Privacy policy

1. Roles

The businesses that use the service ("business customers") decide which data about their own customers is kept and why – they are the controllers of that data, and we process it for them and on their instructions. For the account data of the service's own users, we are the controller.

2. What data we process

• Account: name, email, phone (if entered), role and permissions, a hashed password, an encrypted two-step verification secret, sign-in times and trusted devices.
• Contacts and leads that the business enters or that arrive from forms / the API: name, phones, emails, source, status, tags, notes, tasks, deals and extra fields.
• Consent and opt-outs: marketing consent status, opt-out requests and the do-not-call list – so they are honoured on every channel.
• Phone calls: numbers, time, duration, outcome and agent; a recording – only if the business turned recording on; technical audio-quality data of the call.
• WhatsApp: content and metadata of inbound and outbound messages, media files, templates, and delivery and read statuses.
• Email: messages and delivery events, only if the business connected its own email account.
• Support requests: name, email, business name and the request text.
• Technical data: an audit log of actions, and short-lived counters that limit sign-in attempts (keyed by a hash of the email / IP address).

3. Data from Meta and the WhatsApp Business Platform

When a business connects a WhatsApp number through Meta's sign-up flow (Embedded Signup), we receive and store: the WhatsApp Business Account (WABA) and phone number identifiers, display name, quality rating and messaging limit; a business access token, encrypted at rest; the business's message templates and their status; and messages and updates that Meta sends us by webhook.

We use this data only to let the business send and receive messages, manage templates and numbers, and show it its conversations (the whatsapp_business_messaging and whatsapp_business_management permissions). We do not sell it, do not use it for advertising or profiling, and share it only with the service providers in section 7 to run the service.

4. Calls and recordings

Calls go through the service's telephony server. Recordings are kept on that server (not in the database) and are opened only for an authorised user through the service. The business is responsible for informing the other party of recording and for following the law.

5. AI features (only if turned on)

AI features are off until the business turns them on. When they run, the text needed for the request (and, for transcription, the call audio) is sent to the AI provider (OpenAI or Anthropic; for transcription also Deepgram if configured) – under the business's own provider account if it connected its own key, otherwise under ours. The features process only data the user may see. We do not train models on the businesses' data.

6. Why we use data

• To run the service: leads, dialing, messages, reports and automations the business set up.
• Security, abuse prevention and enforcing consent and opt-outs.
• Support and operations. Our operations team sees status fields per business (such as the number of users and connection states) – not conversation, message or recording content.

7. Service providers

We disclose data to authorities only when the law requires it.

• Vercel – application hosting.
• Neon – database (PostgreSQL).
• Meta Platforms (WhatsApp Business Platform / Cloud API) – WhatsApp messages.
• The service's telephony server (on Amazon Web Services) and the phone line carrier – calls and recordings, when telephony is active.
• OpenAI, Anthropic, Deepgram – only if the business turned on AI features or transcription.
• Resend – email, only if the business connected its own account.
• Browser push services (Web Push) – only for a user who turned on browser notifications.
• Apple Push Notification service and Firebase Cloud Messaging (Google) – only for a user who turned on notifications in the Clozer iPhone or Android app. The device push token is stored encrypted; a notification carries only a short title and an internal link. Turn off: Settings → Notifications, or in the device settings.
• Caller name lookup (RapidAPI) – only if turned on for the business; only the phone number is sent.

8. Retention

• Data is kept while the business account is active.
• The business can set retention periods for message content and media, recordings and the audit log (in the business settings and the dialer settings); after that period the content is deleted (the message record itself stays for counting).
• Call audio-quality data – 30 days; audio problem reports – 90 days.
• Meta deletion request receipts – 90 days, with a fingerprint instead of the user id.
• Unfinished WhatsApp connection attempts – deleted 30 days after they expire.
• Business deletion: connections and tokens are erased at once, everything else after 14 days (section 9).

9. Deletion and disconnection

• Business owner: Settings → My account → "Delete the business and all data". WhatsApp and email connections are disconnected and their tokens erased at once; after 14 days (cancellable until then) all of the business's data, the recordings on the telephony server, and user accounts that belong to no other business are permanently deleted.
• Any user: Settings → My account → "Delete my user" – name, email and phone are erased at once; work records stay with the business without identifying you.
• Disconnecting WhatsApp: Settings → Connections → WhatsApp → Disconnect – see the disconnect page.
• Through Facebook: removing the app or a data deletion request – see the data deletion page.
• Customers of a business that uses the service contact that business; we will help it.

10. Security

• Encrypted transport (HTTPS).
• Tokens and secrets encrypted at rest (AES-256-GCM).
• Separation between businesses at the database level (Row-Level Security) and permissions checked on the server.
• Two-step verification (TOTP) and an audit log.

11. Cookies and browser storage

We use only the cookies needed to sign in and keep you signed in (and to recognise a trusted device for two-step verification), and browser local storage for display preferences. There are no advertising or analytics cookies.

12. Your rights

You can ask to access, correct, delete or restrict the processing of your data: edencohen533@gmail.com.

13. Children

The service is meant for businesses and is not meant for children.

14. Changes

We publish every change to this policy here, with its update date.