1. Who We Are

Clepath is a practice management platform for immigration consultants, operated by Clepath ("we", "us", "our"). Our contact email is clepathapp@gmail.com.

For the purposes of data protection law, Clepath is the data controller for Agent account data. For client data entered by Agents, the Agent is the data controller and Clepath acts as data processor.

2. What Data We Collect

Data Type	What It Includes	Why We Collect It
Account data	Name, agency name, email address	To create and manage your account
Billing data	Subscription plan, payment reference (via Paystack). We never store card numbers.	To process payments and manage subscriptions
Client data	Client names, phone numbers, email addresses, access codes, immigration journey details, documents uploaded	To power milestone tracking and notifications
Usage data	Pages visited, features used, login timestamps	To improve the platform and fix issues
Communications	Emails you send to our support address	To respond to your enquiries

3. How We Use Your Data

• To provide and operate the Clepath platform
• To send milestone notifications to your clients via WhatsApp (Twilio) and email (Resend)
• To process subscription payments via Paystack
• To send you account-related emails (signup confirmation, password reset, billing notices)
• To respond to your support requests
• To improve our platform based on usage patterns
• To comply with legal obligations

4. Third-Party Services We Use

We use the following third-party services to operate Clepath:

Service	Purpose	Data Shared
Supabase	Database and authentication	All account and client data (stored securely)
Vercel	Website hosting	IP addresses, request logs
Resend	Email notifications	Recipient email, notification content
Twilio	WhatsApp notifications	Recipient phone number, notification content
Paystack	Payment processing	Email address, subscription details
Anthropic	AI milestone suggestions (Geniex)	Journey type and milestone context only — no personal client data

We do not sell your data or your clients' data to any third party, ever.

5. Data Storage and Security

Your data is stored on Supabase's secure servers. We implement the following security measures:

• All data is encrypted in transit using TLS/HTTPS
• Database access is protected by Row Level Security (RLS) — each agent can only access their own data
• Passwords are hashed and never stored in plain text
• Access to production systems is restricted to authorised personnel only

6. Data Retention

• Active accounts: Data is retained for as long as your account is active
• Cancelled subscriptions / expired trials: Data is retained for 30 days then permanently deleted
• Deleted accounts: All data is permanently deleted within 30 days of account deletion
• Support emails: Retained for up to 2 years for reference

7. Your Rights

Under NDPR and GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your data in certain circumstances
• Restriction: Request we restrict processing of your data

To exercise any of these rights, contact us at clepathapp@gmail.com. We will respond within 30 days.

8. Client Data (Agents)

As an immigration consultant using Clepath, you are responsible for the personal data of your clients that you input into the platform. You must:

• Have a lawful basis for processing your clients' personal data
• Inform your clients that you use Clepath to manage their case and send them updates
• Obtain any necessary consent from your clients before sharing their phone numbers or email addresses with Clepath
• Handle data subject requests from your clients appropriately

9. Cookies

Clepath uses minimal cookies necessary for the platform to function, including session authentication cookies. We do not use tracking cookies or advertising cookies. We do not use Google Analytics or any third-party analytics tracking.

10. Children's Privacy

Clepath is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. International Data Transfers

Your data may be processed in countries outside Nigeria, including the United States (where Supabase, Vercel, and other infrastructure providers operate). We ensure appropriate safeguards are in place for such transfers.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email. Continued use of Clepath after changes take effect constitutes acceptance of the updated policy.

13. Contact and Complaints

For any privacy-related questions or concerns, contact us at clepathapp@gmail.com.

If you are in the EU/UK and believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority.