use any of them to train its models.
We do not create voiceprints. Callers are recognised by their phone number, never by their voice.
Your data is stored in India. Some processing happens in other countries, mainly AI processing in the United States and Sweden. Section 11 explains this.
You can access, correct, complete and erase your data, withdraw consent, nominate someone, and complain to our Grievance Officer and then to the Data Protection Board of India.

3. Personal Data We Collect and Why

This section lists each kind of personal data we process and the purpose we use it for. We use personal data only for the purposes listed here, or for purposes that are compatible with them and allowed by law.

3.1 Your account and sign-in

What: your name, email address, mobile number, language, the way you sign in (password, one-time code by SMS, WhatsApp or email, passkey, or Google, Facebook or Apple sign-in), your passwords in protected (hashed) form, the public part of any passkey you register, your signed-in devices and sessions, and a record of sign-in attempts including the IP address and browser or app details.
Why: to create your account, sign you in, keep your account secure, stop misuse, and contact you about your account.
If you sign in with Google, Facebook or Apple, we receive your name and email address from that provider. If you sign in with WhatsApp, we send your one-time code through WhatsApp; WhatsApp sign-in never creates an account on its own.

3.2 Customers

What: saved addresses, the services you search for and view, your cart, bookings, quote requests ("Get Quotes"), quotes you receive, invoices, reviews, photos you add, messages with providers, and your notification and marketing choices.
Why: to show you services near you, send your requests to suitable providers, let you book, message and pay providers where payments are available, show your history, send you updates about your bookings, and handle problems and disputes.
A business may also create a booking, quote or invoice for you, for example after you phone it. If you later prove that your phone number or email address is yours, those records are linked to your account. If a booking or invoice is not yours, you can tell us using "This isn't my booking" or "This isn't my invoice".

3.3 Providers and businesses

What: business name and description, the business email, phone and address (with its map location), service areas, Locations, opening hours, services and prices, offers, photos and portfolio, licences or certificates you upload, tax details you give us, your public page name, and your plan, add-ons and billing history.
Why: to build and show your public Clinket page, place you in search results, send you Customer requests, manage your bookings, quotes, invoices, contacts and calendar, bill you for your plan, and support you.
Public information: your business name, business email, business phone, address and map location, hours, services, prices, photos and reviews are shown publicly on your Clinket page and may be shown by search engines and AI assistants. Do not put personal details on your public page that you do not want to be public.

3.4 Team members

What: your name, email address and phone number, your roles, teams and Locations, when you joined, whether you are active, suspended or removed, and the work assigned to you.
Why: to let the Primary owner manage who can do what in the business, route work and messages, and keep a history of who did what.
Your name, email and phone number are visible to the people in the business whose role lets them see the team, such as the Primary owner, Administrators, Operations managers, Dispatchers and Read-only auditors. The business keeps an activity history of actions taken in its account, showing the name of the person who acted. When a business uses the AI Assistant, the AI may know team members' first names so it can respond when a caller asks for someone by name.

3.5 People who call a business's AI Assistant line

What: your phone number, the call time and length, the call recording (if the business has recording on), a written transcript, an AI summary, the languages spoken, and anything you choose to tell the AI, such as your name, address, the service you need, or a message for the business.
Why: to answer the call on the business's behalf, book or reschedule appointments, prepare quotes, take messages and callback requests, send you the details you ask for, and give the business a record of the call so it can follow up.
Section 6 explains call recording, transcripts and how callers are recognised.

3.6 Contacts called through Outbound calls

What: the name and phone number the business holds for you, the details the business chooses to share with its AI Assistant for the call (for example an appointment reminder or a past booking), the call result, your answers to the business's questions, any callback you ask for, and any request to stop calls.
Why: to place the call the business asked for, record the outcome for the business, and make sure stop requests are always respected.
In India, Outbound calls may be used only for service and transactional calls, never for promotional calls.

3.7 Businesses listed from public information

What: for a business that is not yet on Clinket, we may prepare a listing from information the business has made publicly available online, such as its name, business contact details, address, services, prices, opening hours, photos and the name of the owner where it is publicly shown. We record where each item came from.
Why: to help customers find local services and to invite the business to claim and manage its listing.
These listings are marked as set up by Clinket. We use AI to help check and tidy the information. Until the business claims the listing, we contact it by email only, never with marketing, and every email has a link to stop further emails. The business can claim the listing, correct it, or ask us to remove it. Anyone can use "Report wrong info" on the listing.

