Data Usage & Retention Policy

1. Purpose

This document explains how CloseFlow handles data through its full lifecycle, from collection to deletion. It is intended to give Agents and the individuals they serve clear, operational visibility into our practices. It complements, and does not replace, our Privacy Policy and Terms of Service.

2. Data categories and storage

The table below summarises where each category of data is stored and how it is protected.

3. Data lifecycle

Every category of data follows the same general lifecycle:

• Collection: data enters the Service when an Agent signs up, enters a Lead, composes a message, connects an integration, or interacts with a feature.
• Processing: data is used only for the purposes described in the Privacy Policy, such as delivering a message or syncing a calendar.
• Storage: data is stored in the locations set out in Section 2.
• Retention: data is kept for the periods in Section 9 of the Privacy Policy.
• Deletion: at the end of the retention period, or on a valid deletion request, data is securely deleted or anonymised, subject to legally required retention.

4. Artificial-intelligence processing

When an Agent uses an artificial-intelligence feature to draft content:

• The prompt and supporting context the Agent submits are sent to Anthropic (the Claude service) to generate a draft. This context may include a Lead's name and relationship details so that the draft can be personalised.
• The draft returned is shown to the Agent. Only the Agent's reviewed and adopted version is sent to a Lead, never raw output sent automatically.
• Anthropic processes this data as a service provider. Its handling of data is governed by its own privacy policy.
• Where the Service stores voice or style profile samples to match an Agent's tone, those samples are stored within CloseFlow and are not provided to Anthropic to train its models.

The in-app support assistant is a separate AI feature with its own, narrower data flow:

• It answers from CloseFlow's own documentation plus a small set of verified, server-computed account-status facts (plan, plan status, and which integrations are connected). It does not read Lead, message, or billing records, and has no access to an Agent's pipeline data.
• Conversations with the assistant are sent to Anthropic to classify the question and generate an answer, under the same processor terms described above, and are retained for 6 months (see Section 8).
• Questions the assistant cannot answer confidently are routed to a person rather than guessed at; that handoff may create a support ticket containing a summary of the conversation.

Two further AI surfaces are public - anyone can reach them without an account - and both run on a different provider, xAI (Grok). Neither has any access to an Agent's account, Lead, message, or billing data:

• The company line, (249) 486-6555. The call audio is bridged to xAI in both directions in real time so the assistant can hear and speak, together with the caller's number from caller ID. xAI returns the spoken audio and an automated transcription of both sides of the conversation. The transcript, the caller's number, and any message taken are written to a contact record and a call note in CloseFlow's own account, and a copy of the transcript and the message is emailed to our team, through our email provider, so the enquiry can be followed up. Where call recording is enabled on the line, an announcement is played at the start of the call, before the assistant speaks. The transcript and any recording we hold are kept for 6 months from the call; the emailed copy is a second copy in our own mailbox and is not covered by that automated deletion (see Section 8).
• The chat widget on our website. The visitor's message and the earlier messages of the same conversation are sent to xAI, which returns the reply text. Nothing is written to our database: the conversation is held in the page and is gone when the visitor leaves. There is no retrieval step and no account context.

Both assistants answer from one curated pack of product facts, which contains no personal information. xAI processes what it receives as a service provider, in the United States, under its own privacy policy.

5. Communication content handling

• The content of email and SMS messages sent through the Service, together with their metadata, is retained for the lifetime of the account and deleted within approximately 30 days of account closure, after we have sent you a full export.
• Each message carries an audit trail recording the sender, recipient, timestamp, the consent reference relied on, and the send status.
• Email delivery and engagement events (delivered, opened, clicked, bounced) are recorded through our email providers: one sends the message, and a second receives replies so that they thread back to the Agent. Both are named in Section 6 of the Privacy Policy.

