Privacy Policy

1. Who We Are

Campalio helps founders and teams build pre-launch campaigns, publish waitlist pages, collect signups, track referrals, and analyze campaign traffic. Campalio is operated by Usama Afzal, an individual sole proprietor based in Pakistan ("Campalio", "we", "our", or "us").

This Privacy Policy explains how we handle personal data when you visit https://campalio.com, use the Campalio app or API, or join a waitlist that runs on Campalio. We are the controller of the data about our account holders. For data about people who join our customers' waitlists, we act as a processor on our customers' behalf (see Section 5).

2. Information We Collect

• Account information: your name, email address, a hash of your password (if you sign up with email), and your account settings.
• Sign-in provider data: if you sign in with Google, Microsoft, or GitHub, we receive your account ID with that provider, your verified email address, your name, and your profile picture URL.
• Billing information: Lemon Squeezy, our merchant of record, collects your payment and billing details. We receive only your customer and subscription identifiers, your plan, and your renewal dates. We never receive your full card number.
• Campaign content: the campaigns, page copy, logos, images, rewards, and settings you create.
• Waitlist subscriber data: for each person who joins a waitlist, their email address, the result of an email validity check, their referral code and who referred them, referral counts, signup time and status, consent records (if the waitlist asks for consent), unsubscribe status, delivery events such as bounces and spam complaints, and the answers to any extra form fields or questions the waitlist owner chooses to ask.
• Traffic attribution: the UTM parameters (utm_source, utm_medium, utm_campaign), referring page, and landing page of each signup.
• Feedback and support: messages you send us through the in-app feedback form, together with your email address, the page you sent it from, and your browser type, and any emails you send to our support addresses.
• Technical and security data: we process IP addresses and browser information while handling requests, to limit request rates and to stop bots on signup forms. We do not store IP addresses with subscriber records.

3. How We Use Information and Our Legal Bases

• To provide the Service (performance of our contract with you): creating and securing your account, running your campaigns and waitlists, counting referrals, showing analytics, and handling exports.
• To send service emails (contract): sign-in codes, password resets, capacity alerts, billing notices, and the confirmation emails your waitlist sends to its subscribers.
• To keep the Service safe (legitimate interests): preventing spam, fake signups, abuse, and attacks on waitlist forms.
• To improve the Service (legitimate interests): understanding, in aggregate, how features are used. We do not use third-party advertising or tracking tools.
• To meet legal obligations (legal obligation): for example, keeping records related to payments and responding to lawful requests.

We do not sell personal data, we do not use it for advertising, and we do not use your data or your subscribers' data to train artificial intelligence models.

5. Waitlist Subscriber Data (for Waitlist Owners)

When people join your waitlist, you decide what to collect and why. You are the controller of that data, and Campalio stores and processes it on your behalf as your processor. In practice:

• We only use it to run your waitlist: storing signups, sending the emails you set up, counting referrals, and showing you analytics. We never sell it, never email your subscribers for our own purposes, and never share it with other customers.
• Consent: you can add a consent checkbox to your form with your own wording. When a subscriber ticks it, we store the time and the exact wording they saw.
• Subscriber requests: you can export your list and permanently delete any subscriber from your dashboard at any time. If a subscriber contacts us directly, we pass the request on to you.
• Unsubscribing: every email we send to your subscribers includes an unsubscribe link.
• When you leave: email support@campalio.com and we will permanently delete your account and all of your subscriber data within 30 days.
• Security incidents:if a breach affects your subscribers' data, we will tell you without undue delay so you can meet your own obligations.

If you joined someone's waitlist and want your data removed, contact the product owner who runs it, or use the unsubscribe link in any of their emails. You can also email us and we will forward your request.

6. Service Providers We Share Data With

We share personal data only with the providers we need to run the Service, and only for that purpose:

• Payments: Lemon Squeezy, our merchant of record, processes subscription payments, taxes, and invoices.
• Email delivery: Amazon Web Services (SES), Resend, and Brevo send account emails and the emails your waitlist sends to its subscribers.
• Email checks:debounce.io receives a subscriber's email address to check whether it is a temporary inbox. mailcheck.ai and Kickbox receive only the email domain.
• Bot protection and file storage: Cloudflare runs Turnstile challenges on signup forms and stores uploaded logos and images.
• Hosting and database: Vercel hosts the website, and Railway runs our API and PostgreSQL database.
• Sign-in providers: Google, Microsoft, and GitHub, when you choose to sign in with them.
• Fonts in emails: our emails load fonts from Google Fonts, so Google receives the IP address and browser details of the device that opens an email.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the Service, or as part of a sale or transfer of the business. In a transfer, this Privacy Policy will continue to apply to your data.

7. International Data Transfers

Our service providers may process data in the United States, the European Union, and other countries. Where data protection law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses offered by our providers.

8. Cookies and Local Storage

• Essential cookies: secure, HTTP-only cookies (access_token and refresh_token) keep you signed in. The Service cannot work without them.
• Local storage: your browser stores preferences such as your theme and selected campaign, and remembers that you already joined a waitlist so the page can show your referral link. Session storage notes which pages were already viewed in the current browser session, so each page view is counted once.
• Bot protection: Cloudflare Turnstile checks browser signals on signup forms to tell people from bots.

We do not use advertising cookies or third-party analytics trackers.

9. Data Retention

• We keep account and campaign data while your account is active. If you ask us to delete your account, we permanently delete it, including all subscriber data, within 30 days.
• Feedback you sent us through the app is kept to help us improve the Service. When you delete your account it is unlinked from the account, but it keeps the email address you sent it from. Email us and we will delete it.
• Waitlist owners control their subscriber data and can delete individual subscribers at any time.
• Lemon Squeezy keeps payment and tax records for as long as the law requires.

10. Security

We use technical and organizational measures to protect personal data, including:

• TLS encryption for all data in transit;
• Argon2 hashing for passwords;
• hashing of API keys and one-time sign-in codes, so they are never stored in plain text; and
• access limited to the people and systems that need it to run the Service.

No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

11. Your Rights

Depending on where you live, including under the GDPR, the UK GDPR, and the CCPA, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing;
• receive your data in a portable format; for example, waitlist owners can export subscribers as CSV;
• withdraw consent where we rely on it; and
• complain to your local data protection authority.

To exercise these rights, email privacy@campalio.com. We respond within 30 days. You can unlink sign-in providers in Account Settings at any time.

12. Children

Campalio is a business tool and is not directed at children. Account holders must be at least 18. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy as the Service changes. We will update the effective date above, and we will notify account holders by email or in the app at least 14 days before a material change takes effect.