3.8 Website and app visitors

What: device and browser details, a shortened IP address, your language, the pages you visit, and your approximate location if you allow it. See Section 8 for analytics.
Why: to run and protect the websites and apps, understand how they are used and improve them.
If you use "Tap to talk" on the AI Assistant website, you speak with an AI in your browser. That conversation is not recorded and no transcript is kept; only the callback details you give and a short summary are sent to the Clinket team so we can get back to you. Some public forms are protected by Google reCAPTCHA, which checks for automated misuse.

3.9 Payments and billing

What: your plan, add-ons, minute packs, invoices and payment history; for cards, only the card brand, last four digits and expiry date; for UPI AutoPay, your UPI ID, the app name and the mandate details. If you receive payouts, your bank account number, IFSC, PAN and the details of the people who must be named go directly to our payment processor, Razorpay, for its checks.
Why: to charge for subscriptions, the AI Assistant add-on and minute packs, take payments for bookings where that is available, pay providers, keep tax and accounting records, and prevent fraud.
Clinket never stores full card numbers, CVV or UPI PINs. Payment details are entered in Razorpay's secure fields.

3.10 Messages and notifications

What: messages, photos and files you send through Clinket, and the record of messages we send you by email, SMS, WhatsApp and push notification, including whether they were delivered.
Why: to let customers and businesses talk to each other and to keep you informed about your bookings, quotes, invoices, calls and account.
Messages are stored in encrypted form. If an address or number cannot receive messages, we keep a short record of that so we stop sending to it.

3.11 Ask Clinket and business documents

What: documents a business uploads (such as price lists, menus or brochures), the text read from them, the questions team members ask in Ask Clinket and the answers.
Why: to let a business ask questions about its own documents and data, and to let the AI Assistant answer callers from the business's own information.
Ask Clinket only shows a team member what their role allows. Answers are produced by AI and can be wrong.

4. Where Personal Data Comes From

From you, when you create an account, book, message, call, upload or fill in a form.
From businesses that use Clinket, when they create a booking, quote or invoice for you, save you as a contact, invite you to their team, or ask their AI Assistant to call you.
From your calls, when you phone a business's AI Assistant line or answer an Outbound call.
From public sources, for listings of businesses that are not yet on Clinket.
From sign-in providers (Google, Facebook, Apple, WhatsApp) when you choose to use them.
From phone carriers and payment processors, such as caller numbers, delivery reports, number checks and payment results.
From your device, such as device type, app version and, if you allow it, approximate location.

5. Consent and Legitimate Uses

We process your personal data either with your consent or for a legitimate use allowed by Section 7 of the DPDP Act.

Consent: we ask for your consent when you create an account and accept this Policy, when you choose optional features (for example analytics cookies, marketing messages or location), and in other cases where the law requires it. We ask in clear words, for a specific purpose, and we record your choice.
Legitimate uses: we also process personal data that you give us voluntarily for a specific purpose where you have not said you object (for example, the details you give a business's AI Assistant to book an appointment), to meet our legal obligations, to comply with court orders and lawful requests, and to respond to emergencies that threaten someone's life, health or safety.

Withdrawing consent: you can withdraw consent as easily as you gave it: change your cookie choices in Cookie Preferences, turn off marketing in your notification settings or with the unsubscribe link, reply STOP where offered, or write to legal@clinket.com. Withdrawal does not affect processing done before it. After you withdraw, we stop the processing that relied on that consent, unless the law requires or allows us to keep the data. If you withdraw consent that is needed to provide a service, we may no longer be able to provide it.

6. Calls: AI Assistant and Outbound Calls

6.1 Calls to an AI Assistant line

A business that uses the AI Assistant has a Clinket phone number. Depending on the business's settings, the call may ring the business first and be answered by the AI if nobody answers, or be answered by the AI straight away.
At the start of the call, before anything else, callers hear a notice that the call may be recorded and may be answered by an AI assistant. The AI Assistant identifies itself as an AI, and businesses are not allowed to set it up to claim to be a person.
Recording is on by default; the business can turn it off. When it is on, the whole call after the notice is recorded, including any part where a person from the business talks to you, and any voicemail.
Transcripts and summaries: the conversation is turned into a written transcript, and our AI writes a summary with suggested next steps for the business, such as a draft booking, quote or new contact. The business can watch the transcript live and can join the call.
If a business has paused its AI, uses its private mode, or has used up its minutes, the call is simply passed to the business: nothing is recorded, transcribed or summarised, and no notice is played.

