Your privacy matters at CampaignHQ

• Visit information such as IP address, browser type, and pages viewed on campaignhq.co.
• Account information such as name, email address, and billing details when you sign up.
• Service usage information, including operational data related to emails and messages sent through our platform.

Customers may upload contact data to CampaignHQ to run email, WhatsApp, SMS, and other marketing campaigns. This may include:

• Names, email addresses, phone numbers, and company details.
• Audience segments, campaign lists, and contact attributes.
• Campaign activity, delivery events, and engagement data.
• Unsubscribe, opt-out, and suppression status.
• Other campaign-related data uploaded or generated through the service.

Customers are responsible for ensuring that any contact data uploaded to CampaignHQ has been collected lawfully and that they have the required consent or other lawful basis to send communications to those contacts. CampaignHQ does not verify the lawfulness of customer-uploaded lists and does not guarantee customer compliance with privacy or marketing laws.

• Provide and operate CampaignHQ services.
• Improve our website and products through research and analysis.
• Send service-related communications and support responses.
• Process payments and help prevent fraudulent activity.

We may also send product and marketing updates only when you have opted in. You can opt out any time by using the unsubscribe link in those emails.

If you connect Google services such as Google Sheets in CampaignHQ, we access Google user data only after you authorize the connection through Google OAuth and choose the files or actions involved. We use that data to provide the integration features you request: for example, importing contacts from a spreadsheet or exporting an audience list, and not for unrelated advertising purposes.

You can disconnect the integration in CampaignHQ or revoke CampaignHQ's access in your Google Account permissions. For more detail about the Google Sheets integration, see our Google Sheets integration page. CampaignHQ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect an Instagram professional account to CampaignHQ through Instagram Login, we receive the data that Meta makes available for the permissions you approve. This includes your Instagram account ID, username, follower and media counts, your posts, reels, and stories, comments on your media, and direct messages exchanged between your account and people who contact it, along with those people's Instagram-scoped IDs and usernames.

We use this data only to provide the features you set up: showing your Instagram messages and comments in the CampaignHQ inbox, sending the replies and automated responses you configure, moderating comments on your posts, and reporting on those activities. We do not sell Instagram data or use it for advertising, and we only message people who have contacted your account first, within the window Meta allows.

You can disconnect Instagram in CampaignHQ under Settings, Integrations, Instagram, or remove CampaignHQ from Settings, Apps and websites in your Instagram account. Disconnecting stops CampaignHQ from accessing your account.

You can connect social accounts your business manages, such as an Instagram professional account, a Facebook Page, a LinkedIn Page, or a YouTube channel, so that CampaignHQ can publish and schedule posts to them and report on how those posts perform. We access an account only after you, or someone authorized for your business, approve the connection on that platform's own login and consent screen. When you connect an account, we receive:

• Account details, such as the account, Page, or channel name and ID, its profile picture, and your role on it.
• The access tokens the platform issues to CampaignHQ for the permissions you approve.
• Posts you create, schedule, or publish through CampaignHQ, including captions, images, and videos, and their publishing status.
• Performance data the platform provides for your account and for posts published through CampaignHQ, such as views, reach, likes, comments, shares, and follower counts.

We use this data only to provide the features you request: publishing and scheduling your posts, showing their status and performance, and helping you plan your content. We do not sell it or use it for advertising.

Instagram and Facebook Pages

Instagram accounts and Facebook Pages connected for publishing use Meta's Facebook Login for Business. Our use of data from Meta's platforms follows the Meta Platform Terms and Developer Policies. You can remove CampaignHQ's access from Business Integrations in your Facebook settings, from Apps and websites in your Instagram settings, or from Meta Business Suite.

LinkedIn Pages

When you connect a LinkedIn Page, we access the Page's organization details, the posts CampaignHQ publishes for it, and Page and post statistics, through LinkedIn's APIs and on LinkedIn's terms. We do not use information about LinkedIn members who view, react to, or comment on your posts to build profiles, to add them to your contacts, or for marketing, and we do not combine it with other data. We keep data read from LinkedIn only as long as LinkedIn's data storage requirements allow. You can remove CampaignHQ's access from your LinkedIn settings at any time.

If you connect a YouTube channel, CampaignHQ uses YouTube API Services to upload the videos you choose to that channel, set their title, description, privacy, and publish time, and show you how they perform. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's use of your information is described in the Google Privacy Policy.

When you connect a YouTube channel, we access and store:

• Your channel's ID, name, and thumbnail.
• Videos you upload through CampaignHQ, with the title, description, privacy setting, and publish time you choose.
• Statistics and analytics for those videos, such as views, likes, comments, and watch time.

