Legal
Privacy Policy
Last updated: 7 October 2026 · Applies to all users globally
Contents
- Who We Are & How to Contact Us
- Scope of This Policy
- Data We Collect
- How We Use Your Data
- Third-Party Services & Data Processors
- Advertising & Marketing
- International Data Transfers
- Data Retention
- Security
- Children's Privacy
- Your Rights — All Users
- Additional Rights — EU & UK (GDPR)
- Additional Rights — California (CCPA/CPRA)
- Additional Rights — Virginia (VCDPA)
- Additional Rights — Colorado (CPA)
- Additional Rights — Connecticut & Utah
- Legal Action & Public Authorities
- System Logs & Maintenance
- Information Not Contained in This Policy
- Cookies
- Changes to This Policy
- Definitions & Legal References
1. Who We Are & How to Contact Us
Mustafa Hassan Khan Khetran is the data controller, a sole proprietor trading as Clockwrk, based in Lahore, Pakistan. Clockwrk operates the website at clockwrk.io and the client portal at my.clockwrk.io.
For all privacy-related enquiries, requests, or concerns, contact us at:
Clockwrk — Privacy
[email protected]2. Scope of This Policy
This Privacy Policy applies to all personal data collected through:
- The Clockwrk website at clockwrk.io and all its pages
- The booking system at /book-a-call
- The referral programme at /referral
- The careers and job application pages at /careers
- The client portal at my.clockwrk.io
- The newsletter subscription form in the footer
- Any email communications with Clockwrk
- Communications with Clockwrk after seeing or clicking Clockwrk ads on third-party platforms; those platforms process ad interactions under their own policies
It does not apply to third-party websites linked from the Website, whose own policies govern data collection on those sites.
3. Data We Collect
Data You Provide Directly
| Source | Data Collected |
|---|---|
| Booking a call | Name, email, company (optional), services of interest, notes, guest emails (optional), date and time, time zone, and role (if given) |
| Subscribing and payments (bank transfer) | Name, email, company, transfer details on the receipt (transaction ID, sending bank, amount), and receipt files uploaded in the portal |
| Referral programme | Name, email, referral code; when a referred client pays, that client's name, email, plan, and order amount to calculate the 5% reward |
| Job and internship applications | Name, email, phone, role or university details, LinkedIn and portfolio links, CV or resume file, skills, availability, and notes |
| Newsletter and job alerts | Email address |
| Client portal accounts | Name, email, company, requests, messages and feedback, uploaded files and deliverables, billing records |
| Email communications | Your email address and any content you include in your message |
Data Collected Automatically
| Source | Data Collected |
|---|---|
| Cloudflare | IP address, request metadata, and security challenge data for routing, security, and abuse prevention |
| Google Fonts | Your IP address is received by Google when the Orbitron font loads |
| Client portal security | IP address and browser/device details of sign-ins |
| Security | IP addresses may be processed temporarily for rate limiting and abuse prevention |
| Cookies & browser storage | See our Cookie Policy for a full breakdown |
Data We Do Not Collect
We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or sexual orientation, and we have no intention of doing so. We do not collect or store payment card details.
4. How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Booking and scheduling discovery calls | Name, email, company, services of interest, notes, guest emails, date/time, time zone, role | Pre-contractual steps / legitimate interest |
| Delivering subscription and ongoing care services, managing payments | Name, email, company, bank transfer details and receipt files, requests, messages, feedback, files and billing records | Performance of a contract |
| Managing client portal accounts and sign-ins | Name, email, company, account and sign-in details | Performance of a contract / legitimate interest |
| Sending transactional emails (booking confirmations, sign-in codes, system notifications) | Email address | Performance of a contract |
| Processing referrals and issuing referral rewards | Name, email, referral code, referred client's name, email, plan and order amount | Performance of a contract / legitimate interest |
| Reviewing job and internship applications and conducting recruitment | Application data and CVs | Legitimate interest (recruitment) |
| Sending newsletters and job alerts (where subscribed) | Email address | Consent |
| Portal security, fraud prevention, rate limiting and abuse detection | IP address, browser/device details of sign-ins, request metadata | Legitimate interest |
| Complying with legal obligations | All data as required by law | Legal obligation |
We will not use your data for purposes that are incompatible with those listed above without notifying you and, where required, obtaining your consent.
