Privacy Policy

1. Overview & Commitment

Welcome to Campalio("we", "our", or "us"). Campalio provides founders, creators, and teams with tools to build pre-launch campaigns, publish waitlist landing pages, capture prospective leads, track referral shares, and analyze campaign traffic.

We are committed to protecting your personal data and respecting your privacy rights. This Privacy Policy outlines how your personal information is collected, processed, stored, and safeguarded when you visit or use our platform at https://campalio.com, our API services, and associated applications.

2. Information We Collect

We collect information in the following categories:

• Account Information: When you register as a creator, we collect your name, email address, password hash (if using credentials authentication), and workspace preferences.
• Social Identity Provider (OAuth) Data: If you sign in via Google, Microsoft, or GitHub, we receive your provider identity ID (e.g. Google sub, Microsoft oid, GitHub numeric ID), verified primary email address, profile name, and avatar URL.
• Campaign & Waitlist Submissions: Data created within your campaigns, including custom form fields, waitlist subscriber email addresses, referral codes, timestamps, and survey responses.
• Analytics & Traffic Attribution: Public waitlist visitor metadata such as UTM parameters (utm_source, utm_medium, utm_campaign), referrer headers, anonymized client IP hashes for rate limiting, and interaction timestamps.
• Cookies & Session Tokens: Secure, HTTP-only authentication tokens (access_token and refresh_token) required to maintain your login session.

3. How We Use Your Information

Your information is used strictly to provide and enhance our services, including:

• Authenticating your creator account and securing API requests.
• Managing your campaigns, waitlists, rewards, and lead pipelines.
• Dispatching transactional emails (such as 6-digit OTP verification codes and password reset instructions).
• Tracking referral counts, milestones, and leaderboard rankings for your subscribers.
• Generating aggregated analytics reports and performance metrics for your campaigns.
• Preventing automated spam, abusive lead generation, and DDoS attacks on waitlist forms.

5. Data Sharing & Third-Party Service Providers

We do not sell, rent, or trade your personal data to third parties. We share data only with trusted infrastructure and service vendors necessary for platform operation:

• Email Delivery: Transactional email providers (e.g. Brevo / Nodemailer) for OTP verification and notification delivery.
• Cloud Hosting & Database: Secure cloud infrastructure and PostgreSQL database services protected by encryption at rest.
• Identity Providers: Google, Microsoft, and GitHub to facilitate user-initiated OAuth authentication.

6. Data Security & Retention

We apply industry-standard technical and organizational security measures, including:

• HTTPS / TLS 1.3 encryption for all data in transit across public networks.
• Argon2 cryptographic hashing for user passwords.
• HMAC cryptographic hashing for API keys and OTP verification records.
• Single-method unlink safeguards preventing accidental lockout of social-only accounts.

We retain your data for as long as your account is active or as needed to provide you services. You may request data deletion or export at any time.

7. Your Rights & Choices

Depending on your jurisdiction (including GDPR and CCPA), you have the right to:

• Access and download the personal data we hold about you.
• Export your campaign waitlist leads in standard CSV format.
• Unlink connected social identity providers via Account Settings.
• Request deletion of your account and all associated campaign data.