Cleyo is built for recruiters who handle other people's data every day, so we hold ourselves to a high bar. This page explains exactly what we collect, why, and the control you have over it.
Last updated: June 24, 2026
This Privacy Policy describes how Cleyo ("Cleyo", "we", "us", or "our") collects, uses, and protects personal data when you use our website at cleyo.io, our web application at app.cleyo.io, and the Cleyo browser extension (together, the "Services").
Cleyo is a business development platform for recruiters. We help you find companies that are hiring, identify the right people to contact, and run multi-step outreach campaigns. Because our Services involve professional contact data, we act as a data controller for the information we hold about our own users, and as a data processor for the prospect data you load into your workspace. We are committed to handling all of it in line with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.
When you create an account we collect your name, email address, password (stored only as a salted hash), company name, and the preferences you set, such as your email signature and timezone.
When you connect a mailbox or messaging account, we store the credentials needed to send messages on your behalf. These credentials are encrypted at rest and are only used to deliver the campaigns you create. We process the content of the emails and messages you draft and send through Cleyo, along with delivery, open, and reply events.
To run outreach you load or generate professional contact data about the decision makers you want to reach, such as names, job titles, employers, business email addresses, and LinkedIn profile URLs. Some of this is entered by you, and some is retrieved through our enrichment and search providers. You are responsible for having a lawful basis to process the prospect data you bring into Cleyo.
We log technical information needed to operate and secure the Services, including IP address, browser and device type, the pages and features you access, and timestamps. We keep records of security-relevant actions so we can detect and investigate abuse.
Subscriptions and credit purchases are handled by a third-party payment provider. We do not see or store your full card number. We retain billing metadata such as plan, invoice history, and the last four digits of your card.
We use personal data only for the purposes below, each with a lawful basis under the GDPR:
We do not sell your personal data, and we do not use the content of your mailboxes, messages, or prospect lists to train machine learning models.
The Cleyo browser extension keeps your Cleyo workspace in sync while you work on LinkedIn. It is optional, and you can remove it at any time from your browser. The sections below describe exactly what it does with data.
The extension keeps your workspace up to date by syncing periodically in the background. It only activates on LinkedIn and only saves a profile when you ask it to.
Our use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:
The extension only works on LinkedIn. It does not access the pages you visit on other websites.
We share personal data only with the categories of service providers (sub-processors) that help us run Cleyo, each bound by contract to protect it and use it only on our instructions:
We provide a current list of the specific sub-processors we use to customers on request at support@cleyo.io. We may also disclose data when required by law, to enforce our terms, or to protect the rights, safety, and security of Cleyo and our users. If Cleyo is involved in a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy.
Some of our providers may process data outside your country, including outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to ensure your data receives an equivalent level of protection.
We keep personal data only for as long as we need it. Account and workspace data is retained while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must keep certain records longer to meet legal, tax, or security obligations. Connected mailbox tokens are deleted as soon as you disconnect an account.
Security is a core part of how Cleyo is built. We apply industry-standard safeguards, including:
No system is perfectly secure, but we work continuously to protect your data and to meet recognized privacy and security standards.
Depending on where you live, you have rights over your personal data. For users in the EEA and the UK, these include the right to:
You can exercise most of these rights directly from your account settings, or by contacting us at the address below. You also have the right to lodge a complaint with your local data protection authority.
We use cookies and similar technologies that are strictly necessary to keep you signed in and to keep the Services secure. We do not use third-party advertising cookies. The browser extension stores its settings and a local activity log in your browser's local storage, which never leaves your device except as part of the sync described above.
Cleyo is a professional tool intended for business use. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app or by email. Your continued use of the Services after an update means you accept the revised policy.
If you have questions about this policy or how we handle your data, or you want to exercise your rights, contact our privacy team at:
Cleyo
support@cleyo.io