Privacy Policy

This Privacy Policy describes how CloseKit ("CloseKit", "we", or "us") collects, uses, shares, and protects information when you use the Service at closekit.cc. By using the Service, you agree to the data practices described here.

This policy is incorporated into our Terms of Service.

We collect information in the following categories:

• Account information: email address, password (stored as a hash, never plaintext), full name, phone number, role (residential agent, property manager, transaction coordinator, etc.), and brokerage name.
• Deal data: property addresses, purchase prices, contract and closing dates, deal type, party names (buyer, seller, lender, title company), milestone status, and contracts or other documents you upload.
• Client information you enter: the names, phone numbers, and email addresses of buyers, sellers, or other parties you add to a deal or generate portal links for.
• Payment information: handled entirely by Stripe. We never see or store your full card number, CVV, or bank account details. Stripe sends us a customer ID and metadata about subscription status only.
• Usage and device information: IP address, browser type, device type, pages visited, actions taken (e.g., uploads, milestone updates), and timestamps.
• Communications: messages sent through the client portal, support emails you send us, and feedback you provide.

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Authenticate your account and keep it secure.
• Send transactional email — account confirmations, magic-link client portals, milestone reminders, billing receipts, and notifications when a client sends you a message.
• Generate the timelines, reminders, and progress views that make the Service useful.
• Extract structured data from contracts you upload, using a combination of our own deterministic parser and, when needed, AI-assisted extraction (see "AI-assisted document processing" below).
• Process payments and manage subscriptions through Stripe.
• Detect, prevent, and respond to fraud, abuse, or violations of our Terms.
• Comply with legal obligations and respond to lawful requests from authorities.

We do not sell personal information. We do not share information for cross-context behavioral advertising. We do not use your data to train AI models for unrelated purposes.

We share information only with the third-party providers that operate the Service. Each is contractually bound to use data only to provide their service to us:

• Stripe — payment processing and subscription management.
• Supabase — authentication, database hosting, and file storage.
• Resend — transactional email delivery.
• Vercel — web application hosting and serverless function execution.
• Anthropic— AI-assisted extraction of fields from contracts you upload, only when our deterministic parser cannot fill a field and only if you have AI assistance enabled in Settings. See "AI-assisted document processing" below for full details.

We may also disclose information when required by law, in response to valid legal process, to protect the rights and safety of CloseKit or others, or in connection with a merger, acquisition, or sale of assets (in which case the acquiring entity will be bound by this policy or notify you of any changes).

When you upload a contract, CloseKit first runs a deterministic parser that we built and operate ourselves. It reads form-field annotations and applies pattern-matching to extract values. Nothing leaves CloseKit's infrastructure during this step.

For fields the deterministic parser cannot fill confidently, the Service may use AI-assisted extraction powered by Anthropic's Claude API. When this runs:

• Only the specific pages relevant to a missing field are sent to Anthropic — not the entire contract.
• Anthropic is a US-based company that processes content on US infrastructure. Anthropic does not use API content to train its models.
• Content sent to Anthropic may be retained by Anthropic for up to thirty (30) days for trust and safety review purposes, after which it is deleted. CloseKit does not store the AI provider's copy of your content.
• You can disable AI-assisted extraction in Settings. With it off, only the deterministic parser runs and no contract content is sent to any third-party AI provider.

Extracted values — whether from the deterministic parser or AI-assisted extraction — always appear on the review screen for you to confirm or correct before they are saved to your deal. CloseKit does not auto-save AI-extracted values to your account.

We keep your data for as long as your account is active. After cancellation, we retain account and deal data for ninety (90) days to allow you to reactivate, then delete it. You can request earlier deletion by emailing us. Some logs and backups may persist for additional limited periods (typically up to 30 days for application logs and 90 days for backups). We may retain information longer when required by law, for fraud prevention, or to enforce our Terms.

We use reasonable technical and organizational measures to protect your data: encryption in transit (TLS), encryption at rest through our database provider, access controls, and the principle of least privilege for internal systems. Stripe handles all payment card data and is PCI-DSS Level 1 compliant.

No system is perfectly secure. We cannot guarantee absolute security and you provide your data at your own risk. If we become aware of a security breach affecting your data, we will notify you without undue delay.

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information through your account settings or by emailing us.
• Delete your account and associated data, subject to legal retention requirements.
• Export your deal data (export feature in Settings, or request via email).
• Opt out of non-transactional emails.

California residents (CCPA/CPRA): you have the additional rights to know what personal information we collect, to request deletion, to correct inaccurate information, to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise any of these rights, contact closekit1@outlook.com.

We use cookies and similar technologies that are necessary for the Service to function — primarily to keep you signed in and to maintain session state. We use Vercel's built-in analytics for aggregate, anonymized usage statistics. We do not use third-party advertising cookies, cross-site trackers, or social media pixels.

CloseKit is intended for adult real estate professionals. The Service is not directed at children under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

CloseKit is offered to and intended for users located in the United States. Data is processed and stored on infrastructure operated by US-based providers. The Service is not intended for use by residents of the European Union, European Economic Area, United Kingdom, or other jurisdictions outside the United States, and we make no representation that the Service complies with the laws of those jurisdictions. If you access the Service from outside the United States, you do so at your own risk and are responsible for compliance with local laws.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and post the updated policy on this page with a new "Last updated" date. Continued use of the Service after the effective date means you accept the revised policy.

For privacy questions, requests to exercise your rights, or any other privacy-related matter, email closekit1@outlook.com.