Privacy Policy

Closolv ("Closolv," "we," "our," or "us") operates the closolv.io deal-room application. This Privacy Policy explains what personal information we collect from professionals and their clients, how we use it, who we share it with, and your rights regarding that information.

We collect three kinds of information:

• Account information. When a professional creates a Closolv account, we collect their email address, password (hashed), and optional profile fields including full name, company name, and chosen profession. Stripe collects payment information directly when a subscription is started — Closolv stores only a Stripe customer ID, never raw card data.
• Room and task content. Professionals create deal rooms that contain a title, optional vertical (e.g. real estate), and a list of tasks with titles, descriptions, due dates, and assignments. Rooms reference the client by name, email, and optionally phone — provided by the professional. Clients do not create accounts; they access the room via a private magic link sent to their email.
• Communications and access logs. Messages exchanged in a task thread (in-app, by email reply, or by SMS) are stored to render the conversation history. We also log magic-link access events (room views, device-verification attempts, task completions) for security and audit purposes. The professional sees this history; clients see their own devices.

We use the information we collect to:

• Provide and operate the Closolv service — rendering rooms, sending invitations, delivering reminders.
• Send transactional emails and (with consent) SMS related to a specific deal — invitations, task notifications, overdue reminders, completion emails.
• Authenticate professionals via Supabase Auth and verify new client devices via a six-digit code.
• Detect and prevent abuse, unauthorized access, and security incidents.
• Process subscription payments through Stripe.
• Improve the product — limited aggregate, non-identifying usage data only.

We do not sell your personal information. We do not use room contents for advertising or for training third-party AI models.

We share information with a small set of vendors that operate the underlying infrastructure of Closolv. Each is bound by confidentiality and data-processing terms:

• Supabase — hosted Postgres database and authentication. All account, room, task, and message data is stored here.
• Vercel — application hosting and edge delivery for closolv.io.
• Resend — transactional email delivery (invitations, reminders, completions, message notifications).
• Cloudflare — DNS and Email Routing, which parses inbound email replies back into the appropriate task thread.
• Twilio — SMS delivery for Growth-plan users who enable the per-task SMS Contact button.
• Stripe — subscription billing and payment processing.

We share information with these vendors only to the extent necessary to operate the service. We do not share personal information with advertising networks or data brokers.

We retain account, room, and message data for as long as the professional maintains an active account. When a room is closed, its data persists in the professional's archive but the magic link is invalidated — clients no longer have access.

You can delete your account at any time by contacting us at the address below. Account deletion removes all rooms, tasks, and messages owned by that account. Some records — billing receipts, security logs — may be retained for the period required by applicable law.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to withdraw consent for processing. Specifically:

• Right to access. Request a copy of the personal data we hold about you.
• Right to correct. Update or correct inaccurate information directly in the app or by contacting us.
• Right to delete. Ask us to delete your account and associated data.
• Right to export. Receive your room and task data in a portable format.
• Right to opt out of SMS.Reply STOP to any Closolv text message to be removed from future SMS from that professional's number.

California residents have additional rights under the CCPA, and EU/UK residents have rights under the GDPR and UK GDPR. To exercise any of these rights, contact us at the address below.

We apply multiple layers of protection to your data:

• All connections to closolv.io use TLS (HTTPS).
• Passwords are hashed by Supabase Auth — Closolv never sees the plaintext password.
• Magic links expire automatically (90 days by default) and can be regenerated to invalidate the previous link.
• First access from a new device requires a six-digit code emailed to the client.
• Both sides of a room can revoke or flag any device with one click.

No service can guarantee perfect security. If you believe your account or a client's magic link has been compromised, regenerate the link and contact us immediately.

Closolv's infrastructure is hosted in the United States by Vercel and Supabase. If you access the service from outside the United States, your information will be transferred to, stored, and processed in the United States. Where required, we rely on standard contractual clauses or equivalent mechanisms for cross-border transfers.

Closolv is not directed to children under 16, and we do not knowingly collect information from anyone under 16. If you believe a child has provided information to Closolv, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, send a notice to the email address on your account.

Questions about this Privacy Policy or a request to exercise your rights? Reach us at privacy@closolv.io.