Privacy Policy

1. Overview

Clone2GHL ("Clone2GHL," "Extension," "Service," "we," "us," or "our") is a Chrome browser extension that lets users clone webpages, analyze funnel performance, optimize marketing copy and assets with AI, and export funnels directly to GoHighLevel.

Clone2GHL works in two modes:

• Local mode (no account): You bring your own GoHighLevel and OpenAI API keys. Your data is stored only in your browser, and it is shared with a third party only when you explicitly trigger an action (for example, "Push to GoHighLevel" or an AI tool).
• Cloud mode (optional Clone2GHL account): If you create a Clone2GHL account, we operate a backend service that stores account, billing, usage, and (when you choose to sync) funnel data on our servers, and that routes certain AI and video requests on your behalf.

This Privacy Policy explains what we collect, how we use and store it, who we share it with, and the controls and rights you have. By installing or using Clone2GHL, you agree to the practices described here.

2. Data We Collect

A. Data You Provide Directly

API credentials (stored locally, encrypted):

• GoHighLevel API key (Private Integration Token) and Location ID
• OpenAI API key (if you use your own key for AI features)

Account information (only if you create a Clone2GHL account):

• Email address and a password (your password is sent to our backend only to register or sign in; we store only a one-way bcrypt hash, never your plaintext password)
• Optional profile details: display name, company, and timezone

Cloned webpage content:

When you click "Clone This Page," the Extension captures, from the page you are viewing:

• HTML markup and computed CSS styles
• Images (converted to data URIs for preservation)
• Text content, layout, and structure

Cloned content is stored in your browser. It is uploaded to our servers only if you are signed in and choose to sync, and is sent to GoHighLevel only when you export. Cloned pages may include any text present on the source page — you are responsible for ensuring you have the right to clone a given page.

B. Data Collected Automatically

• Which dashboard tabs and features you use (clone, AI tools, export, sync, video)
• Funnel Intelligence analysis results (generated locally)
• Error logs to diagnose failures
• For each clone: the source URL, page title/metadata, and time of cloning

C. Data Stored on Our Servers (Cloud accounts only)

If you create a Clone2GHL account, our backend stores the following so we can provide accounts, billing, usage limits, and optional sync:

• Account & profile: email, bcrypt password hash, display name, company, timezone, account status, and account creation date
• Plan & billing: plan tier, subscription status and renewal date, Stripe customer ID, and invoice records (amount, currency, status, dates, hosted invoice links)
• GoHighLevel linkage: validated Location ID and, for purchases made through GoHighLevel, the GHL contact ID and order/transaction ID used to provision your plan
• Usage & entitlement: monthly clone/logo/AI counters, free-trial start/end dates and trial clones used
• Synced funnels (only if you sync): funnel name, source URL, niche, status, the cloned and AI-optimized HTML, analysis/AI report data, GHL export IDs, and a limited number of prior version snapshots
• Saved sites & preferences: watchlist/custom-site bookmarks and dashboard preferences
• Security tokens (hashed): hashed refresh tokens and hashed, short-lived password-reset and activation codes
• Server logs: request metadata for security and reliability — timestamp, request ID, HTTP method, path (without query string), status code, response time, your account ID, and your IP address (used for rate-limiting and abuse prevention). We do not log request bodies or your passwords.

3. How We Use Your Data

A. To Provide the Service

• Cloning & export: preserve and recreate page layouts and export them to your GoHighLevel account via GoHighLevel's official API
• AI features: generate optimized copy, reports, headlines, logos, and video scripts. These requests are processed by OpenAI (using your key in local mode) or routed through our backend (which uses our OpenAI/HeyGen keys) when you use an account
• Accounts & billing: authenticate you, enforce plan limits, process payments, manage your free trial, and send transactional emails (password resets, activation, and renewal reminders)
• Sync: store and retrieve your funnels across devices when you choose to sync
• Security & support: prevent abuse, rate-limit requests, diagnose issues, and respond to your requests

B. What We Do NOT Do

• We do not sell or rent your data
• We do not use your cloned content or prompts to train our own AI models
• We do not use your data for advertising, profiling, or marketing to third parties

C. Legal Compliance

We may disclose data if required by law, regulation, legal process, or enforceable governmental request.

