Privacy Policy

1. Who We Are

ClimbrIQ is operated by Think Commerce Ltd, a company registered in England and Wales. We are the data controller for personal data collected through this service.

For data protection enquiries, please contact us at hello@climbriq.com.

2. What Data We Collect

We collect the following categories of personal data:

• Account data: email address, full name (optional), password (hashed and managed by Supabase Auth)
• Brand data: brand name, website URL, description, target audience, competitors, and location — provided by you
• Usage data: site crawl snapshots, content strategy and calendar data, article generations, Google Search Console performance data, and session activity
• Billing data: subscription status, Paddle customer ID (payment details are handled directly by Paddle and not stored by us)
• Technical data: IP address, browser type, device type, and cookies

3. How We Use Your Data

We use your data to:

• Provide, operate, and improve ClimbrIQ
• Authenticate your account and protect against unauthorised access
• Process payments and manage your subscription
• Crawl your website, analyse its search performance, plan a content strategy, and generate SEO articles on your behalf using AI
• Publish or schedule those articles to your own website or CMS, where you have connected a WordPress site or a webhook endpoint
• Send transactional emails (account, billing, password reset)
• Comply with legal obligations

Our lawful basis for processing is contract performance (to provide the service you signed up for), legitimate interests (security, fraud prevention, service improvement), and legal obligation where required.

4. Third-Party Services

We use the following third-party processors:

• Supabase — Database and authentication. Your account data and brand data is stored in Supabase. Supabase processes data in accordance with GDPR.
• Anthropic — AI processing (the Claude API). To analyse your site and generate articles, we send Anthropic: your brand profile (name, website URL, description, target audience, competitors, and location); content crawled from your own website (page URLs, titles, meta descriptions, and headings); your Google Search Console performance data where you have connected it (search queries, page URLs, impressions, clicks, click-through rates, and average positions); your brand voice settings (positioning, opinions, tone notes, and phrases to avoid); and the text of articles ClimbrIQ has generated for you, when an article is refreshed. Some of these steps use Anthropic's server-side web search tool, which means search terms derived from your brand and chosen topics are sent to Anthropic and on to its search provider. We do not send your account identifiers (email address or name) to Anthropic, but you should not enter personal data into free-text brand fields, as anything you put there will be sent. Anthropic processes this data as our processor under its commercial API terms.
• Paddle — Payment processing. Paddle handles all payment card data. We store only your Paddle customer ID and subscription status.
• Resend — Transactional email delivery. We use Resend to send account-related emails. Only your email address is shared with Resend for delivery purposes.
• Vercel — Hosting and infrastructure. Our application is hosted on Vercel's infrastructure.

5. Data Retention

We retain your data for as long as your account is active. If you delete your account:

• Account and profile data: deleted within 30 days
• Brand data, crawl snapshots, content strategy and calendar data, articles, and Search Console data: deleted within 30 days
• Billing records: retained for 7 years to comply with UK financial regulations

6. Your Rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data (“right to be forgotten”)
• Restriction: restrict how we process your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@climbriq.com. We will respond within 30 days.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

7. Cookies

We use cookies for authentication (session cookies managed by Supabase Auth) and to remember your preferences. We do not use third-party advertising or tracking cookies. See our Cookie Policy for details.

8. International Transfers

Some of our third-party processors (Anthropic, Vercel) are based in the United States. Data transfers are protected by standard contractual clauses (SCCs) or equivalent safeguards in accordance with UK GDPR.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice in the application. The date at the top of this page indicates when this policy was last updated.