Clickwise Privacy Policy — v2 services

Version dated 10 October 2026. English is the canonical version.

1. Who is responsible

The controller for the processing described in this policy is SOFT DEV FZ LLC, a Free Zone Limited Liability Company licensed by the Fujairah Creative City Free Zone Authority (Media Free Zone) under licence No. 9485/2016. The address shown on its licence is: Fujairah – Twin Towers, P.O. Box 4422, Fujairah, United Arab Emirates. SOFT DEV FZ LLC operates the Clickwise brand for the services listed in section 2.

Privacy contact: privacy@hello.clickwise.net

2. What this policy covers

This policy covers:

• the Clickwise panel at partners.clickwise.net (also reachable as panel-v2.clickwise.net), including affiliate and merchant accounts, sign-up and onboarding;
• the public Clickwise API and MCP server under partners.clickwise.net/api/v1/ (also served as panel-v2.clickwise.net/api/v1/, including /api/v1/mcp/), the discovery files (llms.txt, /.well-known/ai-plugin.json, /.well-known/mcp.json), the public program and catalog pages, and the product feeds;
• the Clickwise Tracker at go.clickwise.net and Clickwise redirect links under /dl/ (for example on r2.clickwise.net and share.clickwise.net), including the conversion reports ("postbacks" and pixels) they receive;
• the emails we send and receive to run the service and to contact prospective partners;
• the Clickwise voice line and WhatsApp: the phone numbers +1 646 362 1368 and +44 7576 559749, the web call page at talk.clickwise.net (linked from partners.clickwise.net/talk), and WhatsApp messages to +1 646 362 1368.

It does not cover:

• t.clickwise.net and the legacy Clickwise v1 platform, which have their own notice;
• Clickwise AI Ads at ads.clickwise.net, which has its own privacy policy;
• the websites of advertisers, affiliate networks and publishers, which process data under their own policies.

3. What data we process

3.1 Accounts, sign-up and onboarding

When you create or use an account we process:

• Identity and login: username, first and last name, email address, and your password, which is stored as a salted hash rather than in clear text. We also keep your language, your time zone and the time of your last login and last activity.
• Affiliates: country, postal address, legal entity type, tax identification number, website name, URL and country, and the payment details you enter: PayPal ID and name, or bank name, account holder, bank country and address, IBAN or SWIFT code and account number.
• Merchants: company name, country, legal entity type, tax identification number, billing address, city and postcode, and the name, phone number, email address and messenger handles of the main and technical contacts.
• Documents you upload to verify your account or tax details.
• Sign in with Google (optional): your Google account identifier, Google email address and profile picture URL.
• Two-factor authentication (optional): your authenticator secret; your recovery codes; and, if you choose to trust a device, a record of that device including its browser user agent.
• Onboarding applications, including those started through our MCP server: what you or your AI agent submit (for example company name, website, contact name and email, country, business vertical, networks used, where links will be published, free-text messages and answers to our follow-up questions), the language used, and the country estimated from your IP address (section 3.7).

Our AI assistant (Google Gemini, section 5) evaluates onboarding applications and asks follow-up questions. Merchant applications can be approved or declined automatically on the basis of that evaluation. You can request human review of an automated decision by writing to privacy@hello.clickwise.net.

3.2 Public API and MCP server

For every call to a tool on our MCP server we record: the time, the tool name and method, the result status, the response time, the name of the AI client when it can be identified, your IP address, your user agent, the protocol version, a summary limited to selected request fields, a summary of the response, any error message, and the linked affiliate account or application, if there is one.

Product search and product feed tools require an affiliate API key (X-API-Key), which links those calls to the affiliate account. The request_tracked_links, request_merchant_onboarding and update_profile tools receive the kinds of data described in 3.1, for example a contact or claim email, display name, website, country and payment method.

The public program and catalog pages, llms.txt, the manifests and the product feeds describe programs and products. Visiting them produces the request logs described in 3.5. The public affiliate-program pages may also load the OpenAI measurement pixel, under the rules in 3.4.

3.3 Tracking links, clicks and conversions

When someone follows a Clickwise tracking link on go.clickwise.net or a /dl/ link, we record a click with: a click ID; the time; the host; campaign, affiliate and link identifiers; the destination URL; any sub-ID supplied by the affiliate; the IP address as received, not truncated, masked or hashed; the browser user agent; the HTTP Referer; and, when present in the link, advertising click identifiers such as Google's gclid, gbraid and wbraid, and an external click ID.

The tracker does not store a location for the click. If a link restricts traffic by country, the /dl/ redirect looks up the country of the IP address in our own database (section 3.7) to choose the route; that country is not stored with the click.

The tracker's /api/touch endpoint can create or recover a click from identifiers supplied to it. It stores the same kinds of data and does not set a cookie.

The destination website, and the affiliate networks that handle the link, receive the parameters contained in the destination URL. These can include identifiers that Clickwise adds so the sale can be attributed.

Conversion reports. When an advertiser, a network or a website reports a sale, lead or other event to us, we record the event type, order ID, amounts, commission, currency, the click ID and any Google click identifiers supplied, together with technical data about the reporting request: IP address, user agent, Referer, HTTP method, path, query parameters and request body. When the report is a pixel loaded by a browser (for example on an order-confirmation page), these technical data are those of that browser.

3.4 Cookies and similar technologies

The controller considers cwclk a network attribution cookie necessary to calculate and pay commissions. We do not ask for consent before setting it. Whether a consent gate is required in particular jurisdictions remains under legal review. A tracking redirect works without cookies or JavaScript, and your browser settings can block or delete cookies. When the ad platform checks a tracking link in the background ("parallel tracking"), a cookie set in that background request does not necessarily reach your browser.

OpenAI measurement pixel. On the affiliate and merchant sign-up pages and on the public affiliate-program pages we may load OpenAI's Ads Measurement Pixel, a script hosted by OpenAI. Where the law requires prior consent for it (including the European Economic Area, the United Kingdom, Switzerland and Brazil), or when we cannot determine your country, it loads only after you accept advertising measurement (cw_consent=all); until then, neither the pixel script nor a request to its host is loaded. Elsewhere it loads unless you have chosen essential cookies only or your browser sends a Global Privacy Control signal. We infer your country from your IP address to apply these rules. After a successful sign-up or application, the page sends OpenAI an event name and a reference built from the internal number of the new account or application. We do not pass form fields, email addresses, names or URLs to it. You can change your choice at any time with the "Cookie settings" link on those pages; choosing essential cookies stops future loads and measurement events. If the pixel has already loaded, that choice reloads the page to stop it. What the script reads or stores in your browser is determined by OpenAI.

Sign in with Google. If you choose it, Google's sign-in service runs in your browser under Google's terms.

The panel home page loads no advertising scripts. It loads our own product analytics script described in 3.9, which sets no cookies and uses no browser storage. Where prior consent is required, or when we cannot determine your country, it shows a cookie banner; the "Cookie settings" link in its footer lets you change your choice. The sign-up and public affiliate-program pages also provide the consent notice and cookie settings.

3.5 Server logs

For each request to our services, our hosting provider, Google Cloud, records the IP address, user agent, full requested URL including query parameters (which can include click identifiers such as gclid), method, status, size and response time, and the Referer when the browser sends one. The tracker's own application log records the route name, not the path or query string. IP addresses are also used as keys of per-minute rate-limit counters, which expire after 60 seconds.

For provisional publisher signups, we store a keyed hash (HMAC-SHA256) of the IP address in the application for 90 days to prevent abuse and detect duplicates. We do not store the raw IP address in that application field; a daily task removes the hash after 90 days.

3.6 Emails and outreach

• Sending. We send service emails and outreach through Resend, using the sender domain send.clickwise.net, and through the Gmail API of our Google Workspace mailboxes.
• Delivery events. Resend reports delivery events to us: sent, delivered, opened, bounced, complaint and delayed. We store them with the message.
• Replies and incoming mail. Mail sent to @clickwise.net addresses is delivered to a Google Workspace mailbox. Our systems read it automatically and store the sender, recipients, date, subject and body in our contact records. Google Gemini may classify or summarise it. Mail sent to certain personal mailboxes is excluded from automated reading.
• Outreach. To find prospective merchants and publishers, we collect business contact data: company name, website or domain, contact name, business email address, country, industry, affiliate networks used, and a research summary written by our AI. Our sources are affiliate-network data, public websites, referrals, manual entry, incoming messages, Clickwise AI Ads, and the B2B contact-data providers Hunter, Apollo, Prospeo and Snov.io. We check with Bouncer whether an address can receive email. If a recipient reports our message as spam, the contact is set to "do not contact". Before any outreach is sent, the system checks that status and any recorded opt-out.

