Privacy policy

Effective 9 October 2026 · Last updated 9 October 2026

1. Who we are
2. Our role
3. What we collect
4. Google user data
5. How we use data
6. AI processing
7. Who we share it with
8. How long we keep it
9. Security
10. International transfers
11. Your rights
12. If you are a store's customer
13. Children
14. Changes
15. Contact

1. Who we are

CLOSD ("CLOSD", "we", "us") provides software that helps online stores turn their support conversations, reviews and orders into personal messages to their customers. This policy covers the website at closd.org and the CLOSD service. You can reach us about anything in it at [email protected].

2. Our role

CLOSD handles two kinds of data, and our role differs for each.

• Store data. When a store connects its systems (its shop, support inbox, helpdesk or review platform), the data in them belongs to the store. The store is the controller of that data and CLOSD is its processor: we process it only on the store's instructions and to provide CLOSD to that store, under a data processing agreement with the store.
• Our own data. For information about the people we deal with directly (store owners and staff who use CLOSD, people who email us, visitors to this website) and for the OAuth credentials that let CLOSD read a connected mailbox, CLOSD is the controller.

3. What we collect

Website visitors

This website does not use analytics, advertising or tracking cookies, and it does not load third-party scripts or fonts. Our host, Cloudflare, processes technical data such as IP addresses and request details to deliver the site and protect it from abuse, and may set strictly necessary security cookies to do so.

People who contact us or use CLOSD

Name, work email address, the store you work for, your role, and what you write to us. If you approve or edit drafts in CLOSD, we record who approved what and when.

Data from a store's connected systems

When a store connects a system, CLOSD reads the data it needs to provide the service:

• Shop (for example Shopify), read-only: customers (name, email, phone, address, marketing consent), orders and their line items, products and discount codes. CLOSD creates single-use discount codes in the shop only when the store has approved that.
• Support inbox (Gmail), read-only: see section 4.
• Helpdesk or review platform, read-only: support tickets, messages and reviews, with the customer's name and contact details.
• Messaging channels (for stores that use CLOSD's sales texts): the messages exchanged with the store's customers, opt-ins and opt-outs.

4. Google user data

A store can connect its support mailbox through Google's sign-in. The person who signs in to that mailbox grants CLOSD access, and can revoke it at any time.

What we access

CLOSD requests one Google scope: https://www.googleapis.com/auth/gmail.readonly. With it, CLOSD reads the email messages and threads in the connected mailbox: the sender and recipients, date, subject, message body and the thread each message belongs to. We also store the OAuth refresh token Google issues so CLOSD can keep reading new support mail. CLOSD cannot send, delete, move, label or change any email with this scope.

How we use it

We use Google user data only to provide and improve CLOSD's user-facing features for the store that connected the mailbox:

• to find conversations with the store's customers, and to filter out what isn't one (notifications, newsletters, bounces, automatic replies and internal threads are skipped);
• to match each conversation to the store's customer and their orders;
• to understand what happened and whether the customer's experience was good or bad;
• to draft a personal email or text that the store's team reviews and approves before it is sent from the store's own systems;
• to keep the store's customer profiles current as new support mail arrives.

How we store it

Messages we keep are stored in CLOSD's database together with the store's other data, on encrypted storage. OAuth refresh tokens are stored as secrets, separate from our code, and are never written to logs. All data travels over encrypted connections (TLS).

Who we share it with

We share Google user data only:

• with the store that connected the mailbox, inside CLOSD;
• with the service providers that host CLOSD and process text for it (including the AI model provider described in section 6), only to provide CLOSD, under contracts that forbid them to use it for anything else;
• when the law requires it, or to protect against fraud, abuse or security threats;
• as part of a merger, acquisition or sale of CLOSD's assets, and only after the store has given its explicit prior consent.

What we never do with it

• We never sell Google user data or transfer it to data brokers or information resellers.
• We never use it for advertising, including retargeting, personalised or interest-based ads.
• We never use it to determine credit-worthiness or for lending.
• We never use it to develop, improve or train generalised AI or machine-learning models.
• People at CLOSD do not read it, except when the store asks us to for specific messages (for example, to review drafts together during setup), when needed for security purposes such as investigating abuse, to comply with the law, or when the data is aggregated and anonymised for our internal operations.

CLOSD's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke access and delete it

You can remove CLOSD's access at any time in your Google Account under Third-party apps & services, or by emailing [email protected]. CLOSD then stops reading the mailbox. We delete the Google user data we hold for that mailbox within 30 days of the disconnection, or sooner if the store asks.

5. How we use data

Purpose	Data	Legal basis (where GDPR applies)
Providing CLOSD to a store: profiles, drafts, approvals, codes, attribution, reports	Store data	Processed on the store's instructions under our data processing agreement; the store is responsible for its own legal basis
Running our relationship with a store and its staff	Contact details, communications	Contract, and our legitimate interest in running our business
Keeping CLOSD and this website secure	Technical data, logs	Legitimate interest in security
Billing the revenue share	Order totals and codes used, per store	Contract
Complying with the law	As required	Legal obligation

We never use store data for our own marketing, and we never combine one store's data with another's.

6. AI processing

CLOSD uses an AI model provider to read conversations and draft messages. The provider processes this text only to return results to CLOSD, under terms that prohibit it from training its models on the data. We list the provider in our sub-processor list, which stores receive with their data processing agreement and anyone can request at [email protected]. Every draft is checked against the conversation and order data it came from, and the store's team approves drafts before anything is sent, under the approval rules the store sets.

7. Who we share it with

We share data with service providers that help us run CLOSD (hosting, databases, the AI model provider, email delivery), only as needed to provide the service and under contracts that require them to protect it. A store's data is shared with that store and no other. We may disclose data if the law requires it. We do not sell personal data.

8. How long we keep it

• Store data, including Google user data: while the store uses CLOSD. When a store disconnects a system or ends its agreement, we delete that data within 30 days, unless the store asks us to delete it sooner or the law requires us to keep part of it.
• Records of approvals, codes and attributed orders: for as long as needed to bill and settle the revenue share, and then as long as accounting law requires.
• Emails with us: for as long as we have a business relationship, and up to two years after.

9. Security

We protect data with encryption in transit and at rest, access limited to the people who need it to run CLOSD, secrets kept out of our code, and read-only access to store systems wherever the work allows it. If a breach affects a store's data, we tell the store without undue delay so it can meet its own obligations.

10. International transfers

CLOSD and its service providers may process data outside your country, including outside the European Economic Area. Where we transfer personal data out of the EEA or the UK, we use safeguards recognised by law, such as the European Commission's Standard Contractual Clauses.

11. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent you gave. To use any of these rights, email [email protected]. We answer within one month. You may also complain to your data protection authority.

12. If you are a store's customer

If you bought from a store that uses CLOSD, that store controls your data and decides how it is used. Please send requests about your data to the store directly. If you write to us instead, we will pass your request to the store and help it respond. You can unsubscribe from any email or text a store sends through CLOSD, using the link or reply option in that message.

13. Children

CLOSD is a service for businesses and is not directed at children. We do not knowingly collect data from children through this website.

14. Changes

If we change this policy, we will update the date at the top and, for material changes, tell connected stores by email before the change takes effect.

15. Contact

Questions about this policy or your data: [email protected]. Anything else: [email protected].