5. Third-Party Services & Data Processors
Website forms for bookings, referrals, applications, newsletter subscriptions, and payment confirmations send data to api.clockwrk.io, which runs on Cloudflare Workers. Submitted data is stored in Cloudflare D1, and CVs, receipts, and portal uploads are stored in Cloudflare R2. We share personal data with the following third-party services to the extent necessary to deliver the Website and the Service. Each acts as a data processor on our behalf or as an independent data controller in respect of their own services:
| Service | Role | Data Shared | Privacy Policy |
|---|---|---|---|
| Resend | Email delivery | Recipient email address, email content | resend.com/privacy |
| Cloudflare | CDN, security, API hosting (Workers), D1 database, R2 file storage | IP address, request metadata, submitted form and portal data, uploaded files | cloudflare.com/privacypolicy |
| Hostinger | Website hosting and email | Standard server logs, email content | hostinger.com/privacy-policy |
| Google Fonts | Orbitron font delivery | IP address when the font loads | policies.google.com/privacy |
| Zoom | Discovery-call meeting creation and calls | Client name and company in meeting title, meeting time, and data processed by Zoom during the call | explore.zoom.us/en/privacy |
We do not sell your personal data to any third party. We share data with the processors above solely to the extent necessary for delivering the Service and operating the Website.
6. Advertising & Marketing
Clockwrk runs or plans to run ads on third-party platforms such as Google, Meta, LinkedIn, X, and Reddit. Those platforms process data under their own policies when you see or click an ad there. Clockwrk does not place advertising pixels, tags, or cookies on clockwrk.io. If that changes, we will update this policy and the cookie banner first and ask for consent where required.
You can manage ad preferences on Google, Meta, LinkedIn, X, and Reddit.
7. International Data Transfers
Clockwrk is based in Pakistan. Several of the third-party services we use are based in or process data in the United States, the European Union, and other countries. As a result, your personal data may be transferred to and processed in countries outside your own jurisdiction.
Where we transfer data outside your country, we take steps to ensure appropriate safeguards are in place:
- For transfers to the US from the EU/UK, we rely on processors that participate in the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or equivalent mechanisms
- Submitted data and files are stored with Cloudflare (D1 and R2); Cloudflare and other processors may process them outside your country, subject to the safeguards described above
By using the Website or the Service, you acknowledge that your data may be transferred internationally as described in this policy.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Client portal data | Kept while your subscription is active, as we need it to deliver the Service. After it ends, kept until it is no longer needed (for example, if you return or need support), and deleted when you ask |
| Billing records | 6 years after the subscription ends, as required by tax law |
| Booking data | Kept until no longer needed for follow-up, then deleted, or sooner if you ask |
| Job and internship application data, including uploaded CVs | Kept until the role is filled and the data is no longer needed, then deleted, or sooner if you ask |
| Referral programme data | Kept while you take part and while any reward is owed, then deleted on request |
| Newsletter and job-alert subscriber data | Until you unsubscribe |
| Communications (email) | Kept as long as needed for the conversation, then deleted on request |
You can ask us to delete your data at any time by emailing [email protected]. While a subscription is active, we cannot delete data we need to deliver the Service, and billing records must be kept for as long as tax law requires. Where data must be retained due to a legal obligation, we keep it only for the required period and restrict access to it.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include:
- HTTPS encryption across all pages of the Website
- Hashed passwords and two-step verification codes for client portal sign-ins
- Cloudflare DDoS protection, bot management, and edge security
- Time-limited signed links for stored files
- Rate limiting against abuse
- Access to production data and systems restricted to authorised personnel only
- Bank transfer confirmation details and uploaded receipt files are accessible only to authorised personnel; we do not collect or store card details
No security system is foolproof. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities without undue delay and in accordance with applicable law.
10. Children's Privacy
The Website and the Service are not directed at individuals under the age of 18. We do not knowingly collect, process, or store personal data from minors. If you are a parent or guardian and believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.
