Clientder
Back to home

Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how Ox Industry UG (haftungsbeschränkt) ("Clientder", "we", "us") processes personal data when you visit clientder.com or use the Clientder application. It applies to visitors, registered users, and the people acting on behalf of an organization/workspace using Clientder. It is an information notice: it tells you what we do with personal data and what your options are.

1. Controller

The controller responsible for the processing described in this policy is:
Ox Industry UG (haftungsbeschränkt)
Döteberger Straße 25, 30926 Seelze, Germany
Registered with the Amtsgericht Hannover, HRB 231036
Managing Director: Mohammad Golestani Eraghi
Contact: team@clientder.com

2. Account registration and authentication

To use Clientder you need an account. Depending on how you sign up, we process:

  • Email address and a securely hashed password, for email/password accounts;
  • Your Google account identifier, name, email address, and profile picture, if you sign in with Google — Clientder never sees or stores your Google password;
  • Phone number, if you sign in with a one-time SMS code (phone/SMS OTP);
  • First name, last name, and, optionally, an organization/workspace name that you provide.

Authentication (including password storage, session management, and OAuth/OTP handling) is provided by our infrastructure provider, Supabase. Passwords are never stored in plain text and Clientder's own application code does not have direct access to them.

3. Organization/workspace and profile data

Clientder is organized around workspaces ("organizations"). We process your profile information (name, avatar) and your membership/role within the organizations you belong to, along with the organization's name, so the application can show the right data to the right members.

4. Search functionality and user-entered search criteria

Clientder's core function is to help you find companies that could be your clients. To do this, we process the search criteria you enter — such as the product or service you sell, target client type, target industry, city, and search radius — and use them to query third-party business-data, geocoding, web-search, and AI-assisted evidence-extraction providers in order to identify and evaluate potential company matches. This processing describes the kind of companies you are looking for; it is not used to build an advertising profile of you as an individual, and Clientder does not sell your search data.

The companies and contact points returned by a search, together with your saved leads, lists you create, and any exports you generate from them, are stored so you can return to and continue working with your results. This data belongs to your organization/workspace and is only accessible to members of that workspace.

5. Billing and payments

If you subscribe to a paid plan, billing and payment processing is handled by Stripe. Clientder does not receive or store your full card number. Stripe collects the billing details needed for checkout and invoicing, such as your billing name, billing address, tax ID (where you provide one) and payment details.

In our own systems we store what we need to operate your account and to keep proper accounting records: your plan, billing interval and subscription status, Stripe customer and subscription references, and records of payments and invoices (for example amounts, dates, status and Stripe reference numbers). Stripe processes billing data on our behalf and, for certain legal, regulatory and fraud-prevention purposes, under its own responsibility, as described in Stripe's own privacy documentation.

6. Hosting and infrastructure

The Clientder application is hosted on Vercel. The database, authentication service, and related backend infrastructure are provided by Supabase. Background jobs — such as running a search and the individual steps behind it, or carrying out an account deletion — are coordinated through Inngest, which receives the technical job data needed to run them. If you use phone sign-in, the SMS one-time code is delivered through Twilio. Where we send authentication or transactional emails (such as confirmation and password-reset emails), they are delivered through IONOS.

7. Technical and server logs

Like any web application, our hosting and infrastructure providers generate standard technical logs (such as IP address, request timestamps, and error information) in the course of operating the service. We use this information for operating, securing, and troubleshooting the service, and for preventing abuse and fraud — not for advertising or analytics profiling. Such logs are kept by those providers for their own rotation and security retention periods (see Section 12).

8. Cookies

Clientder sets only the first-party cookies listed below, which make the service work. We do not use analytics cookies, advertising or marketing pixels, or other tracking technologies.

  • Sign-in session cookies (names beginning with "sb-", set through our authentication provider Supabase) — keep you signed in and protect your session. They last up to 400 days when you stay signed in (the "Remember me" option on the sign-in form is on by default, and new accounts start out that way); if you switch it off, they last about one day, renewed while you keep using Clientder.
  • sb-remember-me — remembers your "Remember me" choice, so the sign-in cookies get the matching lifetime. It holds no session data and lasts as long as the sign-in cookies it describes.
  • clientder-locale — remembers your language. On your first visit it is set automatically from your browser's language settings and a country indication from our hosting platform, and it is updated when you choose a language. It contains only the language code and lasts up to 400 days.
  • clientder-plan-intent — if you choose a plan on the pricing page before you have signed in, remembers that plan and billing interval for one hour so you can continue after signing up or signing in.

If you are redirected to Google (to sign in with Google) or to Stripe (for checkout or to manage your subscription), those providers may set their own cookies under their own policies.

9. Legal bases for processing (GDPR)

We process personal data on the following legal bases under Art. 6(1) GDPR:

  • Art. 6(1)(b) — processing necessary to provide the Clientder service under our Terms of Service (account, search, saved leads, lists, exports, billing);
  • Art. 6(1)(c) — processing necessary to comply with a legal obligation we are subject to (e.g. keeping invoices and other accounting records under German commercial and tax law);
  • Art. 6(1)(f) — processing necessary for our legitimate interests, in particular keeping the service secure, preventing abuse and fraud, maintaining technical logs, keeping the limited deletion and account-merge records described in Section 12, and establishing, exercising or defending legal claims.

