Privacy Policy

1. Identity and Scope

This Privacy Policy explains how SwissMarketLab (“we”, “us”, “our”), registered in Switzerland and owned by Arnaud Alves, collects, uses, and protects information when you access or use Closify at closify.sbs and its subdomains (the “Service”).

By registering for an account or using Closify, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Data We Collect

We strictly limit our collection of personal data to what is necessary to operate our SaaS platform:

• Account Registration Information: When you sign up, we collect your full name, your work email address, and an encrypted password hash. We never store passwords in plaintext. When you confirm your email address, we store the date of confirmation; the link we email you carries a single-use code that expires after 24 hours, and we keep only a one-way hash of it. To keep one free account per inbox, we also store a simplified copy of your email address (lowercase, without a “+” suffix, and without dots for Gmail addresses); it is used only to spot duplicate sign-ups.
• Session Cookies & Local Storage: To maintain your signed-in state securely, our backend sets a strictly necessary, host-only, HttpOnly and Secure session refresh cookie (refresh_token). We do not use third-party analytics or advertising cookies. A single non-tracking UI preference (closify.sidebarCollapsed) is stored in your browser's local storage to remember your navigation sidebar toggle state.
• Usage and Quota Telemetry: When you log into the web application, temporary access tokens are held in client memory (never written to web storage). We monitor API request quotas (search credits and AI generation counters) associated with your user account.
• Customer Communications: If you contact us at contact@closify.sbs or privacy@closify.sbs, we retain your communication history to assist you.

3. Public Business Directory Data

Closify is a B2B sales enablement engine designed for agencies to identify local businesses that lack a modern web presence. In performing search requests initiated by our users:

• We query official third-party business directories, primarily the Google Places API (Google Maps Platform).
• We retrieve and display publicly accessible commercial details: business trade name, commercial category, public phone number, physical commercial address, star rating, opening hours, website status, and up to 5 public Google reviews (the review text and the reviewer’s public display name) strictly for preview copy generation.
• We do not collect private consumer home addresses, private financial records, or confidential personal communications. Third-party review details are utilized solely to summarize business highlights and services for the prospect.

4. AI & LLM Generation Disclosures

Closify generates demonstration landing page mockups using a commercial artificial intelligence API, the Google Gemini API (Google LLC):

• Only public business data from Google is passed to the AI model (Google Gemini) to compose the demonstration page: business name, category, address, phone number, rating, opening hours and up to 5 public Google reviews (their text and the reviewer’s public display name). When you regenerate a page, the change instructions you type are sent as well. After a page is written, its text is sent to Gemini a second time, together with the same business data, for an automatic accuracy check that removes claims the data does not support.
• We use the paid tier of the Gemini API. Under Google’s terms for paid API services, the data we send is not used to train or improve Google’s AI models.
• If Google’s service is unavailable, we may temporarily generate pages with Anthropic Claude (Anthropic PBC) instead, with the same data and the same commercial API terms (no training on the data we send).
• Generated preview mockups are sanitized with rigorous HTML allowlists and hosted as static demonstration files at isolated preview endpoints on preview.closify.sbs.

5. Third-Party Services and Preview Visitors

Some parts of Closify load content directly from other providers. When that happens, your browser (or the browser of the person viewing a shared preview) connects to that provider, which receives the visitor’s IP address and browser information (user agent) and handles it under its own privacy policy:

• Google Fonts (Google LLC): fonts on our website, in the app and in generated previews.
• OpenStreetMap (OpenStreetMap Foundation): the map tiles shown on the search page of the app. Place lookups for that map are made by our server through the Google Maps Platform, not by your browser.
• Pexels (Pexels GmbH): stock photos shown in generated previews are loaded from Pexels’ image servers. Our server searches Pexels with the business category and a few words from its reviews; no personal data is sent.
• Unsplash (Unsplash Inc.): stock photos shown in generated previews can also be loaded from Unsplash’s image servers (images.unsplash.com). Our server searches Unsplash with the business category and, at most, one generic keyword such as “pizza” or “yoga”; no personal data is sent.
• Google Places photos (Google LLC): public photos of the business shown in generated previews are fetched by our server and delivered from preview.closify.sbs, so the visitor’s browser does not connect to Google for them.
• Google Maps (Google LLC): the map embedded in generated previews.
• Google Gemini API (Google LLC): generates the preview pages from the public business data described in section 4. It is called by our server, never by the visitor’s browser. Anthropic (Anthropic PBC) is used only as a backup provider in the same way.

Shared previews contain no analytics, trackers or cookies, and are served with a no-referrer policy, so the providers above do not learn the preview link.

6. Payments and Billing Security

All payments (Starter and Pro subscriptions, and one-time $1.99 preview purchases) are processed directly by our merchant payment gateway partner, Stripe, Inc.

• Closify does not collect, process, or store credit card numbers, CVVs, or bank account credentials on its own servers.
• Stripe provides Closify with non-sensitive reference identifiers (e.g., Stripe Customer ID, Subscription ID, Checkout Session ID of a one-time purchase, amount paid, and payment status events) to manage your account quota and unlock what you paid for.
• All transaction data is encrypted in transit using industry-standard TLS encryption. You can manage payment methods and download invoices through the secure Stripe Customer Portal.

7. Local Business Owner Notice & Opt-Out

8. Data Storage, Hosting, and Retention

Our infrastructure is hosted on cloud servers operated by Hetzner Online GmbH in Germany (Nuremberg/Falkenstein data centers, European Union), adhering to ISO 27001 data center security standards.

• Account credentials and generated preview records are stored in PostgreSQL databases protected by strict firewall configurations and least-privilege network rules.
• Generated preview files are retained for the lifetime of your active account or until you delete them or your subscription lapses.
• If you close your account or request erasure, your personal account details are permanently expunged upon request within 30 days, except for transaction records required under Swiss commercial and tax laws.

9. Your Privacy Rights (Swiss nFADP, EU GDPR & US States)

Depending on your location, you have statutory rights regarding your personal information:

• Right of Access: You may request a copy of the personal information we hold about you.
• Right of Rectification: You may update or correct inaccurate account information directly in your dashboard or by contacting us.
• Right of Erasure (“Right to be Forgotten”): You may request the deletion of your account and associated personal data.
• Right to Restrict or Object: You may object to the processing of your information under specific legal grounds.
• US State Rights (CCPA / CPRA): We do not sell or share personal data for monetary or cross-context behavioral advertising.

To exercise any of these rights, contact us at privacy@closify.sbs. We reply to all verified requests within 30 days.

10. Contact Information & Data Controller

The responsible legal entity and data controller for Closify is:

SwissMarketLab
Owner: Arnaud Alves (Sole Proprietorship)
Switzerland
General Inquiries: hello@closify.sbs
Data Protection Officer / Privacy: privacy@closify.sbs