Privacy Policy — CloseRev

1. Two different roles

We handle two kinds of personal data, and our responsibilities differ for each.

Your account data — your name, work email, company name, phone number and billing details. Here we are the controller: we decide what to collect and why.
Data you upload — the customer records inside your files. Here we are a processor: you remain the controller, we act on your instructions, and we never use that data for our own purposes. Terms are in our DPA.

2. What we collect

In the last 12 months we have collected the following categories, using the classification required by California law.

Category	Examples we collect	Source	Purpose
Identifiers	Name, work email, company name, phone number, account and workspace identifiers	You, at signup	Provide the service, authenticate you, support
IP address	The address your requests come from	Automatically, with every request to our servers	Security and abuse prevention, rate limits, and the consent records described in section 7
Google sign-in	Your Google account identifier, name and email address, only if you choose "Sign in with Google"	Google, when you use it	Create your account and sign you in
Device data	For each browser you sign in from: a hashed device identifier, the browser and operating-system family, and the country it was first seen in. With each consent you give or withdraw: your browser's user-agent string	Automatically	Warn you of sign-ins from a browser we have not seen before; evidence of consent
Ad click identifiers	The identifier Google, LinkedIn or Reddit adds to the link of an ad you clicked	The link you arrived through — kept only while Advertising is on (see section 4)	Tell that ad network its ad led to a signup or a payment
Commercial information	Plan, subscription status, billing history	You and our payment processor	Billing, plan limits, accounting
Internet or network activity	Server logs, actions in your workspace (uploads, matches, overrides, exports, deletions)	Automatically	Security, debugging, your own audit trail
Professional information	Company name, role or industry if you tell us	You	Support and product relevance
What you write to us	Contact-form messages, support requests and email you send us, with any attachments; answers to the end-of-trial feedback form	You	Answer you, and improve the product
Customer records you upload	Your customers' names, phone numbers, email addresses, transaction amounts and dates, marketing channel	You, by upload	Matching and reporting, on your instructions only

We do not collect biometric data, precise geolocation, or sensitive personal information as defined by California law. You must not upload special-category data or protected health information: we do not sign business associate agreements (BAAs) under HIPAA, and the service is not built to hold health data — see the Acceptable Use Policy. Card details go directly to our payment processor and never reach our servers.

3. Why we process it, and on what legal basis

To provide the service — performance of our contract with you.
To secure accounts and prevent abuse — our legitimate interests.
To bill you and keep records — contract, and legal obligation for tax.
To send service messages (verification, password reset, receipts, security and billing notices) — contract. These are not marketing and cannot be opted out of while you hold an account.
To send marketing — only with your consent, which you may withdraw at any time.
To measure our public site and advertise CloseRev (Analytics and Advertising cookies, ad click identifiers, and telling an ad network its ad worked) — your consent. In the United States and in Canada outside Quebec, where these start on with a notice and a one-click way out, we rely instead on that notice and your choice not to opt out (implied consent, in Canadian terms) together with our legitimate interest in measuring and promoting our own service. A Global Privacy Control signal is an opt-out everywhere.
To stop one email address starting the free trial again and again (the trial fingerprint described in section 7) — our legitimate interest in preventing repeated free trials.
To keep records of what you agreed to — our legal obligations and our legitimate interest in being able to prove consent and acceptance of our terms.

4. Selling and sharing

We never sell personal information, and we never use data you upload for our own marketing or to train machine-learning models. That applies without exception to your customers' records.

One thing does need naming plainly. While advertising cookies are on, the advertising vendors listed in our Cookie Policy receive information about your visit to our public site — and California law counts that as “sharing” for cross-context behavioral advertising, even though no money changes hands.

When it is on. In the United States and in Canada outside Quebec, analytics and advertising are on by default: we tell you so when you arrive, and one click turns them off, there or at any time from Your privacy choices. Everywhere else — including Quebec, and anywhere we cannot tell where you are — they are off until you accept. Either way it happens only on our public pages and on one kind of signed-in page: the confirmation shown right after you confirm your email or pay, where Google's tag reports that one event. It never touches your workspace or the customer records you upload.

We honor Global Privacy Control. If your browser sends that signal we treat it as an instruction to opt out of sharing: advertising stays off, it cannot be overridden by clicking accept, and in the United States and Canada we do not switch anything on by default for that browser — we ask instead.