11. Your Rights — All Users
Regardless of where you are located, you have the following rights in relation to personal data we hold about you:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure — ask us to delete your data, subject to legal obligations to retain certain records
- Right to object — object to processing based on legitimate interest, including direct marketing
- Right to withdraw consent — where processing is based on consent (such as the newsletter), withdraw at any time without affecting the lawfulness of prior processing
- Right not to be discriminated against — exercising these rights will not affect the quality or availability of the Service to you
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing certain requests.
12. Additional Rights — EU & UK Users (GDPR)
Applies To: European Union & United Kingdom
If you are located in the EU or UK, the General Data Protection Regulation (GDPR) and, in the UK, the UK GDPR as retained in domestic law, grant you additional rights and protections.
Legal Bases for Processing
Under GDPR, we must have a lawful basis for each processing activity. The bases we rely on are set out in the table in Section 4 above (Performance of Contract, Legitimate Interest, Legal Obligation, and Consent). Where we rely on Legitimate Interest, you have the right to object and we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Additional Rights Under GDPR
- Right to restriction of processing — request that we limit how we use your data while a dispute is resolved
- Right to data portability — receive personal data you have provided to us in a structured, machine-readable format and have it transferred to another controller where technically feasible
- Rights in relation to automated decision-making — we do not make any decisions about you based solely on automated processing that would produce legal or similarly significant effects
Right to Lodge a Complaint
If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority. In the EU, find your national authority at edpb.europa.eu. In the UK, the supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk.
Data Transfers from the EU/UK
When we transfer your data outside the EU/UK (e.g. to processors in the US), we do so using appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms approved under GDPR. Processors maintain their own EU data transfer compliance programmes.
13. Additional Rights — California Consumers (CCPA/CPRA)
Applies To: California, United States
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights over your personal information.
Categories of Personal Information Collected
We collect the following categories as defined under the CCPA:
- Identifiers (name, email, IP address)
- Commercial information (subscription details, payment history)
- Internet or other network activity (security request data and portal sign-in details)
- Professional or employment-related information (job applications)
Sale or Sharing of Personal Information
Clockwrk does not sell or share personal information for cross-context behavioural advertising and does not use it for such advertising on its website.
Your CCPA Rights
- Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you over the past 12 months
- Right to Delete — request deletion of personal information we have collected, subject to certain exceptions
- Right to Correct — request correction of inaccurate personal information
- Right to Opt Out — opt out of any sale or sharing of your personal information for cross-context behavioural advertising, if this practice begins
- Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights
How to Exercise Your CCPA Rights
Submit requests to [email protected]. We will respond within 45 days. We may request information to verify your identity. You may submit up to two requests in any 12-month period at no charge.
14. Additional Rights — Virginia Consumers (VCDPA)
Applies To: Virginia, United States
If you are a consumer residing in the Commonwealth of Virginia, the Virginia Consumer Data Protection Act ("VCDPA") grants you specific rights over your personal data. This section supplements the rest of this Privacy Policy and supersedes any conflicting information for Virginia residents.
Categories of Personal Data We Collect
We have collected the following categories of personal data: identifiers, commercial information, security-related internet or other network activity information, and employment-related information. We do not collect sensitive data as defined under the VCDPA.
Sale of Your Personal Data
Clockwrk does not sell personal data or use it for targeted advertising on its website.
Your Rights Under the VCDPA
- Right to access — confirm whether we are processing your personal data and access such data
- Right to correct — request correction of inaccurate personal data
- Right to delete — request deletion of personal data we have collected about you
- Right to data portability — obtain a copy of your data in a portable, usable format
- Right to opt out — opt out of the processing of your personal data for targeted advertising, sale, or profiling that produces legal or similarly significant effects
- Right to non-discrimination — we will not deny goods or services or charge a different price based on your exercise of these rights
How to Exercise Your Rights
Submit requests to [email protected]. We will respond within 45 days; we may extend by a further 45 days with notice. We may need to verify your identity before processing your request. If we deny your request, you may appeal within 60 days and, if the appeal is denied, contact the Virginia Attorney General.
We do not charge a fee to respond, for up to two requests per year.
15. Additional Rights — Colorado Consumers (CPA)
Applies To: Colorado, United States
If you are a consumer residing in the State of Colorado, the Colorado Privacy Act ("CPA") grants you specific rights over your personal data. This section supplements the rest of this Privacy Policy and supersedes any conflicting information for Colorado residents.
