Privacy Policy
Version: 2026-10-22.
Effective date: October 22, 2026.
Who handles your information
Rostislav Semenov, an individual based in New York City, New York, USA, operates Click2Approve. Send privacy questions and requests to contact@click2approve.com. Do not include passwords or post private information in public GitHub issues.
We control account administration, billing, security, and our customer relationship. An organization generally controls personal information it puts in its workspace; we process that information on its instructions. Contact the organization about its records, and contact us if you need help routing a request. A separate data processing agreement is needed where applicable law requires one. Independently hosted installations have their own operators and privacy practices.
Information we handle
| Category | Examples and sources |
|---|---|
| Account and security | Email, name, avatar, saved signature, preferences, identifiers, password hashes, passkey public credentials, MFA and recovery data, API-token records, and signup acknowledgement versions and timestamp. These come from you and your account activity. Device face or fingerprint templates are not sent to us for passkeys. |
| Workspace content | Employee details, requests, documents, discussions, signatures, decisions, receipts, and workflow history provided by you, your organization, and other participants. |
| Billing | Subscription, invoice, customer identifiers, and payment status from you and Stripe. Stripe handles payment details entered on its hosted payment pages. |
| Technical and support | Request metadata such as IP address and browser information, service and security logs, and messages you send for help. |
Submit only information needed for your workflow. Our Terms restrict sensitive and regulated records.
Why we use it
We use information to operate accounts and workflows, store and share requested records, send service notifications, process subscriptions, provide support, prevent abuse, fix errors, and meet legal obligations.
Where GDPR or UK GDPR applies, the legal bases are contractual necessity for necessary account and service operations, legitimate interests in security and service administration balanced against your rights, and applicable legal obligations. We request separate consent when required and allow it to be withdrawn. Organizations must establish the basis for information they instruct us to process.
Necessary account details are required to register. Optional marketing or tracking consent is separate from signup. Acknowledging this policy does not give blanket consent to other uses. We do not make automated decisions about you with legal or similarly significant effects.
Sharing and providers
We share information with participants and administrators according to workspace permissions and your actions. Service emails may include names and content excerpts. Public receipt links let anyone with an active link view the disclosed receipt, potentially including signatures. Revocation cannot recall copies already saved by recipients.
Microsoft Azure provides hosting, database, storage, queues, and transactional email. With your permission, Google provides audience measurement for the website, documentation, and application as described below. Stripe provides payments and may independently control some payment information. Contacting us at Gmail also involves Google's email service. Providers handle information needed for those functions. We may also disclose information to meet legal requirements, protect rights and security, or complete a business transfer subject to applicable protections.
We do not sell personal information or share it for cross-context behavioral advertising, and we do not use advertising trackers. Our website does not change its operation in response to browser Do Not Track signals. Providers may collect technical information when you interact with their services; their own notices also explain their practices.
Browser storage
The app stores authentication tokens, workspace selection, appearance, and related session preferences in browser local storage. Closing a tab does not clear these values. Signing out removes session tokens; some preferences remain. You can clear browser storage yourself.
Optional analytics
We use Google Analytics on the public website, documentation, and application only after you enable Allow analytics in the optional analytics banner. Turning the toggle off disables analytics. Closing the banner without enabling it keeps analytics disabled. This choice is separate from signup agreement and does not affect access to the service. The same browser preference applies across these pages on the same site, including open tabs.
After acceptance, Google Analytics uses cookies such as _ga and _ga_... to measure visits and understand how pages and app screens are used. Google receives page-view and technical information, such as the public page address and title or an app screen category, browser and device information, and the network information needed to receive the request. We omit URL query strings, fragments, and referring-page addresses from the page views we send. In the app, we send fixed screen names and route templates with resource identifiers replaced, rather than actual account, workspace, task, request, or receipt addresses. We do not send account details, document content, or workspace identifiers, and we do not enable Google advertising features through this integration. Google's processing may take place in the USA and other countries; see Google's Privacy Policy.
We remember your analytics choice in this browser's local storage for up to 180 days. Analytics cookies are configured with a 180-day lifetime. Use Analytics settings in the website, documentation, or app footer to change your choice. Turning analytics off stops further collection and removes Analytics cookies accessible to this website; it does not recall information already sent to Google. Clearing browser storage or using another browser may require choosing again.
Retention and security
Requests and notifications follow workspace retention: one month on Personal Free and Business Trial, and configurable periods on paid plans, including no automatic expiry. Other data, such as receipts, account information, logs, and billing records, follows its own purpose and retention needs. We keep information as needed to provide the service, comply with legal recordkeeping duties, secure accounts, and resolve disputes, then delete or anonymize it when no longer needed.
Deletion can be blocked by related records. Files and organizations may be removed through background processing. Billing recovery expiry can remove workspace data; removing workflow data does not necessarily delete your account. Copies held by other recipients may remain. See Retention and deletion.
Access controls and authentication help protect information, but no service is completely secure. We remain responsible for security measures and breach notifications required by law.
International processing and your rights
Our operator is in the USA, and providers may process information in other countries. Where applicable law requires international transfer safeguards, those arrangements must be in place. Contact us for information about processing locations and applicable safeguards.
Depending on applicable law, you may request access, correction, deletion, a copy or portability, restriction, or objection to processing. You may withdraw consent where we rely on it, use an authorized agent where permitted, or appeal a denied request by replying to our decision. We may verify identity proportionately and will respond within applicable legal deadlines. Rights may be subject to legal exceptions and organization instructions. We will not unlawfully discriminate against you for exercising them. You may complain to a competent privacy regulator.
The service is intended for adults aged 18 or older. Contact us if you believe a child has provided personal information.
Updates
We will update the version and provide notice of material changes where required. Processing that needs new consent will have a separate request. Contact contact@click2approve.com for questions or rights requests.