6. Consent management

• The Service maintains a CASL consent log that records, for each consent event, the timestamp, the method and source of consent, and the relevant consent context.
• The consent log is append-only: entries are written once and are not edited by Agents, so the audit trail remains intact.
• Consent records are retained for the lifetime of the account plus a minimum of 3 years after the relevant consent event, consistent with the CASL limitation period.
• Implied consent has a time limit, and the Service enforces it. Under CASL, implied consent lasts for six months after an enquiry, and for two years after an existing business relationship such as a purchase or a lease. A contact whose implied-consent window has passed is excluded from the campaign audiences the Service draws on — the record itself is kept, because it is the audit trail described above, but the Service will not include that contact in a campaign send. A one-to-one reply to a person who wrote to the Agent is a direct response rather than a campaign, and is outside this filter.
• A call to our own company line, (249) 486-6555, creates a contact record in CloseFlow's account so that the enquiry can be followed up. The record stores the CASL basis a business enquiry gives - implied consent - together with its source and the date of the call, because that is the audit trail the log is for. We do not act on it for marketing. A contact record whose source is the company line is excluded from the audiences our own campaigns draw on, so it is never part of a campaign send; what the caller gets back is a reply to their enquiry, and they can ask us to delete the record at any time, as described in Section 3 of the Privacy Policy and Section 8 below. Separately, and for every contact record in the Service: an unsubscribe, a STOP reply, or an email to [email protected] sets a record to withdrawn, and records marked withdrawn, expired, or awaiting review are excluded from campaign audiences and from the email, SMS, and WhatsApp send paths in the Service.

7. Calendar data lifecycle

Calendar synchronisation is built around data minimisation.

• Authorisation: when an Agent connects Google Calendar, the resulting tokens are encrypted at rest (Fernet with HKDF-derived keys) and used only by the sync process.
• What we read: for external events on a connected calendar, we store only the time ranges of busy periods. We do not read or store event titles, descriptions, locations, or attendees.
• Disconnection: when an Agent disconnects the calendar, we delete the stored tokens and the stored busy-time ranges. Appointments that CloseFlow created in the Agent's Google Calendar remain in Google Calendar; an Agent who wishes to remove them must delete them in Google Calendar directly.

8. Data deletion procedures

• How to request: an Agent can delete their account through in-application settings, or by emailing [email protected].
• Soft deletion: on request, the account is marked deleted and hidden from the interface, with a 30-day grace period during which it can be recovered.
• Hard deletion: thirty days after a deletion request, the Agent's personal information and the personal information of their Leads is erased from CloseFlow's primary database. In the same operation, CloseFlow deletes the following at the third parties that hold it, using each provider's own deletion interface:
  • uploaded content assets and document attachments, at our object-storage provider (Cloudflare R2), including the offsite copies;
  • SMS and WhatsApp message content, call records, call recordings and voicemail transcriptions, at Twilio;
  • the identity verification session at Stripe, including any government photo identification and liveness image submitted to it.
  CloseFlow also revokes its authorisation to the Agent's Google Calendar. Revocation ends CloseFlow's access; it does not delete anything Google holds — Section 7 describes what happens to appointments.
• Providers that do not accept a deletion instruction: several providers hold data on CloseFlow's behalf but publish no way for CloseFlow to delete an individual person's records. CloseFlow cannot shorten their schedules and does not claim to; in these cases the data is deleted by the provider on its own timetable. Resend — the content of emails sent through the Service: 30 days from the date of sending. Postmark — replies from Leads and Subscribers, received on CloseFlow's behalf: 28 days from receipt (mail received before 30 July 2026 leaves on the provider's earlier 45-day schedule as it ages out). Anthropic and xAI — text and, for the CloseFlow telephone line, call audio processed for AI features: 30 days from receipt, and longer for material a provider's safety systems flag. Sentry — fault reports, which may contain a fragment of personal information: 30 days. Meta — WhatsApp message content: deleted on delivery, and in all cases within 30 days; the recipient's WhatsApp telephone number is retained by Meta and CloseFlow has no means to remove it. Google reCAPTCHA — the IP address and browser identifier of a visitor who submits a public form: Google does not document a retention period for this data and provides no deletion interface. Microsoft — where an Agent connected an Outlook or Microsoft 365 calendar, the tokens CloseFlow stored are destroyed with the account, which ends CloseFlow's access; Microsoft's own record of the authorisation can only be removed by the Agent, at myapplications.microsoft.com.
• Exceptions that survive closure: three categories are retained after account closure. CASL compliance records - consent, unsubscribe requests, and related commercial electronic message logs - for a minimum of three (3) years from the date of the relevant event or account deletion, solely to demonstrate compliance with CASL and to respond to potential regulatory inquiries. Financial and tax records - billing and payment-related information - for six (6) years under Canada Revenue Agency requirements. Encrypted backup snapshots - a backup cannot be edited to remove one person without destroying it for everyone in it; snapshots are overwritten on a fixed schedule, and the last snapshot containing a deleted account is overwritten within twelve months. Apart from these, we do not retain personal information longer than necessary for the purposes for which it was collected.
• Agent call recordings: a recording of a call an Agent placed or received through the Service, and any automated transcription of a voicemail left on it, are deleted 365 days after the call — the audio at our telephony provider and the pointer to it in the call record, by a scheduled job that runs nightly. An Agent can delete an individual recording sooner from within the application. A deletion the provider will not confirm leaves the recording inaccessible and stays on the retry list until it succeeds, rather than being recorded as done.
• Your export, without a login: when an Agent asks us to delete their account we email a download link straight away. It needs no sign-in, works for 30 days, and can be used up to five times. The archive carries the Agent's leads and their message history, subscribers, calendar, and consent records - the consent records especially, since the obligation to prove consent for a message already sent stays with the Agent after they leave.
• Support assistant conversations: chat transcripts with the in-app support assistant are retained for 6 months from the last message in the conversation, then deleted. This is separate from and shorter than the communication-content retention above, reflecting that support conversations are a service-improvement and quality record, not a CASL/consent record. Support tickets and their escalation records (the ticket summary and question, not the full transcript) are business records and are retained for the life of the account, then deleted with it.
• Company line call records: the transcript of a call to (249) 486-6555 and the message taken are removed from the call record 6 months after the call, and any recording of it is deleted at our telephony provider at the same time, by a scheduled job. The window is 180 days and the job runs weekly, so removal normally lands within a few days of that mark rather than on the day itself. A call record is never half-deleted: where a recording exists, the conversation is removed on the first sweep after the 180-day mark on which we can confirm the recording was destroyed at our provider. If that provider cannot be reached, the conversation is kept alongside it until the deletion succeeds, and the failure is alarmed to us each week rather than passed over quietly. The same sweep replaces the one-line summary of the call held on the contact record. What survives is the header of the record - that the call happened, when, how long it ran, and how it ended. The contact record created for the call is kept as our record of the enquiry, on the basis in Section 6 and outside any campaign audience, until the caller asks us to remove it.
• The emailed copy of a company line call: the notification sent to our team when a call ends carries the transcript and the message, and it lands in a mailbox. No scheduled job can reach a mailbox, so that copy is outside the 6-month deletion above: it stays until we delete it by hand, and our email provider holds its own record of the message under Section 6 of the Privacy Policy. When a caller asks us to delete a call, deleting that copy is part of how we action the request.
• Asking sooner: a caller can ask for any of the above to be deleted before the 6 months are up by emailing [email protected]; because CloseFlow is the controller for these calls, the request comes to us directly rather than to an Agent.
• Confirmation: a confirmation of deletion is available on request, normally within 30 days of completion.

