Legal
Subprocessors
We keep this list short on purpose — every vendor is another party with access to your data. These are the ones we use and exactly what each one sees.
- Last updated 2 October 2026
- Aventura Virtual Solutions Inc. (Canada), operating CloseRev
Contents
Current subprocessors
| Vendor | Purpose | Data it can access | Region |
|---|---|---|---|
| Cloudflare | Hosting, database (D1), file storage (R2), key-value storage for internal state, transactional email, and receiving the mail sent to our closerev.com addresses | All application data, including uploaded files, the account emails we send you, and any message (with its attachments) you email to us | Global edge |
| Stripe | Subscription billing and payment processing | Billing contact and payment details. Never sees uploaded customer data | US / global |
| Optional "Sign in with Google" authentication | Your Google account identifier, name and email — only if you choose to use it | US / global | |
| Have I Been Pwned | Checking a new password against a corpus of passwords exposed in public breaches | Not your password. We hash it here and send the first five characters of that hash — one prefix shared by hundreds of thousands of different passwords. They send back every match for the prefix and the comparison happens on our servers. The provider cannot tell which password was checked, or whose it was | Global edge |
| Google (Gemini API) | The written summary at the top of a report; help mapping unusual CSV column names; and — inside our own support console — a suggested draft answer to a support request you send us. The summary and the mapping help are on by default for new workspaces, and the workspace owner can turn either off in Settings | For the report summary: channel names, totals and counts. Never a record, a phone number or an email address. For column mapping: the names of your columns only, never their contents, and only when our own matching could not place a required column. If a file's first row looks like a customer's details rather than column names — an email address, or a value with seven or more digits, such as a phone number — nothing is sent. For a support draft: the text of the request you sent us, together with answers we have already published on our blog. Never your uploaded files, never anything from your account, and never another customer's case. The draft is only ever a draft: a person at CloseRev reads it, edits it, and decides whether to send anything | US / global |
| Telling LinkedIn when an ad led to a contact message, a signup or a payment, and showing CloseRev ads on LinkedIn to people who visited — only while Advertising is on (see below the table) | Only while Advertising is on: from our server, a scrambled (hashed) version of your email address, your IP address, LinkedIn's own click identifier if you arrived from one of their ads, and the amount for a purchase; and from LinkedIn's Insight Tag, which loads on our public pages only while Advertising is on, the pages it runs on, your IP address and browser, and its own cookies. Never your name, your workspace, or anything you have uploaded, and never on a signed-in page. With Advertising off, the tag never loads and nothing is sent — not the hash, not your IP, and not the fact that anything happened | US / global | |
| Telling Reddit when an ad led to a contact message, a signup or a payment, and showing CloseRev ads on Reddit to people who visited — only while Advertising is on | Only while Advertising is on: from our server, a scrambled (hashed) version of your email address, your IP address, Reddit's own click identifier if you arrived from one of their ads, and the amount for a purchase; and from the Reddit Pixel, which loads on our public pages only while Advertising is on, the pages it runs on (with their titles and descriptions), your IP address and browser, and its own cookies. The pixel's automatic matching — reading email addresses or phone numbers off the page — is switched off. Never your name, your workspace, or anything you have uploaded, and never on a signed-in page. With Advertising off, the pixel never loads and nothing is sent — not the hash, not your IP, and not the fact that anything happened | US / global | |
| Google Ads | Telling Google when an ad led to a contact message, a signup or a payment, and showing CloseRev ads on Google's network to people who visited — only while Advertising is on. Sent from our server through Google's Data Manager API, and also by Google's own tag when the contact form sends a message, when a demo tour is completed, and on the page shown right after you register, confirm your email or pay, so the ad can be credited in the same session | Only while Advertising is on: a scrambled (hashed) version of your email address, Google's own click identifier if you arrived from one of their ads, and the amount for a purchase; Google's tag then keeps that click identifier in a cookie of its own, sees the pages it runs on, and may add your browser to an audience. Not your IP address from our server. Never your name, your workspace, or anything you have uploaded. The tag runs on no signed-in page except the confirmation shown right after you confirm your email or pay, where it reports that one event. With Advertising off — including before you choose — Google's tag still runs on our public pages, with every kind of advertising storage denied, and sends Google only that a page was viewed, from which country, and the fact that no consent was given, with any click identifier stripped; it sets no advertising cookie and sends nothing else for advertising | US / global |
| Google Analytics | Measuring traffic on our public site | Google's tag loads on every public page for every visitor, in Google's Consent Mode. With Analytics off — including before you choose — it sets no cookie and sends only that a page was viewed, from which country, and that consent was not given. With Analytics on it sets its own cookies and records the pages visited, approximate location and device. Never loaded on a signed-in page, so it sees no workspace or uploaded customer data | US / global |
When the advertising and analytics rows apply
In the United States and in Canada outside Quebec, Analytics and Advertising are on by default: we tell you so in a notice when you arrive, and you can switch either off in one click, there or at any time from Your privacy choices. Everywhere else, including Quebec and anywhere we cannot tell where you are, both are off until you accept. A Global Privacy Control signal from your browser always turns Advertising off, wherever you are, and cannot be overridden by clicking accept. Details are in our Cookie Policy.
Account emails (verification and password reset) are sent by Cloudflare Email Sending rather than a separate email vendor — deliberately, so that using the product doesn't hand your email address to one more company. Mail you send to a closerev.com address is received by Cloudflare too: a message to support@ becomes a case in our own system, with its attachments kept in our own storage, and our team's mailbox receives a copy of the text without the attachments.
What we don't use
No data brokers and no session-replay trackers. Three advertising tags exist — Google's, LinkedIn's and Reddit's — on the public site only, with one exception: the confirmation shown right after you confirm your email or pay, where Google's tag reports that one event if Advertising is on. Google's tag runs for everyone in a cookieless mode that identifies nobody, and sets cookies and builds audiences only while Advertising is on; LinkedIn's and Reddit's do not load until it is. Our own page counting runs on every public page — never on a signed-in page — and keeps only daily totals with no identifier of any kind: no cookie, no address, no browser. It is never used for advertising or shared.
Changes
Before adding or replacing a subprocessor we email the owner of every workspace at least 30 days in advance. You may object, and if we cannot resolve the objection you may end the affected service, as set out in the DPA. Anyone else who would like the same notice can ask at privacy@closerev.com.
Questions about this document? legal@closerev.com. Data requests go to privacy@closerev.com.