Privacy Policy
ClickTree is a tree testing tool for checking whether people can find things in a website or app’s navigation. This policy explains what personal data we handle, why, and the choices you have. We’ve kept it as plain as we can.
Who we are
ClickTree is based in England and Wales.
In this policy, “we”, “us” and “our” mean ClickTree. You can reach us using the contact form.
Our two roles
We handle personal data in two different ways, and the law treats them differently:
- As a controller for data about people who sign up for ClickTree, visit our website or contact us. We decide how that data is used, and this policy covers it fully.
- As a processor for data collected from participants in studies that our customers run. The organisation running the study (our customer) is the controller. They decide what to ask and how answers are used. We store and process the data only on their instructions, under our Terms.
If you took part in a study and have a question about your answers, the best first step is to contact the organisation that invited you. We’ll help them, and you, where we can.
Account holders
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, email address, company name, and your password (stored only as a secure hash by our authentication provider) | To create and secure your account and workspace | Contract |
| Profile photo, if you upload one | To show you to your teammates | Contract |
| Workspace content: clients, studies, navigation trees, tasks, images and page screenshots for first-click tests, settings, client logos and colours | To provide the service | Contract |
| Team membership and invitations (the email addresses you invite) | To let you share a workspace | Contract; legitimate interests (for people you invite) |
| Plan and usage (for example, responses this month) | To apply plan limits | Contract |
| Billing details for paid plans: billing name, email and address, plan and payment history. Card details are handled by our payment provider, Stripe; we never see full card numbers. | To take payment | Contract; legal obligation (tax records) |
When you ask ClickTree to screenshot a web page, our servers load that public page once in a browser, save the image to your study and keep the page address so you can retake it. We don’t send cookies or sign-in details to the page.
We don’t sell your data, use it for advertising, or use your workspace content to train AI models. The insights ClickTree shows on results are calculated by fixed rules in your browser and on our servers, without third-party AI.
Study participants
When someone takes part in a study through a ClickTree link, we collect on behalf of the organisation running it:
- Their answers: for example, which places in a menu they opened, where they clicked, which design they chose, how they grouped cards, what they wrote, whether they skipped, and how long each step took.
- Screening answers, if the organisation asks screening questions before the study. If someone is screened out or their group is already full, their answers aren’t kept: we only count that it happened.
- Optional details, only if the organisation turned them on: name, email address and gender.
- A participant ID if they arrived from a research panel that adds one to the link, and any link tags the organisation added to the link (such as which group or panel it was sent to).
- Technical information: their browser type (user agent), whether they used a desktop or mobile device (worked out from their screen size, so results can be compared), and a random token that lets them resume on the same device. The token is stored in their browser’s local storage, not a cookie.
Participants aren’t asked to create an account. Organisations using ClickTree must tell their participants what they collect and why, and must have a lawful basis for doing so. They shouldn’t ask for more than they need.
Website visitors and contact
- Contact form: your name, email, topic and message. We use them to reply, and keep a copy so nothing is lost (legitimate interests).
- Abuse protection: to stop spam and floods of fake responses, we keep a one-way scrambled (hashed) version of visitors’ IP addresses for a short time when they sign up, contact us or take part in a study. We never store the IP address itself (legitimate interests).
- Hosting logs: our hosting provider keeps standard short-term server logs for security and reliability.
We don’t use analytics, advertising or tracking tools on the website, and our fonts are served from our own site, so visiting ClickTree doesn’t send your data to third parties such as Google.
Where data is stored
ClickTree’s database and files are hosted in the EU. Some providers are US companies or may access data from outside the UK and EU, for example for support. Where that happens, we rely on the safeguards the law requires, such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK–US and EU–US data bridge and Data Privacy Framework where the provider is certified.
How long we keep data
- Account and workspace data: while your account is open. If you ask us to close your account, we delete it within 30 days, apart from anything we must keep by law, such as invoices.
- Study responses: until the organisation running the study deletes them, deletes the study, or closes their account. They can delete individual responses at any time.
- Contact messages: up to 24 months.
- Hashed IP addresses for abuse protection: deleted automatically, normally within a few days.
- Backups: deleted data can remain in encrypted backups for a short period until those backups expire.
Security
Data is encrypted in transit and at rest. Each workspace is separated at the database level, so one customer can’t see another’s studies or results. Passwords are never stored in readable form. Invite links are single-use, expire after 14 days and are stored only in scrambled form. Access to production systems is limited to the people who need it.
Your rights
Under UK and EU data protection law you can ask to access, correct or delete your personal data, to restrict or object to how it’s used, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
Account holders can change their password, photo and team from the Account page, and can export study results to CSV. For anything else, contact us. We’ll reply within one month.
If you took part in a study, please contact the organisation that invited you first, since they control that data. If you can’t reach them, contact us and we’ll pass your request on.
Children
ClickTree accounts are for people aged 18 and over. Organisations running studies are responsible for making sure participants are old enough to take part, or have appropriate consent, under the law that applies to them.
Changes to this policy
If we make important changes, we’ll update the date at the top of this page and, where appropriate, let account holders know by email or in the app.
Contact and complaints
For privacy questions or requests, use our contact form and choose “General question”.
If you’re unhappy with how we’ve handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live. We’d appreciate the chance to put things right first.