Categories of Personal Data We Collect
We have collected the following categories of personal data: identifiers, commercial information, security-related internet information, and employment-related information. We do not collect sensitive data as defined under the CPA.
Sale and Targeted Advertising
Clockwrk does not sell personal data or use it for targeted advertising on its website.
Global Privacy Control (GPC)
If you submit an opt-out request via a user-enabled Global Privacy Control signal, we will abide by that request in a frictionless manner as required under the CPA.
Your Rights Under the CPA
- Right to opt out — opt out of targeted advertising, sale of personal data, or profiling producing legal or similarly significant effects
- Right to access — confirm whether we are processing your data and access it
- Right to correct — request correction of inaccurate personal data
- Right to delete — request deletion of your personal data
- Right to data portability — obtain your data in a portable format
How to Exercise Your Rights
Submit requests to [email protected]. We will respond within 45 days; we may extend by a further 45 days with notice. If we deny your request, you may appeal and, if the appeal is denied, contact the Colorado Attorney General. We do not charge a fee for up to two requests per year.
16. Additional Rights — Connecticut (CTDPA) & Utah (UCPA)
Applies To: Connecticut and Utah, United States
If you are a consumer residing in the State of Connecticut or the State of Utah, the Connecticut Data Privacy Act ("CTDPA") or Utah Consumer Privacy Act ("UCPA") respectively grant you specific rights over your personal data. This section supplements the rest of this Privacy Policy.
Categories of Personal Data We Collect
We have collected the following categories of personal data: identifiers, commercial information, security-related internet information, and employment-related information. We do not collect sensitive data as defined under the CTDPA or UCPA.
Sale and Targeted Advertising
Clockwrk does not sell personal data or use it for targeted advertising on its website. To exercise your rights, contact us at [email protected].
Connecticut residents: if you submit a Global Privacy Control (GPC) signal, we will honour it as an opt-out request.
Your Rights
- Right to access — confirm whether we process your personal data and access it
- Right to correct — request correction of inaccurate data (Connecticut only)
- Right to delete — request deletion of your personal data
- Right to data portability — obtain your data in a portable format
- Right to opt out — opt out of targeted advertising and sale of personal data
- Right to non-discrimination — we will not increase cost or decrease service availability based solely on your exercise of these rights
How to Exercise Your Rights
Submit requests to [email protected]. We will respond within 45 days; we may extend by a further 45 days with notice. Connecticut residents may appeal a denial and, if the appeal is denied, contact the Connecticut Attorney General. We do not charge a fee for up to one request per year (Utah) or two requests per year (Connecticut).
17. Legal Action & Public Authorities
The User's personal data may be used for legal purposes by the Owner in court or in the stages leading to possible legal action arising from improper use of this Website or the related Services.
The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities, including judicial or administrative authorities, where legally required to do so.
18. System Logs & Maintenance
For operation and maintenance purposes, this Website and any third-party services employed by it may collect files that record interaction with the Website (system logs) or use other personal data — such as IP address — for this purpose. System logs are retained for the minimum period necessary for security and maintenance purposes and are not used for any other purpose.
19. Information Not Contained in This Policy
More details concerning the collection or processing of personal data may be requested from the Owner at any time. Please see the contact information at the beginning of this document. In addition to the information contained in this Privacy Policy, this Website may provide the User with additional and contextual information concerning particular Services or the collection and processing of personal data upon request.
20. Cookies
We use cookies and browser storage on the Website and client portal. For a full breakdown of what we use, why, and how to manage your preferences, please read our dedicated Cookie Policy.
21. Changes to This Policy
We may update this Privacy Policy as the Website and the Service evolve — for example, when we add new third-party tools, begin processing new categories of data, or as applicable law changes. When we make material changes, we will update the "Last updated" date at the top of this page and notify active subscribers by email at least 14 days before the changes take effect. For minor, non-material changes, we may update without advance notice.
We encourage you to review this page periodically. Continued use of the Website or the Service after any update constitutes acceptance of the revised Policy.
22. Definitions & Legal References
This Privacy Policy relates solely to this Website, if not stated otherwise within this document.
Clockwrk — Privacy Enquiries
[email protected]