Privacy Policy

Last updated: 2026-10-27

This policy explains what personal data the ClickSpeak hosted service collects, why, where it is kept, for how long, and the rights you have under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and the EU General Data Protection Regulation (GDPR).

1. Who we are

ClickSpeak is operated by ABSTRA SERVIÇOS DE TECNOLOGIA SOCIEDADE LIMITADA, CNPJ 37.405.458/0001-30, with its registered office at Rua Visconde de Inhaúma, 134, 20º andar, sala 2001 (parte), Centro, Rio de Janeiro/RJ, CEP 20091-901, Brazil (“Abstra”, “we”, “us”). For the hosted service at clickspeak.io and its servers at *.clickspeak.io, Abstra is the controller of account, sign-in, billing and site data. For the data inside a server (member list, channel names, access rules and presence), Abstra acts as a processor, on behalf of the customer who administers that server, who is the controller of that data.

The data protection officer (“encarregado”) is the Encarregado de dados da Abstra, reachable at support@clickspeak.io. Write to that address about any privacy matter. Residents of the European Union may also contact the encarregado at that address.

This policy does not cover self-hosted ClickSpeak servers. When an organization runs the server software on its own infrastructure, that organization is the controller of the data it handles, and Abstra does not receive the audio, screen or member data that passes through it.

2. What we collect

• Sign-in data. When you sign in with Google or Microsoft, we receive and store your name, e-mail address and profile picture. We never see or store your password.
• Server data. The channels of each server and its configuration: name, access rules (who may join), administrators and member limit. We keep the e-mail address of whoever creates or administers a server, so they can manage it in the dashboard.
• Access requests and invitations. When you ask to join a server, we keep your e-mail address and the date of the request, and e-mail the administrators of that server with your address; when one of them lets you in, you get an e-mail saying so. When an administrator invites someone, we e-mail the invitee with the inviter's name and the server's link. These records serve only that and limiting abuse: a request stops working after 7 days and is deleted after that, and everything goes when the server is deleted.
• Usage milestones of each server. To know whether the service works for those who adopt it, we record when each server was created and when it reached certain milestones (the app installed, the second person, the first conversation, the plan's limit, the payment), without any e-mail address. These milestones go into a daily internal report, for Abstra's team only, with the server's name and the domain of its creator's e-mail (for example, company.com), never the address. Since a server's name is free text and a domain can belong to a single person, we treat this report as personal data. Legal basis: our legitimate interest in improving the service (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Free trial of the paid plan. To offer the trial once per person, we keep a one-way fingerprint (a SHA-256 hash) of the e-mail of whoever created the server, never the address, with the trial's dates. It stays after the server is deleted, because it is what prevents a second trial. Legal basis: our legitimate interest in preventing abuse of the offer (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Access logs. The IP address, date and time of each access to the Service, with the server and account involved, which Brazilian law (Marco Civil da Internet, art. 15) requires us to keep.
• Other technical logs. Debug and operational records, such as errors and requests made, recorded by our servers for security and troubleshooting.
• Billing data. For a server on the paid plan, the name, e-mail address, billing address and, if given, the CNPJ (Brazilian company tax ID) of whoever pays, plus the Stripe customer and subscription (currency, capacity, status and period). They are entered on Stripe's payment page, and card details stay with Stripe only (see section 6).
• Cookies. Only a session cookie that keeps you signed in and a cookie that remembers your language. We use no analytics, advertising or tracking cookies.

We do not collect anything else. At sign-in we ask the provider for no more than the name, e-mail and picture; billing data is described above.

3. Audio and screen

Audio and screen sharing are never recorded or stored. They are relayed in real time through our media server, encrypted in transit, only to the people in the same channel, and are gone as soon as they are delivered. Abstra does not listen to or watch them.

4. Why we use your data, and on what legal basis

• To provide the service you or your organization asked for: signing you in, showing you the servers and channels you belong to, and letting administrators manage them. Legal basis: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• To bill a server's paid plan: creating and keeping the subscription in Stripe, matching the server's capacity to what was paid, and telling administrators when a payment fails. Legal basis: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• To keep the service secure and working: preventing abuse, investigating faults, and sending service notices such as the inactivity notices described in the Terms of Service. Legal basis: our legitimate interest in running a secure and reliable service (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• To comply with the law, by keeping the access logs that the Marco Civil da Internet requires and issuing the tax invoices for payments. Legal basis: compliance with a legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).