We do not rely on your consent for the processing described in this policy. If we ever ask for your consent for a specific purpose, we will say so at that point. Agreeing to our Terms of Service is a contractual matter and is separate from this information notice.

10. Recipients and processors

We share personal data only with service providers who process it on our behalf to operate Clientder, in particular: Supabase (database and authentication infrastructure), Vercel (application hosting), Inngest (background job coordination), Twilio (SMS delivery, where phone sign-in is used), IONOS (delivery of authentication and transactional emails), and Stripe (payment processing), plus the third-party business-data, geocoding, web-search, and AI-assisted evidence-extraction providers used to generate search results described in Section 4. We do not sell personal data to third parties.

11. International data transfers

Some of our service providers may process data outside the European Economic Area. Where that is the case, such transfers are carried out on a legally recognized basis under GDPR (such as the EU Standard Contractual Clauses or another applicable safeguard) as offered by the relevant provider.

12. Retention and account deletion

While your account is active, we keep your data for as long as necessary to provide the service.

Requesting deletion. You can ask for your account to be deleted. Where self-service deletion is available for your account, you can start it in Settings → Privacy & Data after verifying your identity. Where it is not available, or cannot proceed (see "Unresolved billing matters" below), you can send us your request by email and we will handle it manually.

What is erased. When a deletion request is accepted, your access ends, an active subscription is cancelled, and the account and workspace data tied to you — such as your profile, workspace membership, searches and their results, saved leads, lists, usage records and temporary security tokens — is erased from our active systems according to our deletion process. Your sign-in identity is removed as well.

What may remain. Deletion does not mean that no record of your account can exist anywhere. The following may remain, for the reasons given:

  • Accounting and tax records. Invoices, accounting vouchers and related payment records and references that German commercial and tax law requires us to keep (Art. 6(1)(c) GDPR). As a general guide, German law currently provides for: invoices and accounting vouchers (Buchungsbelege) — 8 years; books, inventories, annual financial statements and comparable records — 10 years; commercial and business correspondence — 6 years. These periods generally start at the end of the calendar year in which the record arose, and may be extended where tax law requires continued retention.
  • A pseudonymized organization record. To keep retained billing records linked to the right account without keeping your organization's name, we keep a pseudonymized record of the organization (an internal identifier and technical timestamps). It is not anonymous: it can be linked to the retained billing records, so we keep it only as long as those records need it.
  • Limited deletion and security records. A short record that an account deletion or account merge took place — internal account and organization identifiers, its status and timestamps, and no content of your searches or leads. We keep it for security, accountability (to be able to show that a deletion was carried out), to establish, exercise or defend legal claims, and so that a deletion can be respected again if systems are ever restored from a backup (Art. 6(1)(f) GDPR). We keep these records for as long as these purposes apply, judged by the applicable accountability, security and limitation periods; once they no longer apply, the records are deleted or further reduced.
  • Records at Stripe. Stripe may continue to hold billing and customer information — such as billing name, address, tax ID, invoices and payment records — where this is needed for invoicing, payment processing or its own regulatory retention. Deleting a Clientder account therefore does not necessarily delete invoices and payment records held by Stripe that must be kept. As part of an account deletion we remove the Stripe customer record only where it has no invoice or payment history and can be removed; otherwise it stays.
  • Technical payment-event records. We keep technical records of payment events received from Stripe for payment processing and troubleshooting. When an account is deleted, the personal content of the records linked to it is removed; only a minimal technical record remains while retained payment records refer to it.

Unresolved billing matters. An unresolved billing matter may prevent self-service account deletion until it is resolved. This applies, for example, to an overdue or unpaid payment, an open invoice, a pending balance, or billing information we cannot verify at that moment. In that case your request is not started and nothing is deleted. Contact us at team@clientder.com and we will help.

Backups and logs. After data is deleted from our active systems, residual copies can remain for a limited time in protected backups and in provider logs, until they are overwritten or expire under the rotation and security retention periods of those systems. They are not used as active product data. Where data is restored from a backup, we re-apply the deletion. We do not state those periods here because they depend on our providers' systems and settings.

13. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

  • access the personal data we hold about you;
  • request rectification of inaccurate data;
  • request erasure of your data;
  • request restriction of processing;
  • data portability, for data you provided to us; and
  • object to processing based on our legitimate interests.

How to exercise them. Some profile details can be changed in your account settings. For anything else — including a copy of your personal data (access and, where applicable, portability), correction, restriction, objection or erasure — email us at team@clientder.com. We may need to verify your identity first; writing from the email address of your account helps. Clientder does not currently offer a self-service data export in the application, so requests for a copy of your data are handled by us manually. We respond without undue delay and in any case within the time limits required by law.

For deletion, see Section 12: self-service deletion is offered in Settings → Privacy & Data where it is available for your account, and requests that cannot be handled there are handled manually via the address above. Your rights are subject to legal limits; for example, we cannot erase records that we are legally required to keep (see Section 12).

You also have the right to lodge a complaint with a data protection supervisory authority. You may contact the authority in your own country/state, or the authority responsible for our registered seat in Lower Saxony, Germany: the Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen).

14. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes to the service or to applicable law. We will update the "Last updated" date above when we do. If changes are material, we will take reasonable steps to notify active users.

15. Contact

Questions about this policy or about how we handle your data can be sent to team@clientder.com.