Privacy Policy

The Close Out ("we," "us") respects your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use thecloseout.io and related services (the "Platform").

1. Information We Collect

Account information: name, email, company, password (hashed), role, profile settings.

Subscription and billing: tier, subscription status, Stripe customer ID (we do NOT store card numbers).

Usage data: pages viewed, searches performed, saved-search filters, leads created, opportunities viewed, IP address, user agent, timestamps.

AI interactions: natural-language search queries, investment-analysis requests. Queries may be sent to third-party AI providers (Anthropic, OpenAI) via Emergent's LLM proxy for processing.

Communications: demo requests, contact-form submissions, support emails.

2. How We Use Your Information

• Provide, maintain, and improve the Platform
• Process subscriptions and payments via Stripe
• Send transactional and alert emails (via Resend)
• Generate AI-based scoring, search results, and analyses
• Prevent fraud, abuse, and enforce our Terms
• Comply with legal obligations

3. Third-Party Sub-Processors

• Stripe, Inc. — payment processing
• Anthropic (Claude) — AI text generation via Emergent LLM proxy
• Resend — transactional email delivery
• Google (Maps Embed API) — Street View and map rendering
• MongoDB Atlas — encrypted database hosting
• Emergent — application hosting infrastructure

4. Public Records Data

The Platform aggregates information from publicly available sources (government records, court filings, WARN notices, county assessors, etc.). This is not "your personal data" — it is public information about businesses and properties. We do not create dossiers on individuals for unlawful purposes and do not sell such data.

5. Data Sharing

We do NOT sell your personal data. We may share data: (a) with sub-processors listed above; (b) when required by law, subpoena, or court order; (c) to protect our rights, prevent fraud, or in an emergency; (d) with your consent; (e) in a merger, acquisition, or asset sale (with notice).

6. Data Retention

Account data is retained while your account is active plus a reasonable period thereafter for legal, tax, and audit compliance (typically 7 years for financial records). You may request deletion at any time (see Section 8).

7. Security

We use industry-standard safeguards including TLS encryption in transit, encrypted storage at rest, bcrypt password hashing, JWT-based session tokens, and optional two-factor authentication. No system is 100% secure — you use the Platform at your own risk. Report vulnerabilities to legal@thecloseout.io.

8. Your Rights (US, GDPR, CCPA)

Subject to applicable law you may: access your data, request correction, request deletion, request portability (export), object to processing, and withdraw consent. Email legal@thecloseout.io with your request. We respond within 30 days.

California residents (CCPA): we do not sell your personal information; you have the right to know, delete, and non-discrimination.

EU/UK residents (GDPR): we act as data controller for account data. Lawful basis: contract performance, legitimate interest, and consent.

9. Cookies and Tracking

We use essential cookies (auth tokens) and minimal analytics. We do NOT use third-party advertising trackers. Browser localStorage is used for session state.

10. Children's Privacy

The Platform is not intended for children under 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice.

12. Contact

Data protection officer: legal@thecloseout.io. Mail: The Close Out, 12606 225 St E, Graham, WA 98338, USA.