We do not sell your data, use it for advertising, or build profiles of you.

5. Where your data is kept

Each server's data stays in the region chosen when the server was created. Today the only region is Brazil (Microsoft Azure, Brazil South); regions in the United States and the European Union will follow. Outside a server's region we keep only what is needed to find it and bill it: the routing record (server id and its region), the e-mail addresses of its administrators, used by the clickspeak.io dashboard, and, for a paid server, its Stripe customer and subscription. Billing data is also kept outside the server's region: the customer and the subscription in Stripe and in that central record; the name, e-mail, billing address, CNPJ and amounts paid in Stripe and in Abstra's finance system, which issues the tax invoices.

ClickSpeak's servers and central record are hosted in Brazil (Microsoft Azure, Brazil South region). Some processors may process data outside Brazil: Stripe, for payments; Amazon SES, for sending e-mail (United States, us-east-1 region); and Google and Microsoft, for sign-in. These transfers rely on those processors' standard contractual clauses or equivalent safeguards (LGPD art. 33 and, where it applies, GDPR art. 46). If you are in the European Union and use a server in the Brazil region, your data is transferred to and stored in Brazil.

6. Who processes data on our behalf

• Microsoft Azure: hosting of the servers, the media relay, the database and backups.
• Amazon Web Services (AWS): DNS and static files, such as the website assets and app downloads.
• Google and Microsoft: sign-in. They learn that you signed in to ClickSpeak, under their own privacy policies.
• Stripe: payments for the paid plan. Stripe receives the card, billing address and CNPJ on its own payment page and keeps the customer and the subscription. Card details never pass through ClickSpeak.
• Abstra's finance system: not a third party, but Abstra itself. It receives the payment events from Stripe (name, e-mail, billing address, CNPJ and amounts) to issue the tax invoices.
• Amazon SES (Amazon Web Services, in the United States): sending the service's e-mails, such as the inactivity and failed-payment notices to server administrators and the access requests and invitations.

We share personal data with nobody else, except when required by law or a valid order from a competent authority.

7. How long we keep it

• Sign-in and server data: for as long as the server exists, or until you ask us to delete your data. When a server is deleted, by its administrators or under the inactivity rule in the Terms of Service, its data is deleted with it.
• Billing data: while the subscription exists and, afterwards, for as long as tax and accounting law requires for payments and invoices.
• Backups: up to 30 days after the data is deleted from the service.
• Access logs: 6 months, as required by the Marco Civil da Internet (art. 15). They are kept confidential and disclosed only under a court order.
• Other technical logs (debug and operational): 14 days.

8. Your rights

Under the LGPD you may ask for confirmation that we process your data, access, correction, anonymization, blocking or deletion, portability, information about whom we share it with, and you may object to processing. Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection.

To exercise any of them, write to support@clickspeak.io from the e-mail address the request is about, or tell us how to confirm it is you. We answer within 15 days. For the data inside a server, the controller is whoever administers the server (see section 1): if your request is about that data, for example your membership of the server, we may forward it to the administrator or ask you to contact them.

You may also complain to a supervisory authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in the European Union, the data protection authority of your country.

9. Security

All traffic to clickspeak.io and its servers is encrypted with TLS. Access to production systems is limited to the Abstra staff who need it to run the service.

10. Children

ClickSpeak is not meant for people under 18, and we do not knowingly collect data from them.

11. Changes to this policy

We may update this policy. The date at the top always shows the latest version, and we will e-mail server administrators before any material change takes effect.

12. Contact

ABSTRA SERVIÇOS DE TECNOLOGIA SOCIEDADE LIMITADA, CNPJ 37.405.458/0001-30, Rua Visconde de Inhaúma, 134, 20º andar, sala 2001 (parte), Centro, Rio de Janeiro/RJ, CEP 20091-901, Brazil. support@clickspeak.io.