4. Data Storage & Location

A. Browser Storage (Local)

• API keys and auth tokens are stored in the Extension's chrome.storage.local and are encrypted at rest using AES-GCM with a key generated on your device
• Cloned pages, funnels, library/templates, watchlist entries, and preferences are stored locally
• If you enable Chrome Sync, Chrome may sync extension data across your signed-in devices — you control this in Chrome Settings
• Local data persists until you delete it (Settings → Clear Data) or uninstall the Extension

B. Our Cloud Backend (Optional — accounts only)

• If you create an account, the data listed in Section 2C is stored on our backend infrastructure (hosted with our cloud provider) and transmitted over HTTPS/TLS
• Sign-in, sync, usage refresh, AI routing, video jobs, and billing requests are sent to our backend only when you use those features
• Access to backend data is restricted to authorized Clone2GHL administrators for support, billing, and abuse-prevention purposes

5. Data Sharing & Sub-processors

We do not sell your data. We share data only with the service providers ("sub-processors") needed to deliver the features you use. Depending on whether you use your own keys or a Clone2GHL account, data is shared with:

6. Data Security

A. Encryption

• API keys and auth tokens are encrypted at rest in extension storage (AES-GCM)
• All network communication uses HTTPS/TLS
• Passwords are stored only as one-way bcrypt hashes; refresh tokens and reset/activation codes are stored only as hashes

B. Browser Isolation

• The Extension runs in a sandboxed context and cannot read other extensions' data or other sites' cookies
• A strict Content Security Policy (script-src 'self'; object-src 'self') is enforced, and the Extension loads no remotely-hosted code

C. Backend Safeguards

• Rate-limiting on authentication, AI, and webhook endpoints to prevent abuse
• Strict CORS allow-listing; signed webhooks for billing and GoHighLevel events
• No security method is perfect; we cannot guarantee absolute security, and you use the Service at your own risk

7. Your Rights & Controls

A. Access

• View your stored funnels and history in the Clone2GHL dashboard (My Funnels, Settings)
• Account users may request a copy of their account data by emailing us (see Section 12)

B. Delete Local Data

1. Open the Clone2GHL dashboard → Settings → "Clear Data," or
2. Remove the Extension (right-click the icon → "Remove from Chrome"), which deletes its local storage

C. Delete Your Account & Server Data

If you created a Clone2GHL account, you can request deletion of your account and associated server-side data (and we will confirm and complete deletion within 30 days) by:

• Using the "Delete account" option in the dashboard, if available, or
• Emailing [email protected] from your account email with the subject "Delete my account"

Note: certain records (for example, invoices and minimal anti-fraud records) may be retained where required by law — see Section 11.

D. Stop Sharing

• Remove your API keys in Settings to stop sharing with GoHighLevel/OpenAI
• Sign out (or never sign in) to stop using the backend and its sub-processors

E. Chrome Sync Opt-Out

To stop Chrome from syncing extension data across your devices: Chrome Settings → "You and Google" → Sync, and turn off "Extensions."

8. Children's Privacy

Clone2GHL is a business tool and is not directed to children. It is not intended for anyone under 13, and paid/account features require that you are of legal age to enter into a contract. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us at [email protected] and we will delete it.

9. Third-Party Links & Services

This Privacy Policy does not apply to third-party services you connect or visit (GoHighLevel, OpenAI, Stripe, Resend, HeyGen, or pages you clone). Your use of those services is governed by their own terms and privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last Updated" date above and, for material changes, provide additional notice (e.g., in the Extension or by email). Your continued use after an update constitutes acceptance of the revised policy.

11. Data Retention

12. Contact & Data Requests

For privacy questions, data-access or deletion requests, or to report a concern:

• Email: [email protected]
• Website: https://clone2ghl.com

For GDPR, CCPA, or other regulatory requests, include your name, the email associated with your account, and the specific request (access, deletion, portability). We will respond within 30 days.

13. Compliance Statements

A. GDPR (EU/EEA/UK residents)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. Our legal bases are: performance of a contract (providing the Service), your consent (optional AI/cloud features), and our legitimate interests (security and abuse prevention). To exercise any right, contact us at [email protected].

B. CCPA/CPRA (California residents)

You have the right to know what personal information we collect, to request deletion, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information. We will not discriminate against you for exercising your rights.

14. International Data Transfers

Our sub-processors (including OpenAI, Stripe, Resend, HeyGen, and GoHighLevel) are based in the United States, and our backend may process and store data in the United States or other countries. If you access Clone2GHL from outside these regions, your information may be transferred to and processed in countries whose data protection laws differ from those in your jurisdiction. By using the Service, you consent to such transfers, which we carry out using appropriate safeguards where required.

15. Summary: How We Handle Your Data

16. Acknowledgment