We use this data only to upload and schedule the videos you ask us to and to report on them to you. We do not share YouTube data with anyone except the service providers that host and operate CampaignHQ, and we do not sell it. Our use of cookies and similar storage on your device is described in the Cookies section below.

You can disconnect your channel in CampaignHQ at any time, or revoke CampaignHQ's access from your Google Account security settings. When you disconnect a channel in CampaignHQ, we revoke our access and delete the YouTube data we stored within 7 days. If you revoke access from your Google Account instead, we delete it within 30 days.

• Trusted service providers (for example, infrastructure, email delivery, WhatsApp messaging, analytics, and payments) under confidentiality obligations. Our current sub-processors are listed on our Sub-processors page.
• Law enforcement or regulatory bodies when required by law, or when needed to protect rights and safety.
• As part of a merger, acquisition, or asset sale where data transfer is legally permitted.

Our current sub-processors are listed at /sub-processors.

We use reasonable technical and organizational safeguards to help protect your information from unauthorized access, disclosure, or destruction. These measures include:

• Access controls and least-privilege permissions for production systems.
• Encryption in transit for data transmitted over networks.
• Encryption at rest where supported by our infrastructure and service providers.
• Restricted production access for authorized personnel only.
• Secure credential and secrets handling practices.
• Logging, monitoring, and alerting for operational and security events.
• Backup protection and recovery procedures.
• An incident response process for security events involving personal data.

CampaignHQ has successfully completed a SOC 2 Type II audit. Details and report requests are on our Security page.

No method of storage or transmission is fully secure, so we cannot guarantee absolute security.

We retain personal data for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. Customers may request deletion or export of their data through the service or by contacting us.

When data is deleted, it may remain in backups for a limited period until those backups expire in the ordinary course of our backup retention cycle. We may also retain minimal suppression or unsubscribe records as needed to ensure opted-out contacts are not contacted again.

To delete data CampaignHQ received from Instagram, whether you are a business that connected an account or a person who messaged or commented on one, email support@campaignhq.co with the subject "Instagram data deletion" and your Instagram username. We will delete the associated Instagram data within 30 days and confirm by email. Businesses can also disconnect Instagram in CampaignHQ at any time.

When you disconnect a social account you connected for publishing, we stop accessing it and delete the data we received from that platform within the time that platform requires, and within 30 days at most (7 days for YouTube, as described above). Posts and drafts you created in CampaignHQ stay in your account until you delete them. To ask us to delete data received from a connected social account, email support@campaignhq.co with the subject "Social data deletion" and the account or Page name.

CampaignHQ is operated from India and may use service providers and sub-processors in other countries to deliver, secure, and support the service. Where GDPR or similar laws apply and personal data is transferred outside the European Economic Area (EEA), UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses where required.

Depending on your location, you may have rights regarding your personal data, including the right to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data, subject to legal and operational requirements.
• Request export or portability of personal data where applicable.
• Object to or restrict certain processing activities.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a data protection authority in your jurisdiction.

To exercise these rights, contact us at support@campaignhq.co. We will respond within a reasonable timeframe and as required by applicable law.

You can choose not to provide certain information, though that may limit your ability to use parts of our services. You can also opt out of marketing emails at any time using the unsubscribe link in those messages.

Our websites (campaignhq.co, app.campaignhq.co and blog.campaignhq.co) use cookies and similar storage in three categories. Outside India we ask which ones we may use in a cookie banner; in India all three are on until you choose otherwise. Wherever you are, you can change your choice at any time with “Cookie Settings” in the site footer. Your choice applies to all three sites and is kept for 12 months.

• Necessary (always on): security, your cookie choice (chq_consent, chq_consent_ads) and demo bookings.
• Analytics: which pages, searches, posts and campaigns bring visitors to us (chq_touches, kept for 6 months, with no personal details), and site usage through Google Analytics and PostHog.
• Targeting: letting Google and ChatGPT measure visits that come from our ads on their platforms, and limit how often you see them.

If you reject a category, we don't set its cookies and we remove the ones we set before. In the European Economic Area, the UK and Switzerland, Google tags wait for your choice before using cookies.

For customers that require a data processing agreement, our Data Processing Agreement is available at /data-processing-agreement. It applies where CampaignHQ processes personal data on behalf of customers as a processor or service provider.

Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that such information has been collected, we will take steps to delete it promptly.

We may update this policy periodically by posting a revised version on our site. For material changes, we will provide notice through email or a prominent site notification before the update takes effect.

CampaignHQ is operated by KumoHQ Software Services LLP, Salarpuria Cadenza Apt, Kudlu Gate Jn, Bommanahalli, Bangalore South, Bangalore 560068, Karnataka, India.

If you have any questions or concerns about this Privacy Policy, contact us at support@campaignhq.co.

You can also reach us through our contact page.