6.2 Recognising callers

When you call an AI Assistant line, we check your phone number against the business's own contacts and against Clinket accounts. If we find a match, the AI is given your name (and, where held, your email address) so it can greet you by name, find your bookings and save the call correctly, and the business sees who called. We recognise callers only by phone number. We do not create voiceprints or any other biometric identifier, and we do not identify people by their voice.

6.3 Outbound calls

With Outbound calls, the business is the caller: it chooses who to call and why, and Clinket provides the tool. The AI Assistant says at the start that it is an AI and names the business it is calling for. Nothing about the reason for the call is shared until the person confirms who they are.
If the business has recording on, the call is recorded only after you have heard the notice that the call is recorded.
You can ask the AI to stop calling you at any time, and it will record your request immediately. A stop request is always honoured: it blocks future calls from that business, and a request never to be contacted blocks all messages from that business to your number. Clinket also keeps its own platform-wide stop list.
Clinket checks stop lists, permitted calling hours in your local time and limits on how often a number can be called. Clinket does not check the national customer preference register (DND / NCPR); the business is responsible for following the rules of the Telecom Regulatory Authority of India and any other law that applies to its calls.

6.4 What we do not do with calls

We use call recordings, transcripts and summaries to improve our AI only when the business that received or made the call has left on the setting “Use call recordings to improve the Clinket AI assistant” in its AI Assistant settings; the business can turn it off at any time. We never sell them, share them with other businesses or use them for advertising, we do not use messages for this, and our AI provider, Microsoft Azure OpenAI, does not use them to train its own models. The business that received or made the call can listen to and download its recordings; once a business downloads a recording, the business is responsible for that copy. Phone carriers may keep their own copies of call records under their own policies.

7. AI and Automated Features

We use AI to answer and make calls for businesses, write call summaries and suggestions, read documents businesses upload, answer questions in Ask Clinket, help businesses write descriptions and call scripts, check listings prepared from public information, and improve search.
Our AI runs on Microsoft Azure AI services under contract. Your content is processed to provide the feature and is not used to train AI models, by us or by Microsoft.
Some decisions are made automatically, such as which providers receive a Customer request, the order of search results, and draft bookings, quotes or contacts created from a call. Bookings requested by the AI must be confirmed by the business. If you think an automated result is wrong, contact the business or write to us and a person will review it.
AI can make mistakes. Please check important details, such as dates, prices and addresses, with the business.

8. Analytics

8.1 How our analytics work

To improve search, recommendations and other features, and to detect fraud and abuse, the Clinket apps record structured analytics events about actions taken on the Platform. Analytics events do not contain the text of your messages or reviews, the description of a quote, booking or contact notes, the contents of files you upload, call audio or transcripts, or other free text you type. They contain only short labels.

Before analytics data is stored, your IP address is shortened so that it no longer identifies your device, any email address or phone number that appears is replaced with a placeholder, and your location, if you have allowed it, is rounded to about one kilometre. Clinket does not keep precise location in analytics records.

8.2 Your choice, and the default in India

In India, analytics events are kept without your account number, device identifier or business identifiers unless you say yes to analytics in Cookie Preferences. If you say no, or have not chosen, the events are kept only in this de-identified form. You can change your choice at any time.

8.3 Information sent with analytics events

Your account number when you are signed in and have said yes to analytics.
A device identifier created by Clinket and stored in your browser or app, used to keep recommendations consistent on that device. It is not an advertising identifier, and Clinket never reads your phone's advertising ID. You can clear it by clearing your browser or app storage.
A session identifier that ends when you close the tab or app.
The app version, a short request reference used to find errors, the page path you visit (without the rest of the address), and the website that sent you to us.
Your shortened IP address, browser or app type, country and language.
Your rounded location, only if you have allowed location for features such as nearby search. Clinket never asks for location only for analytics.
For businesses, the business, team membership and Location the action belongs to.
The reference numbers of the services, providers, bookings, quote requests, invoices and categories an action relates to, but never their contents.
The search words you type, used to improve spelling correction and results, with email addresses and phone numbers removed.
Engagement signals such as which result you clicked, time on a page and how far you scrolled, and a reference linking a search to what you then viewed or booked.