9. Data portability

• Self-service export: an Agent can export their data from the account settings area.
• Format: the export is a structured archive containing Leads, calendar events, messages, consent records, and settings.
• Availability: an export remains available for 30 days following a deletion request, so an Agent can retrieve their data before it is purged.

10. Processor data flows

The processors that support the Service are listed in Section 6 of our Privacy Policy, with their purpose, the data shared, and their location. The summary below describes the direction of data flow.

Each processor maintains its own sub-processors. Their respective privacy policies, linked in the Privacy Policy, describe those arrangements.

11. Security measures

• Encryption: TLS in transit; Fernet with HKDF-derived keys for secrets at rest; bcrypt for passwords.
• Access control: role-based access, with multi-tenant isolation enforced at the data-query layer so that one Agent cannot access another Agent's data.
• Authentication: two-factor authentication is available, using time-based one-time passwords and recovery codes.
• Audit logging: sensitive actions are logged to support accountability and investigation.
• Vulnerability disclosure: security concerns may be reported to [email protected] (currently routed to [email protected]).
• Breach response: where a breach poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA, and we aim to notify without undue delay.

12. Exercising your rights

The operational procedures for data subject requests are:

• Access: submit a request through account settings or to [email protected]; we respond within 30 days.
• Correction: Agents can correct most data directly; otherwise submit a request, answered within 30 days.
• Deletion: follow the procedure in Section 8; we respond within 30 days.
• Regulator complaint: contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of Quebec may contact the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

Because Agents control Lead information, a Lead should ordinarily direct a request to the Agent they are dealing with; CloseFlow will facilitate it, as described in our Privacy Policy.

13. Changes to this document

We may update this document from time to time. When we make a material change, we will update the "Last updated" date above and notify Agents through an in-application notice, by email, or both, before the change takes effect.

14. Contact