• Privacy requests. Messages to privacy@hello.clickwise.net are received by Resend for human handling, outside the automated commercial and onboarding workflows. The panel records the sender, recipient, message identifiers, time and handling status, without fetching or retaining the message body or subject in that record. A notification containing the sender and subject is sent to the owner’s Workspace mailbox. The complete message remains in Resend for the person handling your request. Correspondence involving protected personal mailboxes is excluded from this automated intake. Resend’s shared-account inbound webhooks also notify other internally operated projects of message metadata, including sender, recipient and subject.

3.7 Language and country detection

We look up the country of your IP address in a database kept on our own servers (DB-IP «IP to Country Lite», CC BY 4.0: IP Geolocation by DB-IP) in these cases: when you open the panel home page with no language in the address, when you use the sign-up and onboarding forms, when you follow a /dl/ link that is restricted by country, and, if the request does not already carry your country, to apply the cookie rules in 3.4. Your address is not sent to any third party for this, and the result is not stored, except that for onboarding applications the estimated country is stored with the application.

3.8 Phone calls, web calls and WhatsApp with our AI assistant

Calls to our phone numbers and to the web call page, and messages to our WhatsApp number, are answered by an AI assistant, not by a person. On calls it says that it is an AI assistant when it greets you, and it answers truthfully if you ask. Our WhatsApp profile also states that an AI assistant answers. If you prefer not to talk to an AI, write to partnerships@clickwise.net.

• Calls. Phone calls are connected through Twilio. While the call lasts, its audio is streamed to the Google Gemini Live API so that the assistant can understand you and answer. We do not record call audio. Gemini transcribes both sides of the conversation. With each call we store your phone number, the time, duration and direction of the call, the transcript (up to 20,000 characters), a summary, the outcome and technical metrics. The assistant uses earlier calls from the same number as context.
• Web calls. On talk.clickwise.net, the audio goes from your browser to our server and to Gemini Live in the same way, and the transcript and summary are stored as for phone calls. To prevent abuse, we count calls per day and per IP address per hour; the counter is keyed by a one-way hash of your IP address, not by the address itself.
• WhatsApp. We use Meta's WhatsApp Business Platform (Cloud API): Meta hosts and delivers the messages between you and us. For each incoming message we store your WhatsApp number and profile name, the time, the message type and text, and the identifier, type and file name of any attachment. We also keep the latest 60 turns of the conversation: your text messages and the assistant's answers. The text of your message and the recent conversation are sent to the Google Gemini API to write the answer. Voice notes are downloaded from Meta and sent to Gemini so that the assistant can understand them; we do not keep the audio. The assistant answers a limited number of messages per number each day.
• Your affiliate account on WhatsApp. If you are a Clickwise affiliate, you can link your WhatsApp number to your account: you give us the account's email, we send a 6-digit code to that email, and you type it in the chat. While the number is linked, the assistant can read your programs, performance reports, conversions and payment status (balance, next payout and a masked payout method) and create your tracked links, with the same permissions as an app connected to your account through our MCP server (read and links only). It cannot change your payout details or postback settings, apply to programs, or approve anything. The link appears among your account's connections as «Clickwise WhatsApp»; it ends when you revoke it there, write «unlink» in the chat, or change your password. We keep the linked number, the account, when it was linked and a hash of each code; codes expire after 15 minutes. What the assistant reads to answer you is sent to the Google Gemini API and becomes part of the WhatsApp conversation.
• Linking WhatsApp from your profile (affiliates, merchants and Clickwise AI Ads users). You can also link your WhatsApp number from your profile in the panel or on ads.clickwise.net. You accept a consent that says what the channel is for («I agree that Clickwise may message me on WhatsApp about my account and my campaigns, and to use this channel to ask about them. I can opt out at any time by writing STOP or from this profile.»), we show you a one-time code that expires after 15 minutes, and you send «CW ALTA» with that code from the WhatsApp number you want to link: that message proves the number is yours. A number links to one account, and a number linked to another account is not taken over. An affiliate gets the same link and permissions as in the previous point. For a merchant, while the number is linked the assistant can read the status of your Clickwise account and of the ad accounts connected to it and, where available, the figures, campaigns and alerts that Clickwise AI Ads shows you; it cannot change campaigns, budgets, payments or settings. We email you when a number is linked, and when you unlink it in the chat or from your profile; the email never shows the full number. The link ends when you write STOP (or BAJA) in the chat, disconnect it from your profile or change your password; a merchant's link also ends if the account is closed or becomes a staff account. Commands (the «CW ALTA» message and its code, STOP, BAJA and BLOQUEAR, which blocks changes over WhatsApp for your account) are handled by fixed rules before the assistant: they are not sent to the Google Gemini API, and codes and PINs are never kept in the message records; we keep which command arrived and our answer. If changes confirmed over WhatsApp are added later, they will need a PIN, which we store only as a hash. An access token pasted in the chat is removed before the message is stored or reaches the assistant, and we ask you to revoke it. We keep the linked number, the account, when it was linked, the version and time of your consent and whether you asked for campaign alerts on WhatsApp (for now they are sent by email), a record of each consent and opt-out, and a hash of each code.
• Contact files. For people we already work with, the assistant may use a short contact file (name, company, role, email address, phone numbers, time zone, language and notes about our relationship) to recognise you and give context. We also keep a do-not-call status for each number.
• Follow-up. After a call, the summary and the transcript are emailed to our team's Google Workspace mailbox and kept in our internal follow-up files. Each call (its summary and the follow-up action, not the transcript) and each WhatsApp message (with the assistant's answer) is also kept in a record for your number in our panel, linked to your contact record (3.6) when we know your email, so that a person on our team can follow up and, within WhatsApp's 24-hour window, answer you there. For WhatsApp, the first message of the day from each number is also emailed to that mailbox. Anything agreed in a call or chat is confirmed in writing by email.