8.4 Activity we record

Account and settings: registration, sign-in, security and preference changes, sign-out.
Marketplace: search, page views, bookings, quote requests and quotes, Customer requests, invoices and cart actions.
Messages and contacts: opening conversations, sending messages, attaching files and managing contacts, never the text.
Reviews: posting, editing, voting, reporting and replying, never the review text.
Business tools: services, photos, offers, calendar, team, Ask Clinket, plan and billing pages and their outcome (for example payment succeeded or failed), never card details.
Calls: for AI Assistant and Outbound calls, only the type of outcome (for example missed, handled by the AI, booking made) and a length range, linked to the business; never the caller's phone number or identity.
Navigation and errors: menus, notifications, permissions given or refused, and error codes. Some frequent events are recorded only for a sample of visits.

8.5 What analytics never capture

Message, review, quote, booking or note text, or the contents of uploaded files.
Call audio, recordings or transcripts.
Your name, full email address, full phone number or postal address.
Passwords, one-time codes, passkeys or other sign-in secrets.
Card numbers, bank details or UPI PINs.
Precise location.
Health, religious, political, sexual-orientation or biometric information.
What you type before you submit a form.
Pages for resetting passwords or verifying codes.

8.6 Google Analytics, Google Tag Manager and crash reports

On our websites, Google Analytics and Google Tag Manager are loaded only after you say yes to analytics cookies. Their advertising features are turned off, and they are not loaded on pages opened from private links or permission pages. Our mobile apps use Google Firebase Crashlytics, which sends a report when the app crashes, with device model, operating system, app version, crash details and an app-install identifier, so we can fix errors. See our Cookie Policy for details.

9. How We Share Personal Data

We do not sell personal data, and we do not share it for third-party advertising. We share it only as follows:

With the businesses you deal with: when you book, request a quote, message, call or are called by a business, that business receives the details needed to serve you.
Within a business: team members see records according to their role.
Publicly: provider public pages, reviews and business replies are public and may appear in search engines and AI assistants. We tell search engines when public pages change.
With our service providers (Section 10), who process data only on our instructions and under contract.
For legal reasons: when required by law, court order or a lawful request from a government authority, or to protect the rights, safety and property of people and of Clinket, and to prevent fraud.
In a business transfer: if Clinket is merged, acquired or sells its assets, personal data may pass to the new owner under this Policy.

10. Our Service Providers

Microsoft Azure: hosting, databases, file storage, search, push notifications, server logs, and AI services (Azure OpenAI, Azure AI Speech and Azure AI Document Intelligence).
Amazon Web Services (Amazon SES): sending email.
Plivo: AI Assistant and Outbound phone calls in India, and phone number checks.
Telnyx: phone calls and SMS outside India.
2Factor: SMS and one-time codes to Indian numbers.
Meta Platforms: WhatsApp messages and sign-in, and Facebook sign-in.
Razorpay: payments, UPI and card mandates, and payouts in India.
Google: Google sign-in, Google Maps (address search and maps), Google Analytics and Tag Manager (only with your consent), Firebase (crash reports and app notifications) and reCAPTCHA.
Apple: Sign in with Apple and app notifications on Apple devices.
Mailchimp (Intuit): managing our email list for newsletters and product news.

Each of these providers handles personal data under contract and for the purposes above. Some, such as Google, Apple and Meta, also handle data you give them directly under their own privacy policies.

11. Where Your Data Is Stored and Transfers Outside India

Personal data of users in India is stored in data centres in India. Some processing happens in other countries:

AI processing (call summaries, transcripts of AI calls, Ask Clinket, document reading and other AI features) takes place in the United States, and the live voice of AI Assistant and Outbound calls is processed in Sweden.
Server logs used to keep the Platform running and secure are stored in Canada.
Service providers such as Google, Meta, Apple, Mailchimp, Plivo and Razorpay may process data in other countries, including the United States.
If a primary data centre is unavailable, we may temporarily use another region.

We transfer personal data outside India only to countries not restricted by the Government of India under the DPDP Act, and we protect it with contracts and security measures.