5. Marketing communications

We send marketing only to people who have opted in. Consent is optional, is never a condition of using CloseRev, and is recorded with the date and the wording you agreed to. Every marketing message identifies us and carries a one-click unsubscribe, and we act on unsubscribes promptly. You can also withdraw consent from your account settings or by emailing us.

6. Who we share it with

Only the vendors needed to run the service, each bound by contract to protect it. The current list, and what each one can see, is on our Subprocessors page. We may also disclose personal data where legally required, to protect our rights or someone's safety, or to a successor in a merger or sale of assets — in which case this policy continues to apply until you are notified otherwise.

Mail you send us. Email to any closerev.com address is received by Cloudflare, already one of our subprocessors. A message to support@ becomes a case in our own system, and its attachments are kept in our own storage with the case. Our team's mailbox receives a copy of the sender, subject and text of each message — never the attachments.

7. How long we keep it

Data	Retention
Uploaded files and match results	Until you delete them, or your workspace's retention window elapses: 6 months on Starter, 13 on Growth, and 24 on Enterprise and Agency and during a free trial. You can shorten the window in Settings, and at your request we can extend it to up to 36 months
Account data	While your account is open, then deleted within 30 days of closure
Support requests sent from inside the product, with their attachments	Your workspace's retention window, and deleted when the account is closed
Contact-form messages and email sent to support@, with their attachments	24 months. The sender's IP address is cleared after 90 days
Answers to the end-of-trial feedback form	24 months, and deleted sooner if the account is closed
An unconfirmed signup	Held as a pending registration only until you confirm the address, and deleted automatically if the link is never used
A record that an address has used its free trial	24 months from its last use, including after the account is closed. It holds a keyed one-way fingerprint of the address — never the address itself — with the trial's end date and how many trial imports it used, so that signing up again does not start a second trial
An address that unsubscribed from, bounced or complained about our emails	Kept indefinitely, including after the account is closed, so that we never send that kind of email to it again. It holds the address and the reason, nothing more
Browsers you have signed in from	180 days after the browser was last used, and deleted when the account is closed
A conversion report waiting to be sent to an ad network	3 days. It holds hashes of the email address, never the address itself, with the ad click identifiers and, for LinkedIn and Reddit, the IP address
Consent records	Records of Terms acceptance and marketing consent (date, wording, IP address, browser) are kept 6 years, including after the account is closed, as evidence. Cookie choices you make while signed in are recorded the same way
The log of CloseRev staff access to your account	24 months in our database. Copies made each night are kept for up to 6 years in storage that cannot be altered, as evidence of who looked at what
Invoices and tax records	As long as tax law requires, typically 6–7 years
Server and security logs, including the log of emails we sent	Up to 90 days
Database backups	Point-in-time restore covers the last 30 days, so deleted data can remain in a backup for up to 30 days. A restore re-applies every deletion made since the restore point

Deleting an import removes its records, its match results and the original uploaded file from storage.

8. Security

Data is encrypted in transit and at rest. Each workspace is isolated and every query is scoped to it. Passwords are hashed with scrypt at OWASP's recommended parameters, each with its own random salt. Email links are single-use, expiring, and stored only as hashes. Access by our staff is least-privilege, and the record of that access is tamper-evident. Our Security page describes this in more detail — including what we have not done yet.

When you choose a password we check it against a corpus of passwords exposed in public breaches, because a password already on a public list protects nothing. The password itself never leaves our servers — we hash it here and send only the first five characters of that hash, a prefix shared by hundreds of thousands of different passwords, and do the comparison ourselves. The provider cannot tell which password was checked or whose it was. It is named on our Subprocessors page.

9. International transfers

We are established in Canada, which the European Commission recognizes as providing adequate protection for commercial organizations subject to PIPEDA. Where personal data is transferred from the EEA or UK to a vendor outside an adequate jurisdiction, we rely on the Standard Contractual Clauses (with the UK Addendum where applicable) together with supplementary measures including encryption. You may request a copy of the relevant safeguards.

