Privacy Policy | Above Clicks

Draft. These policies were prepared without legal review. They describe how this site actually works, but they are not legal advice.

This policy explains what personal data Above Clicks collects through aboveclicks.com and our forms, why we collect it, how long we keep it and the rights you have. It covers visitors and prospects worldwide, including people in the European Union and United Kingdom (GDPR and UK GDPR), California and other US states with privacy laws (CCPA/CPRA), Canada (PIPEDA), Australia (Privacy Act 1988) and India (Digital Personal Data Protection Act, 2023).

Who we are

Above Clicks is a performance marketing agency for e-commerce brands, based in India. For the purposes of this policy, Above Clicks is the controller (or “data fiduciary” under India’s DPDP Act) of the personal data described here.

Postal address: Above Clicks, 2401, 24th Floor, E-Square, Supertech, Plot C-2, Sector 96, Noida, Uttar Pradesh, India – 201303.

Questions about this policy or your data, requests to use your rights and complaints (including grievances under India’s DPDP Act) go to [email protected], or by post to the address above. A person on our team who can answer on behalf of Above Clicks reads every message.

What we collect

Information you give us

Free audit form: your name, work email, store URL, monthly ad spend band, the platforms and services you choose, any notes you add and your consent to this policy.
Contact form: your name, email, store URL (optional) and your message.
Quick audit form: your store URL, work email, the main problem you describe and, if you add it, your WhatsApp number.
Free tools: if you ask for a tool’s result by email, your email address, any name and store URL you add, and the tool’s answers and result.
Email and WhatsApp: whatever you choose to send us, including files and screenshots.
Audit access: if you give us read-only access to ad, analytics or store accounts for an audit, we see the data in those accounts. We only use it to prepare your audit.
Newsletter signup: your email address, the page you signed up on, and when you gave and confirmed your consent.

Information collected automatically

Form context: the page you submitted from, the first and last campaign links (UTM parameters) that brought you to the site, and the referring site. These are stored with your request so we know which marketing works.
Spam protection: to limit abuse, we keep a one-way hash of your IP address for up to one hour.
Submission details: when you send a form (including a tool result request), we store your IP address, the time you sent it, and your browser’s user agent along with the browser, operating system and device type read from it. We use these to spot and block spam and abuse. They’re kept with your request in our leads system, shown to our team in the request notification, and left out of lead exports.
Analytics and advertising tags: with your consent where the law requires it, we use Google Analytics 4, Google Ads, the Meta Pixel and Microsoft Clarity, which the site loads directly (no tag manager). They collect device, browser and usage information, such as pages viewed and clicks. See the cookie policy for the full list.
Hashed contact details for ad measurement: if advertising cookies are allowed for you and you send a form or sign up for the newsletter, we pass a one-way SHA-256 hash of your email address (and of your phone number, if you give one with a country code) to Google Ads for enhanced conversions, hashed in your browser, and to Meta through its Conversions API, hashed on our server. With the Meta event, our server also sends your IP address, your browser’s user agent and the Meta cookie IDs (_fbp, _fbc). Google and Meta use this to measure which ads lead to requests. If advertising cookies are off, none of it is sent.

We don’t ask for sensitive personal data, and the site is not meant for children under 16.

How we use it, and our legal bases

To answer your request and prepare your audit (taking steps at your request before a contract, or consent).
To follow up about our services after you’ve contacted us (legitimate interests; you can tell us to stop at any time).
To measure and improve the site and our marketing (consent where required, otherwise legitimate interests).
To keep the site secure and stop spam (legitimate interests).
To meet legal obligations, such as tax and accounting records once you become a client (legal obligation).

We don’t sell your personal data, and we don’t use it for automated decisions that have legal or similar effects on you.

If you sign up for our newsletter, you get one marketing email a month from Above Clicks. We use double opt-in: first we send you a confirmation email, and we send no marketing email until you click the link in it. Your email address is stored in our website’s leads system, with the page you signed up on and the times you consented and confirmed. Every monthly email has a link to unsubscribe in one click. If you unsubscribe, we keep your address marked as unsubscribed so you aren’t emailed again, unless you ask us to delete it. We never sell or share your address, and you can ask us to delete it at any time by emailing [email protected]. Our legal basis is your consent, which you can withdraw at any time by unsubscribing.

We share personal data only with service providers that help us run the business, under contracts that limit how they use it:

InMotion Hosting, which hosts the website, its database and our mailbox, and sends form notifications and replies
Google (Gmail), where one of our team inboxes receives new-request notifications
Cloudflare, for the Turnstile spam check on our forms
Google (Analytics, Ads), Meta (Pixel and Conversions API) and Microsoft (Clarity), as described above and in the cookie policy
WhatsApp (Meta), if you choose to message us there

Some of these providers process data outside your country, including in the United States and India. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.

Sharing for advertising (US state laws): if you accept advertising cookies, the Meta Pixel and Google Ads tags may count as “sharing” for cross-context behavioral advertising under California law. You can opt out at any time with the “Your privacy choices” link in the footer. We also treat a Global Privacy Control signal from your browser as an opt-out of advertising cookies.

How long we keep it

Audit and contact requests that don’t become clients: up to 24 months after our last contact, then deleted.
Client records: for the length of the engagement and as long as tax and accounting law requires afterward.
Spam-protection hashes: one hour.
Submission details (IP address, time sent, user agent, browser, operating system and device type): for as long as the lead record is kept.
Analytics data: according to each tool’s retention settings. GA4 will be set to 14 months, its longest standard option, when tracking goes live.

Your rights

Depending on where you live, you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct it or delete it;
stop or limit how we use it, or object to processing based on legitimate interests;
move it to another provider (portability);
withdraw consent at any time, without affecting what we did before you withdrew it;
opt out of the sale or sharing of personal data and of targeted advertising (US state laws);
nominate someone to exercise your rights if you die or become unable to (India’s DPDP Act).

To make a request, email [email protected]. We’ll confirm who you are and reply within one month (45 days for US state law requests). We won’t treat you differently for using your rights.

If you’re not happy with our answer, you can complain to your local regulator, for example the ICO in the UK, your EU supervisory authority, the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner or the Data Protection Board of India.

Security

The site runs over HTTPS. Form submissions are stored in our website database, which only our team can access. We use strong, unique passwords and two-factor authentication where our tools offer it. No system is perfectly secure, so if a breach affects your data, we’ll tell you and the regulators as the law requires.

Changes to this policy

We’ll update this page when our practices change and show the new date at the top. If a change is significant, we’ll say so on the site or tell people we’re in touch with.