Privacy notice
ClientHQ collects two kinds of data about how the product runs: error reports, so that a fault can be fixed, and product events, so that we can see where the product loses people. This page says exactly what each collector receives, what it never receives, and how to change your cookie choice. It is written in plain words on purpose.
What is collected
Errors go to Sentry. An error report carries the stack trace, the runtime it happened in, the build it came from, the agency it happened in and the account it happened to, plus a masked recording of the screen from the moments before the error. Every piece of text, every input and every image in that recording is blanked out before it leaves the browser.
Product events go to PostHog. A product event is a name, such as an invoice being issued, with the ids of the things involved, plus page views from the browser on the agency side of the product.
The identifiers that are sent
- your account id (the id your sign in provider assigns)
- your agency's id
- a client's id, on events about a client's portal
- your role in the agency (admin or member)
- dates, such as when the agency was created
- counts, such as the size of the team
What is never sent
No email address, no name, no invoice amount, no file name, no note, no client company name, no request headers, no cookies and no form contents. Both collectors are configured to refuse those, and a test in the codebase fails if an event ever declares one.
Client contacts
If you are a client contact using the portal your agency shares with you, you are not profiled at all. No analytics script loads on a portal page, no analytics cookie is set there, and no person record exists for you anywhere. The few events about portal use name the client company, never the person.
Where the data lives, and for how long
Error reports live in the Sentry region chosen when the project was created, in the European Union or the United States. Product events live in PostHog's European Union cloud. Each provider keeps data for its default retention period, which is the period shown in that provider's own dashboard: ninety days for Sentry error events and replays, and the plan's default for PostHog events. Error tracking with masked recordings rests on our legitimate interest in keeping the product working; the analytics cookie is set only with your consent.
The cookie, and how to change your choice
Page view analytics run without any cookie until you accept one. Your choice is stored in a single first party cookie named clienthq_consent, for one year. Accepting lets the analytics client remember an anonymous id across visits; declining keeps it in memory only, and nothing about the product changes either way.
To change your choice, press the button below and the banner will ask again. The same control is in your account menu.
Erasure
When an account is deleted, the person and their events are deleted from PostHog by the same process that removes them locally, and a nightly check retries any deletion that did not complete.