10. Your rights

Depending on where you live — under the GDPR and UK GDPR, California's CCPA as amended by the CPRA, PIPEDA in Canada, and comparable laws elsewhere — you may have the right to:

know what we hold and obtain a copy;
correct inaccurate data;
delete data;
restrict or object to processing, including direct marketing;
portability of data you provided;
withdraw consent at any time, without affecting processing already carried out;
not be discriminated against for exercising these rights — we do not offer a lesser service or different price to anyone who does.

Most of these you can exercise yourself in the product: export your data, delete an import, or close your account. For anything else, email privacy@closerev.com. We respond within 30 days (45 where California law allows an extension, with notice). We may need to verify your identity before acting. An authorized agent may submit a request on your behalf with written proof.

If we refuse a request, you can appeal. We will tell you why we declined and how to appeal, and you can appeal by replying to that decision or emailing privacy@closerev.com with "appeal" in the subject. A different person from the one who made the original decision reviews it, and we respond within 45 days with the outcome and our reasoning. If we still decline, we will tell you how to complain to your state Attorney General. This appeal right is required in Virginia, Colorado, Connecticut, Montana, Texas, Oregon, Delaware, New Hampshire and New Jersey; we offer it to everyone rather than asking where you live.

If you are dissatisfied you may complain to your local data protection authority, or in Canada to the Office of the Privacy Commissioner.

California "Shine the Light". California residents may ask once a year whether we disclosed personal information to third parties for their own direct marketing. We do not, so the answer will always be that there is nothing to report — but the request is your right and we will answer it in writing within 30 days.

Do Not Track. There is still no agreed standard for what a browser's DNT header should mean, so we do not act on it. We do act on Global Privacy Control, which is a defined opt-out signal, as described in section 4.

11. If you are someone else's customer

If your details reached us because a business uploaded them, that business is the controller and decides what happens to your data. Please contact them. If you contact us instead we will route your request to them and support them in answering it.

12. Automated decision-making

CloseRev matches records algorithmically, but it does not make decisions producing legal or similarly significant effects about individuals. Match results are advisory, are shown with their confidence, and can be overridden by a human.

13. Cookies

We use strictly necessary cookies; identifier-free counts of which public pages are read and how far people get through our public demo; and Google Analytics, Google Ads, LinkedIn and Reddit cookies — the last three so that we can tell an ad network when its ad worked and show CloseRev ads to people who visited our public site. Those four are off until you accept, except in the United States and Canada outside Quebec, where they start on with a notice and one click turns them off (section 4). None of them runs on a signed-in page except the confirmation shown right after you confirm your email or pay, where Google's tag reports that one event.

The counts set and read nothing, create no identifier, never record your address or your browser, and are kept only as daily totals for 400 days. A browser sending Global Privacy Control or Do Not Track sends us nothing for them; our server still counts that a page was served, as it does for every request. Details, including what Google's tag does before you choose, are in our Cookie Policy.

14. Children

CloseRev is a business tool, is not directed at anyone under 16, and we do not knowingly collect their data.

15. Changes

If we make a material change we will email account owners before it takes effect. The date at the top always reflects the current version.

16. Who is accountable, and how to reach them

Canadian privacy law requires a named individual to be accountable for personal information, and for you to be told how to reach them. Ours is the Privacy Officer at Aventura Virtual Solutions Inc., reachable at privacy@closerev.com. That address reaches a person, not a queue, and it is the right address for access requests, deletion requests, appeals, and for challenging how we have handled your information.

Aventura Virtual Solutions Inc. is incorporated in Canada and is the controller of the data described in section 1. For security reports use security@closerev.com; for anything else, the contact form.

17. Our representative in the European Union

We are established in Canada and offer this service to people in the EEA, so Article 27 of the GDPR requires us to designate a representative in the Union. Ours is:

CONSTANTLY CURIOUS, LDA
Sociedade por Quotas
Avenida dos Combatentes, n.º 43, 5.º B
São Domingos de Benfica
1600-042 Lisboa, Portugal
+351 936 661 068

You may contact our representative on any matter relating to how we handle your personal data, and supervisory authorities may address them in addition to, or instead of, us. Doing so does not limit what you can ask us directly, and it does not change who is responsible: designating a representative does not move accountability away from Aventura Virtual Solutions Inc.

In practice privacy@closerev.com is the faster route for an access or deletion request, because it reaches the people who can act on it. The representative exists so that there is an address inside the Union that you and your regulator can use, and it is a real one.