Privacy Policy

For information about our own customers and website visitors (for example account details, billing and support), CloseTrack is the data controller.

For information our customers put into the Service about their own clients and contacts (for example a buyer's name, email and phone number in a file), our customer is the controller and we process it on their behalf, as their service provider ("processor"), under our Terms. If you are one of our customers' clients, please contact the transaction coordinator or brokerage you work with about your information; we will help them respond.

Information you give us:

• Account details: name, email address, phone number, password (stored only as a secure hash), role, and your company or brokerage.
• Workspace content: files, properties, tasks, documents, notes, templates, messages and the details of clients and other parties you add.
• Communications through the Service: emails, text messages and call records (numbers, times, durations), and call or meeting recordings and transcripts if you turn recording on.
• Support and enquiries: what you send us by email or through our contact form, including the IP address the form was sent from (used to prevent abuse).

Information from connected services, if you choose to connect them: from Google or Microsoft, your email messages, labels, calendar events and contacts as needed for the features you use; from real estate platforms such as Dotloop or SkySlope, transaction data.

Payment information. Payments are handled by Paddle.com, our Merchant of Record. You enter card details directly with Paddle; we never receive or store full card numbers. Paddle shares with us your name, email, country, the plan or credits bought, and the card brand and last four digits, so we can show your billing history. Paddle's own handling is described in its privacy notice.

Technical information: IP address, browser and device type, and logs of activity in the Service, used to operate, secure and troubleshoot it.

We use personal information to:

• provide the Service, including features you turn on such as messaging, e-signatures, calendar sync and AI assistance (to perform our contract with you);
• process payments, send receipts and manage subscriptions, through Paddle (contract, and legal obligations such as tax records);
• send service messages, for example security alerts, billing notices and changes to our terms (contract and legitimate interests);
• keep the Service secure, prevent fraud and abuse, and fix problems (legitimate interests);
• respond to support requests and enquiries (legitimate interests, or contract);
• improve the Service, using aggregated or de-identified information where we can (legitimate interests);
• comply with the law and enforce our terms (legal obligation and legitimate interests).

We only send marketing emails with your consent or where the law otherwise allows, and every marketing email has an unsubscribe link. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

When you use AI features, the relevant content (for example an email thread or an uploaded contract) is sent to our AI providers, OpenAI and Anthropic, to produce the result. They process it on our behalf under terms that do not allow them to use it to train their models, and we do not use your content to train AI models either. AI features act on your instructions, and you decide what to do with their output.

If you connect a Google account, CloseTrack accesses Gmail messages and labels, Google Calendar events and contacts only to provide the features you use: showing and filing your transaction email in CloseTrack, sending email you write, syncing file deadlines to your calendar, and suggesting contacts.

CloseTrack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train generalised AI models, and people at CloseTrack do not read it unless you ask us to (for example for support), it is needed for security or to comply with the law, or it has been aggregated and anonymised. You can disconnect Google at any time in Settings, or from your Google account's security settings.

We share personal information only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions:

We also share information when you direct us to (for example when you send a document for signature, share a client portal or timeline link, or connect another service); when required by law or to protect rights, safety and security; and with a buyer or successor if our business is sold or reorganised, in which case this policy will continue to apply to your information.

Our providers process information in the United States and other countries, which may have different data protection laws from yours. Where the law requires, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and their UK equivalent.

We keep account and workspace information for as long as your account is open and afterwards until you ask us to delete it, so you can return or export it. When you delete your account or workspace, you have 30 days to change your mind; after that it is permanently deleted, and removed from backups as they expire. We keep billing and tax records for as long as the law requires (usually up to 7 years), and security logs for a limited period.

We use encryption in transit (TLS) and at rest, isolation of each workspace's data at the database level, role-based access controls, two-factor sign-in, and audit logs. No system is completely secure, but we work to protect your information and will notify you and the relevant authorities of a personal data breach where the law requires. See our Security page.

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent at any time. Much of this you can do yourself in Settings, including exporting your data and deleting your account.

California residents have the right to know what personal information we collect, use and disclose, to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in California law.

To make a request, email security@closetrack.co. We may need to verify your identity first, and we respond within 30 days (or sooner where the law requires). You may use an authorised agent. If you are in the EEA or UK, you can also complain to your local data protection authority.

The Service is for professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children; if you believe a child has given us information, contact us and we will delete it.

We may update this policy. For material changes we will notify you by email or in the app before they take effect. The date at the top shows when it was last updated.

CloseTrack. Privacy questions and requests: security@closetrack.co. General enquiries: hello@closetrack.co.