How your data is protected
What we do, what you are responsible for, and exactly how to get your data back out. Written plainly rather than as a compliance brochure.
Isolated per account
Every table enforces row-level security. A query from your account physically cannot return another account's rows. This is enforced by the database, not by the app, so it holds even if the front end is tampered with.
Hosted in Australia
Your database runs on PostgreSQL in Sydney. It does not leave the country in normal operation.
Encrypted in transit
Every connection uses HTTPS. Passwords are hashed by Supabase Auth and never stored in readable form, including by us.
We never see your card
Payments run through Stripe. Card numbers never touch Clearline's servers or database. We hold only a customer reference.
Server-side access control
Subscription status is checked by the database, not the browser. An expired account cannot read its own records regardless of what the front end says.
Export whenever you want
Full CSV export of contacts and activity, plus a complete JSON backup, from the Admin page. No request, no waiting, no fee.
Backups and recovery
Clearline runs on Supabase, which takes automated daily backups of the database with point-in-time recovery. If something went badly wrong at the infrastructure level, the database can be restored.
That protects against our failures. It does not protect against yours. If you delete a contact by mistake, that is a normal change to your own data and a full database restore is not a reasonable response to it.
What you can export
- Contacts, with every field, as CSV
- Call log and note history as CSV
- A full JSON backup of contacts, activity, deals, appointments and campaigns
What happens if you cancel
Your data is kept for 30 days after cancellation. Resubscribe within that window and nothing is lost. After 30 days it is permanently deleted and cannot be recovered. Export before you cancel if you want a copy.
What you are responsible for
This part matters and most vendors skip it. The contact information you upload is personal information about other people, and you collected it. Under the Privacy Act you hold the obligations that come with that, not us.
- Having a lawful basis to hold the contact data you upload
- Responding if one of those people asks to see or correct their record
- Complying with the Spam Act when you email, and the Do Not Call Register Act when you call
- Keeping your password secure and not sharing your account
Clearline is the tool. You remain the entity that holds the data.
Where your data goes
| Service | What it handles | Where |
|---|---|---|
| Supabase | Database and sign-in | Sydney, Australia |
| Cloudflare | Hosting and delivery | Global edge network |
| Stripe | Payments and invoices | Australia and United States |
| OpenStreetMap services | Turning addresses into map coordinates | Europe |
We do not sell personal information and we do not use your contact database for anything other than running the service for you.
Reporting a problem
If you think you have found a security issue, email clearlcrm@gmail.com with the detail. Please give us a reasonable chance to fix it before publishing anything. We will acknowledge within two business days.
Being straight about our size
Clearline is a small operation, not a large vendor with a security team. We hold no ISO or SOC certification and we are not going to claim otherwise. What we have done is use well-run infrastructure, enforce access control at the database rather than in the browser, keep card data entirely with Stripe, and give you a one-click export so you are never locked in.