CCAMO ("we", "our", "us") operates a cloud-based platform that enables digital agencies to manage clients, teams, files, tasks, messaging, and operational workflows ("the Platform"). This Privacy Policy explains what personal data we collect, why we collect it, the lawful basis on which we process it, how long we keep it, who we share it with, and what rights you have in relation to it. This policy applies to all users of the Platform including agency owners, administrators, team members, and clients accessing the Platform via an agency account. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.
The data controller responsible for your personal data is: CCAMO support@ccamo.io For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, CCAMO is the data controller in respect of personal data collected directly from users of the Platform. Where agencies upload data relating to their own clients, the agency is the data controller of that data and CCAMO acts as a data processor on the agency's behalf.
2.1 Account Information When users create an account we collect: • Full name • Email address • Password (stored in encrypted form — we do not have access to your plaintext password) • Agency name • Account role (Owner, Admin, Team Lead, Team Member, or Client) 2.2 Usage Data We automatically collect information about how the Platform is used, including: • IP address • Browser type and version • Device type and operating system • Pages and features accessed within the Platform • Timestamps of activity • Activity logs generated through use of the Platform This data is collected to maintain the security and performance of the Platform and to understand how users interact with it. 2.3 Agency-Uploaded Client Data Agencies using the Platform may upload data relating to their own clients. This may include client contact information, project details, files, documents, and messages. CCAMO processes this data solely on the instruction of the agency. The agency is the data controller of this data and is responsible for ensuring they have a lawful basis for uploading and processing it through the Platform. 2.4 Referral Data If you participate in the CCAMO Referral Scheme, we collect and store your unique referral code, the number of users referred by you, the conversion status of those referrals, and the discount or benefit tier associated with your referral activity. 2.5 Billing Information Billing and payment data is processed directly by Paddle, our payment processor. CCAMO does not store your full card details. We receive from Paddle only the information necessary to manage your subscription, including subscription status, plan type, and billing history.
Under UK GDPR, we are required to identify a lawful basis for each type of personal data processing we carry out: Creating and managing user accounts — Contract: necessary to provide the Platform services Authenticating users and maintaining session security — Contract: necessary to provide the Platform services Storing and processing agency-uploaded client data — Contract: processing on behalf of the agency as data controller Monitoring platform performance and security — Legitimate interests: to operate and secure the Platform Improving platform functionality and user experience — Legitimate interests: to develop and improve our product Sending service-related communications (e.g. billing, account notices) — Contract: necessary to manage the subscription relationship Sending optional marketing or product update emails — Consent: only where you have opted in Complying with legal and regulatory obligations — Legal obligation: where required by applicable law Processing referral scheme activity and applying discounts — Contract: necessary to administer the referral scheme
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law: Account information (active accounts) — Retained for the duration of the active subscription Account information (cancelled or terminated accounts) — Retained for 90 days post-termination, then permanently deleted Usage and activity logs — Retained for 12 months from the date of collection Agency-uploaded client data — Retained while the agency account is active; deleted within 90 days of account termination unless the agency requests earlier deletion Billing and transaction records — Retained for 7 years in accordance with UK financial record-keeping obligations Referral scheme data — Retained for the duration of scheme participation and for 12 months following the end of participation Communications and support correspondence — Retained for 2 years from the date of the last communication Where retention is required beyond these periods by law or for the purposes of legal proceedings, data will be retained for the minimum period necessary to fulfil that requirement.
5.1 Current Sub-Processors CCAMO currently uses the following third-party sub-processor to deliver the Platform: Replit, Inc. — Application hosting and database infrastructure — United States As the Platform develops, additional sub-processors may be engaged for services including payment processing, file storage, and messaging. This section will be updated when new sub-processors are added. Users will be notified of material changes. 5.2 Data Sharing We do not sell, rent, or share your personal data with third parties for their own marketing purposes. Personal data may be shared in the following limited circumstances: • With sub-processors listed above, solely for the purpose of delivering the Platform • With legal or regulatory authorities where required by law • In connection with a business transfer, merger, or acquisition, where user data may transfer as part of the transaction — users will be notified in advance where required by law
CCAMO's Platform is currently hosted by Replit, Inc., a company based in the United States. The operation of the Platform therefore involves the transfer of personal data outside the United Kingdom. This transfer is conducted under the following safeguards in accordance with UK GDPR requirements: • A Data Processing Agreement (DPA) is in place with Replit that incorporates the UK International Data Transfer Agreement (IDTA) and Standard Contractual Clauses (SCCs), providing appropriate contractual safeguards for the transfer • The UK-US Data Bridge framework, established in 2023, provides an additional legal basis for the transfer of personal data between the UK and qualifying US organisations • Replit's DPA is publicly available at replit.com/dpa. A copy of Replit's sub-processor list is available at replit.com/subprocessors. Where additional sub-processors are engaged in future that involve international transfers, appropriate safeguards will be put in place and disclosed in this policy.
Under UK GDPR, you have the following rights in respect of your personal data: Right of Access — You can request a copy of the personal data we hold about you Right to Rectification — You can ask us to correct inaccurate or incomplete personal data Right to Erasure — You can ask us to delete your personal data where there is no lawful reason to continue processing it Right to Restriction — You can ask us to restrict processing of your data in certain circumstances Right to Data Portability — You can request your data in a structured, machine-readable format for transfer to another service Right to Object — You can object to processing based on legitimate interests or for direct marketing purposes Right to Withdraw Consent — Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing To exercise any of these rights, please contact us at support@ccamo.io. We will respond to all valid requests within 30 days. In some cases, we may need to verify your identity before processing your request. If you are not satisfied with how we handle your request or your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include: • Encrypted password storage — passwords are hashed and are not accessible in plaintext • Access controls — user data is accessible only to authorised personnel and systems • Secure hosting — the Platform is hosted on Replit infrastructure which maintains its own security programme as detailed in the Replit DPA • Session authentication — secure session tokens are used to manage user access While we take data security seriously, no system is entirely immune from risk. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach and will notify affected users without undue delay where required by law.
The Platform is intended solely for use by individuals aged 18 or over in a professional business capacity. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from a minor, we will take steps to delete that data promptly. If you believe a minor has provided us with personal data, please contact us at support@ccamo.io.
The Platform uses cookies and similar technologies to maintain session authentication, ensure security, and understand how the Platform is used. Full details of the cookies we use, their purpose, and how to manage them are set out in the CCAMO Cookie Policy.
We may update this Privacy Policy from time to time to reflect changes to our data practices, legal requirements, or the Platform itself. Where updates are material, we will notify users via email or in-platform notification before the changes take effect. The effective date at the top of this document will always reflect the date of the most recent update. Continued use of the Platform after an updated Privacy Policy takes effect constitutes acceptance of the updated policy.
For any privacy-related queries, requests to exercise your data subject rights, or concerns about how we handle your personal data, please contact: CCAMO support@ccamo.io We aim to respond to all privacy-related enquiries within 5 business days and to all formal data subject requests within 30 days.