3.9 Product analytics

To find errors and improve the panel, our public pages and our API, we record how the services are used. We do it on our own infrastructure (Google Cloud) and without third-party analytics tools.

What is recorded.

• The screens viewed, as a route template without identifiers or URL parameters.
• Clicks on buttons and links, identified by the element's technical name and never by its text.
• Progress through forms, by field name only and never what you type.
• JavaScript errors, with email addresses, phone numbers and links removed from the message.
• Requests to our API that fail.
• The response time and status of our API.
• Searches in the program and product catalog. The search text is kept only when the search returns no results, shortened to 50 characters, with email addresses, phone numbers, links and similar data removed.
• Calls to our MCP server (tool, result and timing).
• The milestones of sign-up and activation, such as approval, first link, first click and first sale.

How you are identified.

• If you are signed in, events carry a pseudonymous identifier computed from your account number with a secret key (HMAC). They do not contain your name, your email address or the account number itself.
• If you are not signed in, you get no identifier that lasts beyond the page: the script sets no cookies and stores nothing in your browser, and its session identifier exists only while the page is open.
• We keep a shortened IP address (the first three blocks of an IPv4 address or the first 48 bits of an IPv6 address), the device type, the browser and operating-system family, the page language and, when our load balancer provides it, the country.
• The full IP address is used only when the event is received, to recognise our own test traffic. The full browser identification string is not kept.

Your choice.

• If you are not signed in and your browser sends a Global Privacy Control signal, or you have chosen essential cookies only in the cookie settings of the site you are visiting, the script records nothing, and we do not record your searches or the addresses you could not find. Only the technical time and status of your requests to our API are kept, without identifiers, like the server logs in 3.5.
• If you are signed in, you can object by writing to privacy@hello.clickwise.net.
• Our staff, test and internal accounts are marked and left out of the analysis.

Retention. Product events are kept for 400 days, and technical events (API timings, errors and background tasks) for 90 days. Daily totals without identifiers are kept for up to 25 months.

4. Why we use your data, and on what legal basis

The following bases state the position adopted by SOFT DEV FZ LLC as controller. They are not a statement that an independent legal assessment has been completed.

5. Who receives data

Service providers

The provider-by-provider assessment of processor or independent-controller roles and the associated data processing agreements remains pending. Afventures hosts email for which SOFT DEV FZ LLC remains the controller, as an intragroup processing arrangement; its formal documentation is pending.

Payments. Affiliate payments are currently made manually through banks or PayPal. The payment provider receives the recipient and transaction details needed to make the payment.

Other recipients. The advertisers, affiliate networks and affiliates involved in a referral receive the identifiers and transaction information needed for attribution and payment. We may also disclose data where the law requires it or to establish, exercise or defend legal claims.