12. How Long We Keep Data

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires, and then delete it or remove what identifies you. Main periods:

Call recordings, transcripts and summaries: 90 days. The live transcript of a call is deleted within 24 hours, once the summary is made.
Records that a call notice was played: kept as evidence that callers were told, showing only part of the phone number.
Stop requests and calling permission records: while the business is on Clinket and for 5 years after it closes, so stop requests keep working; supporting evidence files for 7 years.
Outbound call results and finished campaigns: 365 days; closed follow-ups: 12 months.
Bookings and invoices: about 2 years; quotes: 1 year; quote requests: up to 1 year. Businesses should keep their own copies for tax purposes.
Messages: generally 1 year; closed conversations: 90 days.
Notifications: 30 to 90 days. Carts and recently viewed items: 30 to 90 days.
Business activity history: 90 days; payment-related entries: 1 year.
Sign-in attempts, account activity and ended sessions: 90 days.
Ask Clinket conversations: 30 days. Replaced documents: 60 days. Documents a business keeps on Clinket stay until the business removes them or closes.
Files from listings prepared from public information: 30 to 365 days (normally 90). The listing itself stays until it is claimed or removed.
Records of undeliverable addresses: 180 days.
Analytics: up to about 7 years; some search measurement records: about 90 days.
Billing and payment records: about 7 years.
Account details: while your account is open; see Section 15 for deletion.

We keep logs of processing for at least one year where the DPDP Rules require it, and longer when we must keep data to meet a legal obligation, resolve a dispute or prevent fraud.

13. Security and Data Breaches

We protect personal data with reasonable security safeguards, including encryption in transit and at rest, encrypted message storage, access limited by role, protected passwords and sign-in codes, monitoring and regular review. No system is perfectly secure, so we cannot guarantee absolute security.

If a personal data breach affects you, we will tell you without delay, in plain words, what happened, the likely impact, what we are doing about it and what you can do, and we will report it to the Data Protection Board of India as the DPDP Rules require.

14. Your Rights

Under the DPDP Act you have the right to:

Access a summary of the personal data we process about you and the processing we do, and the identities of the other Data Fiduciaries and Data Processors we have shared it with, together with a description of what was shared.
Correct, complete and update your personal data.
Erase your personal data, unless we must keep it for a legal purpose.
Withdraw consent at any time, as described in Section 5.
Grievance redressal: complain to our Grievance Officer (Section 20).
Nominate another person to exercise your rights if you die or become unable to act.

You can change most account details yourself in the app. For any other request, write to legal@clinket.com from the email address on your account, or tell us how to reach you. We may ask you to confirm your identity before acting. We respond within the time the law requires. If your data was given to us by a business (for example as one of its contacts), we may pass your request to that business and help it respond.

15. Deleting Your Account

You can ask us to delete your account in the app (in your profile, under data deletion) or by writing to legal@clinket.com. We deactivate your account straight away: you are signed out everywhere and your account can no longer be used. We then complete the deletion within the time the law requires, keeping only what the law requires or allows us to keep, such as tax and billing records, stop requests (so they keep working), and records needed to prevent fraud or resolve disputes. Deleting your account does not close a business you own; the Primary owner can close the business separately.

16. Messages and Marketing Choices

We send service messages about your account, bookings, quotes, invoices, calls and security by email, SMS, WhatsApp and push notification. WhatsApp messages are sent from Clinket's shared business number.
We send marketing only if you have agreed to receive it, and you can opt out at any time with the unsubscribe link, in your notification settings, or by replying STOP where offered. Opting out of marketing does not stop important service messages.
We never add you to our marketing list just because a business booked, quoted, invoiced or saved you as a contact.

17. Data a Business Puts on Clinket

When a business uploads or creates information about its own customers, contacts or staff (for example its contact list, call scripts, notes or documents), the business is the Data Fiduciary for that information and is responsible for having a lawful basis and giving any notice required, including before it calls anyone through Outbound calls. Clinket processes that information as the business's Data Processor, following its instructions and our terms. If you want to exercise your rights over such information, please contact the business; you can also write to us and we will help.

18. Children

Clinket is for adults aged 18 or older. We do not knowingly process the personal data of children (people under 18), and we do not track or target advertising at children. If we learn that we hold a child's data without verifiable consent from a parent or lawful guardian, we will delete it. If a person with a disability has a lawful guardian, the guardian may act for them after we verify the guardianship.

19. Changes to This Policy

We may update this Policy when our services or the law change. If a change is significant, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. The effective date at the top shows when this Policy last changed.

20. Grievance Officer and Contact

Our Grievance Officer handles questions, requests and complaints about your personal data and this Policy, and can be reached at legal@clinket.com. For general help, write to support@clinket.com.

We acknowledge complaints within 24 hours and aim to resolve them within 15 days, and in every case within the period set by the DPDP Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.