Privacy Policy
In short
- On this website we collect only what you give us (for example your email for the waitlist). We use no advertising or analytics cookies.
- In the Clossara service, your company decides what data is connected. We process it only to provide the service, on your company's instructions.
- Your conversations are analysed by Clossara's own model, after names and addresses are redacted. They are never sent to a third-party AI provider and never used to train any model.
- We do not sell personal data, and we do not use it for advertising.
1. Who we are
This policy explains how Clossara (“Clossara”, “we”, “us”) handles personal data.
This policy covers:
- the website at clossara.com, including the waitlist;
- Clossara campaign pages (addresses starting with
/p/on a Clossara domain); - the Clossara service, including the web portal (for example app.clossara.com), the copilot and the MCP server.
2. Controller or processor
Who decides what happens to the data depends on the kind of data:
- Customer data is the data your company connects to or uploads into Clossara: CRM records, emails, call records, documents and copilot conversations. Here your company is the controller and Clossara is its processor. We process customer data only to provide the service, on your company's documented instructions, under the data processing agreement (DPA). If you are a contact in a customer's CRM or mailbox and want to exercise your rights, please contact that company; we will help them respond.
- Our own data is the data we collect for ourselves: website visitors, waitlist and campaign sign-ups, user account details (email and sign-in), billing contacts, and support correspondence. For this data Clossara is the controller.
3. What we collect
| Where | Data | Source |
|---|---|---|
| Waitlist | Email address, the page you signed up from, and the time | You |
| Campaign pages | Email address, and if the form asks for them, your name and company; whether you ticked the consent box; the campaign tags of the link you followed (utm_* parameters) and the page you came from | You, and your browser |
| User accounts | Work email, workspace, role, a salted hash of your password (never the password itself), whether your email is verified | You, or the administrator who invited you |
| Customer data | What your company connects or uploads: CRM deals, accounts and contacts; emails from mailboxes your users connect (read-only); call records; uploaded documents; copilot conversations | Your company's systems, with its authorisation |
| Technical data | IP address, browser type, the address requested, time, and the result, recorded in server logs; on the website, Cloudflare's bot check (Turnstile) on the waitlist form | Your browser |
| Correspondence | What you write to us, for example at [email protected] | You |
4. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Tell you when Clossara is available, and about access to it | Waitlist | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Answer a campaign page request and follow up on it | Campaign pages | Your consent, where the form asks for it (Art. 6(1)(a)); otherwise taking steps at your request before a contract (Art. 6(1)(b)) |
| Know which campaigns bring people to us | Campaign tags and referring page | Our legitimate interest in measuring our own marketing (Art. 6(1)(f)) |
| Provide the service: sign-in, workspaces, analysis, drafts, the copilot | User accounts, customer data | Performance of our contract with your company (Art. 6(1)(b)); for customer data, your company's instructions under the DPA (Art. 28) |
| Account emails: email verification and team invitations | User accounts | Performance of the contract (Art. 6(1)(b)) |
| Keep the service secure: stop abuse and spam, investigate incidents | Technical data | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Billing, accounting and tax | Billing contacts and invoices | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Support | Correspondence, and with your approval the relevant part of your workspace | Contract (Art. 6(1)(b)) |
We do not make decisions about people that have legal or similarly significant effects based solely on automated processing. Clossara is a decision-support tool: it informs, and a person decides.
5. How the AI handles your data
- Redaction first. Before any text reaches the model, the service replaces email addresses and people's names with labels and removes phone numbers.
- Clossara's own model. Analysis runs on a model operated by Clossara on servers Clossara operates. The model server keeps text in memory only while answering, and does not log or store it.
- No third-party AI. Customer data is not sent to OpenAI, Anthropic, Google or any other AI provider.
- No training. Customer data is never used to train or fine-tune any model, including Clossara's own.
- A person stays in charge. Drafts are suggestions. Clossara cannot send from your mailbox; a person reviews a draft and sends it themselves.
The Security page describes these controls in more detail.
6. Google and Microsoft data
If you connect a Gmail or Outlook mailbox, Clossara reads it with read-only permissions (gmail.readonly for Google, Mail.Read for Microsoft). It uses the messages only to show and analyse your sales conversations inside your workspace. You can disconnect a mailbox at any time from the service, or revoke access from your Google or Microsoft account settings.
Clossara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we use Google user data only to provide and improve the user-facing features of Clossara;
- we do not transfer it to others, except as needed to provide the service, to comply with law, or as part of a merger or acquisition with notice to you;
- we do not use it for advertising;
- we do not use it to train AI or machine-learning models;
- our staff do not read it, except with your permission for a support request, for security purposes such as investigating abuse, or to comply with law.
8. Where it is stored
The service and its database are hosted in the European Union. Cloudflare runs a global network, so requests to this website may pass through Cloudflare locations outside the EU. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
9. How long we keep it
| Data | Kept |
|---|---|
| Waitlist | Until you ask us to remove it, or 24 months after we last contacted you, whichever comes first |
| Campaign page sign-ups | Until you ask us to remove them, or 24 months after we last contacted you, whichever comes first |
| User accounts | While the account exists. An administrator can remove a user at any time; this also removes the mailbox data synced for them. |
| Customer data | While your company's contract is active, and afterwards as set out in the contract and the DPA. Your company can delete conversations, documents and users at any time, and export or delete its whole workspace. |
| Server logs | Up to 30 days, unless needed to investigate a specific incident |
| Billing records | As long as accounting and tax law requires |
10. Security
Original conversations, uploaded documents and connection credentials are encrypted at rest. All traffic is encrypted in transit. Passwords are stored only as salted hashes. Clossara staff have no standing access to customer data, and every support access is logged. The Security page describes these and other measures. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.
11. Your rights
Under the GDPR and similar laws you have the right to:
- access the personal data we hold about you, and get a copy;
- correct it if it is wrong;
- delete it;
- restrict how we use it;
- receive it in a portable format (portability);
- object to processing based on our legitimate interests;
- withdraw your consent at any time, where we rely on it. This does not affect processing that already happened.
To use any of these rights, write to [email protected]. We reply within one month. For customer data, we pass your request to the customer that controls the data and help them answer it.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
13. Children
Clossara is a business service. It is not meant for anyone under 16, and we do not knowingly collect their personal data.
14. Changes to this policy
We may update this policy as the service changes. The date at the top shows the latest version. If a change materially affects how we handle your personal data, we will tell customers' administrators by email or in the service before it takes effect.
15. Contact
For privacy questions and requests, write to [email protected].
See also: Terms of Service · Security