6. International transfers

SOFT DEV FZ LLC is established in the United Arab Emirates. Our application servers, databases, cache and file storage are in Google Cloud's europe-west1 region (Belgium). Google Cloud Logging keeps our logs in its global location. The voice-line and WhatsApp records in 3.8 are stored in Google Cloud's us-central1 region (Iowa, United States). Some other providers in section 5 may process data outside the United Arab Emirates and the European Economic Area, including in the United States. Privacy mail received on hello.clickwise.net is stored by Resend in its US East (Northern Virginia) region. The assessment of each provider’s locations and applicable transfer safeguards remains pending; this policy does not claim that particular contractual safeguards have already been put in place. Product analytics events (3.9) pass through Google Cloud Logging and are stored in BigQuery in europe-west1.

7. How long we keep data

Our retention position is to keep data while your account is active and for the time required for reconciliation and accounting. There is currently no automatic deletion schedule for accounts, affiliate clicks and conversion reports, commission records, MCP call records, onboarding applications, contact records or emails. Closing an account marks it as deleted without automatically erasing associated data. Deletion and anonymisation tooling, including for click IP addresses, remains to be implemented; we do not promise a deletion deadline that the system does not enforce.

• Call audio: not recorded; it exists only while the call is in progress.
• Call transcripts, summaries and call logs, WhatsApp message records and voice-line contact files (3.8): no automatic deletion schedule. We keep them to follow up on your requests and to give the assistant context in later conversations, until you ask us to delete them. The WhatsApp conversation record keeps only its latest 60 turns.
• WhatsApp account links (3.8): kept while the link is active; the record of the link, the record of each consent and opt-out and the hashes of its codes are deleted 12 months after the link ends (a code that was never used, 12 months after it expires). The record of each command (which command arrived and our answer, never a code) is deleted after 90 days.
• Web call counters: no automatic deletion; they contain only hashed IP addresses and counts.
• Server logs: 30 days.
• Database backups: automated backups; we keep the latest 30 of the panel database and the latest 7 of the tracking database, plus 7 days of transaction logs.
• Country lookup cache: 24 hours (5 minutes after a failed lookup).
• Product analytics: 400 days for product events and 90 days for technical events (3.9). Daily totals without identifiers are kept for up to 25 months.
• Cookies: as listed in 3.4. When a cookie expires, the records on our servers are not deleted.

8. Your rights

Depending on the law that applies to you, you may have the right to access your data, correct it, delete it, restrict or object to its processing (including objecting to outreach at any time), receive it in a portable format, withdraw consent where processing relies on consent, and complain to a data protection authority. The controller’s position is that the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, and that the GDPR applies to users in the European Union under Article 3(2). We have not designated an EU representative; the representative requirement and competent supervisory authorities remain pending legal advice.

To exercise these rights, contact privacy@hello.clickwise.net. We may ask for reasonable information to confirm your identity before acting on a request. Please do not send passwords, payment details or unnecessary identity documents. Records held by an advertiser or network may need a separate request to that organisation. We will respond within one month of receiving your request. This response commitment does not mean that all records are automatically erased within that period; accounting obligations may require us to retain some records.

Calls and WhatsApp. To have the voice-line and WhatsApp records about you deleted, write to privacy@hello.clickwise.net and tell us the phone or WhatsApp number you used and roughly when. We may ask you to confirm that the number is yours, for example with a WhatsApp message from it. We will delete the call transcripts and summaries, the WhatsApp messages and the contact file held for that number and, if you wish, mark it as do-not-call. Our team does this manually. The copies sent by email, kept in the panel record for your number or added to our contact records (3.6) are handled in the same request.

9. Security

Passwords are stored as salted hashes. Two-factor authentication is available for accounts. Authenticator secrets are stored encrypted; a secret saved before encryption was introduced is converted the next time it is used. In production, session and CSRF cookies are only sent over HTTPS. Service credentials are kept in Google Cloud Secret Manager.

10. Changes to this policy

When our processing changes, we will update this policy and its date. This version reflects the implementation reviewed on 27 September 2026; section 3.8, the related entries in sections 4 to 8 and the cookie rules in section 3.4 reflect the implementation reviewed on 2 October 2026; section 3.9 and the related entries in sections 3.4, 4, 6 and 7 reflect the implementation reviewed on 9 October 2026; linking WhatsApp from the profile in section 3.8 and the related entries in sections 4, 5 and 7 reflect the implementation reviewed on 10 October 2026.